* [PATCH 5.10 000/491] 5.10.253-rc1 review
@ 2026-04-13 15:54 Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 001/491] ARM: clean up the memset64() C wrapper Greg Kroah-Hartman
` (495 more replies)
0 siblings, 496 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 5.10.253 release.
There are 491 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.253-rc1
Jens Axboe <axboe@kernel.dk>
io_uring/poll: correctly handle io_poll_add() return value on update
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
Yang Yingliang <yangyingliang@huawei.com>
device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
s390/syscalls: Add spectre boundary for syscall dispatch table
Yang Yang <n05ec@lzu.edu.cn>
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
device property: Allow secondary lookup in fwnode_get_next_child_node()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
device property: Allow error pointer to be passed to fwnode APIs
Daniel Scally <djrscally@gmail.com>
device property: Check fwnode->secondary when finding properties
Daniel Scally <djrscally@gmail.com>
device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
device property: Unify access to of_node
Andy Shevchenko <andy.shevchenko@gmail.com>
device property: Retrieve fwnode from of_node via accessor
Daniel Scally <djrscally@gmail.com>
media: device property: Return true in fwnode_device_is_available for NULL ops
Saravana Kannan <saravanak@google.com>
device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev()
Jaskaran Singh <jsingh@cloudlinux.com>
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
Jaskaran Singh <jsingh@cloudlinux.com>
Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()"
Penghe Geng <pgeng@nvidia.com>
mmc: core: Avoid bitfield RMW for claim/retune flags
Ulf Hansson <ulf.hansson@linaro.org>
mmc: core: Drop reference counting of the bus_ops
Ulf Hansson <ulf.hansson@linaro.org>
mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
Ulf Hansson <ulf.hansson@linaro.org>
mmc: core: Drop redundant member in struct mmc host
Maarten Lankhorst <dev@lankhorst.se>
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Li Chen <me@linux.beauty>
ext4: publish jinode after initialization
Baokun Li <libaokun@linux.alibaba.com>
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
Yuto Ohnuki <ytohnuki@amazon.com>
xfs: stop reclaim before pushing AIL during unmount
Yuto Ohnuki <ytohnuki@amazon.com>
xfs: save ailp before dropping the AIL lock in push callbacks
Zqiang <qiang.zhang@linux.dev>
ext4: fix the might_sleep() warnings in kvfree()
Jinjiang Tu <tujinjiang@huawei.com>
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
Kevin Hao <haokexin@gmail.com>
net: macb: Move devm_{free,request}_irq() out of spin lock area
Jimmy Hu <hhhuuu@google.com>
usb: gadget: uvc: fix NULL pointer dereference during unbind race
Kuen-Han Tsai <khtsai@google.com>
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
Michael Zimmermann <sigmaepsilon92@gmail.com>
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: rfkill: prevent unlimited numbers of rfkill events from being created
Andrea Mayer <andrea.mayer@uniroma2.it>
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
Guangshuo Li <lgs201920130244@gmail.com>
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
Liao Chang <liaochang1@huawei.com>
cpufreq: governor: Free dbs_data directly when gov->init() fails
Florian Westphal <fw@strlen.de>
netlink: add nla be16/32 types to minlen array
Jon Hunter <jonathanh@nvidia.com>
ASoC: tegra: Fix Master Volume Control
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: soc-core: don't use discriminatory terms on snd_soc_runtime_get_dai_fmt()
GuoHan Zhao <zhaoguohan@kylinos.cn>
xen/privcmd: unregister xenstore notifier on module exit
David Howells <dhowells@redhat.com>
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
Tyllis Xu <livelycarpet87@gmail.com>
net: stmmac: fix integer underflow in chain mode
Pengpeng Hou <pengpeng@iscas.ac.cn>
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
Johan Hovold <johan@kernel.org>
mmc: vub300: fix NULL-deref on disconnect
David Carlier <devnexen@gmail.com>
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
Ruide Cao <caoruide123@gmail.com>
batman-adv: reject oversized global TT response buffers
Pengpeng Hou <pengpeng@iscas.ac.cn>
nfc: pn533: allocate rx skb before consuming bytes
Shawn Guo <shawnguo@kernel.org>
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
Shawn Guo <shawnguo@kernel.org>
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
Thomas Fourier <fourier.thomas@gmail.com>
wifi: brcmsmac: Fix dma_free_coherent() size
Oleh Konko <security@1seal.org>
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
Tuan Do <tuan@calif.io>
netfilter: nft_ct: fix use-after-free in timeout object destroy
John Johansen <john.johansen@canonical.com>
apparmor: fix race between freeing data and fs accessing it
John Johansen <john.johansen@canonical.com>
apparmor: fix race on rawdata dereference
John Johansen <john.johansen@canonical.com>
apparmor: fix differential encoding verification
John Johansen <john.johansen@canonical.com>
apparmor: fix unprivileged local user can do privileged policy management
John Johansen <john.johansen@canonical.com>
apparmor: Fix double free of ns_name in aa_replace_profiles()
Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
apparmor: fix side-effect bug in match_char() macro usage
John Johansen <john.johansen@canonical.com>
apparmor: fix: limit the number of levels of policy namespaces
Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
apparmor: replace recursive profile removal with iterative approach
Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
apparmor: fix memory leak in verify_header
Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
apparmor: validate DFA start states are in bounds in unpack_pdb
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Use heuristic to find stream entity
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Implement UVC_EXT_GPIO_UNIT
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Allow extra entities
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Move guid to entity
David Hildenbrand (Red Hat) <david@kernel.org>
mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
David Hildenbrand (Red Hat) <david@kernel.org>
mm/rmap: fix two comments related to huge_pmd_unshare()
David Hildenbrand (Red Hat) <david@kernel.org>
mm/hugetlb: fix two comments related to huge_pmd_unshare()
David Hildenbrand (Red Hat) <david@kernel.org>
mm/hugetlb: fix hugetlb_pmd_shared()
Jane Chu <jane.chu@oracle.com>
mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
Miaohe Lin <linmiaohe@huawei.com>
mm/hugetlb: make detecting shared pte more reliable
David Hildenbrand (Arm) <david@kernel.org>
mm/hugetlb: fix skipping of unsharing of pmd page tables
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: uinput - take event lock when submitting FF request "event"
Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Input: uinput - fix circular locking dependency with ff-core
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xfrm_user: fix info leak in build_report()
Johan Hovold <johan@kernel.org>
wifi: rt2x00usb: fix devres lifetime
Eric Biggers <ebiggers@kernel.org>
lib/crypto: chacha: Zeroize permuted_state before it leaves scope
Jens Axboe <axboe@kernel.dk>
io_uring/tctx: work around xa_store() allocation error issue
Taegu Ha <hataegu0826@gmail.com>
usb: gadget: f_uac1_legacy: validate control request size
Kuen-Han Tsai <khtsai@google.com>
usb: gadget: f_rndis: Protect RNDIS options with mutex
Kuen-Han Tsai <khtsai@google.com>
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
Cengiz Can <cengiz.can@canonical.com>
nvmet-tcp: fix use-before-check of sg in bounds validation
Sebastian Urban <surban@surban.net>
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
Alan Stern <stern@rowland.harvard.edu>
USB: dummy-hcd: Fix locking/synchronization error
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
thunderbolt: Fix property read in nhi_wake_supported()
Yufan Chen <yufan.chen@linux.dev>
net: ftgmac100: fix ring allocation unwind on open failure
Yang Yang <n05ec@lzu.edu.cn>
vxlan: validate ND option lengths in vxlan_na_create
Yifan Wu <yifanwucs@gmail.com>
netfilter: ipset: drop logically empty buckets in mtype_del
Ian Abbott <abbotti@mev.co.uk>
comedi: me4000: Fix potential overrun of firmware buffer
Ian Abbott <abbotti@mev.co.uk>
comedi: me_daq: Fix potential overrun of firmware buffer
Ian Abbott <abbotti@mev.co.uk>
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
Ian Abbott <abbotti@mev.co.uk>
comedi: Reinit dev->spinlock between attachments to low-level drivers
Deepanshu Kartikey <kartikey406@gmail.com>
comedi: dt2815: add hardware detection to prevent crash
Oliver Neukum <oneukum@suse.com>
cdc-acm: new quirk for EPSON HMD
Yang Yang <n05ec@lzu.edu.cn>
bridge: br_nd_send: validate ND option lengths
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
Justin Chen <justin.chen@broadcom.com>
usb: ehci-brcm: fix sleep during atomic
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: Flush anchored URBs in usbtmc_release
Guangshuo Li <lgs201920130244@gmail.com>
usb: ulpi: fix double free in ulpi_register_interface() error path
Miao Li <limiao@kylinos.cn>
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
Ethan Tidmore <ethantidmore06@gmail.com>
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
Ethan Tidmore <ethantidmore06@gmail.com>
iio: gyro: mpu3050: Move iio_device_register() to correct location
Ethan Tidmore <ethantidmore06@gmail.com>
iio: gyro: mpu3050: Fix irq resource leak
Ethan Tidmore <ethantidmore06@gmail.com>
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Francesco Lavra <flavra@baylibre.com>
iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
David Lechner <dlechner@baylibre.com>
iio: light: vcnl4035: fix scan buffer on big-endian
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: dac: ad5770r: fix error return in ad5770r_read_raw()
Zoltan Illes <zoliviragh@gmail.com>
Input: xpad - add support for Razer Wolverine V3 Pro
Christoffer Sandberg <cs@tuxedo.de>
Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
Bart Van Assche <bvanassche@acm.org>
Input: synaptics-rmi4 - fix a locking bug in an error path
JP Hein <jp@jphein.com>
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
Wanquan Zhong <wanquan.zhong@fibocom.com>
USB: serial: option: add support for Rolling Wireless RW135R-GL
Frej Drejhammar <frej@stacken.kth.se>
USB: serial: io_edgeport: add support for Blackbox IC135A
Thomas Zimmermann <tzimmermann@suse.de>
drm/ast: dp501: Fix initialization of SCU2C
Sanman Pradhan <psanman@juniper.net>
hwmon: (occ) Fix division by zero in occ_show_power_1()
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: Fix the GCC version check for `__multi3' workaround
Oleh Konko <security@1seal.org>
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Oleh Konko <security@1seal.org>
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
Takashi Iwai <tiwai@suse.de>
ALSA: ctxfi: Fix missing SPDIFI1 index handling
Berk Cem Goksel <berkcgoksel@gmail.com>
ALSA: caiaq: fix stack out-of-bounds read in init_card
Ernestas Kulik <ernestas.k@iconn-networks.com>
USB: serial: option: add MeiG Smart SRM825WN
Yasuaki Torimaru <yasuakitorimaru@gmail.com>
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drm/ioc32: stop speculation on the drm_compat_ioctl path
Paul Walmsley <pjw@kernel.org>
riscv: kgdb: fix several debug register assignment bugs
Sanman Pradhan <psanman@juniper.net>
hwmon: (occ) Fix missing newline in occ_show_extended()
Sanman Pradhan <psanman@juniper.net>
hwmon: (pxe1610) Check return value of page-select write in probe
Alex Guo <alexguo1023@gmail.com>
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Sasha Levin <sashal@kernel.org>
Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
David Jeffery <djeffery@redhat.com>
scsi: core: Wake up the error handler when final completions race against each other
Sasha Levin <sashal@kernel.org>
Revert "scsi: core: Wake up the error handler when final completions race against each other"
Ian Forbes <ian.forbes@broadcom.com>
drm/vmwgfx: Add seqno waiter for sync_files
Sasha Levin <sashal@kernel.org>
Revert "drm/vmwgfx: Add seqno waiter for sync_files"
Ard Biesheuvel <ardb@kernel.org>
efi/mokvar-table: Avoid repeated map/unmap of the same page
Eric Dumazet <edumazet@google.com>
ipv6: avoid overflows in ip6_datagram_send_ctl()
Xiang Mei <xmei5@asu.edu>
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
Xiang Mei <xmei5@asu.edu>
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
Martin Schiller <ms@dev.tdt.de>
net/x25: Fix overflow when accumulating packets
Martin Schiller <ms@dev.tdt.de>
net/x25: Fix potential double free of skb
Saeed Mahameed <saeedm@nvidia.com>
net/mlx5: Avoid "No data available" when FW version queries fail
Fedor Pchelkin <pchelkin@ispras.ru>
net: macb: properly unregister fixed rate clocks
Fedor Pchelkin <pchelkin@ispras.ru>
net: macb: fix clk handling on PCI glue driver removal
Weiming Shi <bestswngs@gmail.com>
rds: ib: reject FRMR registration before IB connection is established
Keenan Dong <keenanat2000@gmail.com>
Bluetooth: MGMT: validate LTK enc_size on load
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: reject immediate NF_QUEUE verdict
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
Qi Tang <tpluszz77@gmail.com>
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
Qi Tang <tpluszz77@gmail.com>
netfilter: nf_conntrack_helper: pass helper to expect cleanup
Florian Westphal <fw@strlen.de>
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
Florian Westphal <fw@strlen.de>
netfilter: x_tables: ensure names are nul-terminated
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_log: account for netlink header size
Zhengchuan Liang <zcliangcn@gmail.com>
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
Alexei Starovoitov <ast@kernel.org>
bpf: Fix regsafe() for pointers to packet
Suraj Gupta <suraj.gupta2@amd.com>
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
Pengpeng Hou <pengpeng@iscas.ac.cn>
NFC: pn533: bound the UART receive buffer
Yochai Eisenrich <echelonh@gmail.com>
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
Paolo Abeni <pabeni@redhat.com>
ipv6: prevent possible UaF in addrconf_permanent_addr()
Xiang Mei <xmei5@asu.edu>
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
Yang Yang <n05ec@lzu.edu.cn>
bridge: br_nd_send: linearize skb before parsing ND options
Eric Dumazet <edumazet@google.com>
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
Eric Dumazet <edumazet@google.com>
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
Thomas Bogendoerfer <tbogendoerfer@suse.de>
tg3: Fix race for querying speed/duplex
Yochai Eisenrich <echelonh@gmail.com>
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
Jiayuan Chen <jiayuan.chen@shopee.com>
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
Loic Poulain <loic.poulain@linaro.org>
net: qrtr: Release distant nodes along the bridge node
Loic Poulain <loic.poulain@linaro.org>
net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet
Norbert Szetei <norbert@doyensec.com>
crypto: af-alg - fix NULL pointer dereference in scatterwalk
Lee Jones <lee@kernel.org>
HID: multitouch: Check to ensure report responses match the request
Josh Poimboeuf <jpoimboe@kernel.org>
objtool: Fix Clang jump table detection
Deepanshu Kartikey <kartikey406@gmail.com>
atm: lec: fix use-after-free in sock_def_readable()
Benoît Sevens <bsevens@google.com>
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
Davidlohr Bueso <dave@stgolabs.net>
futex: Clear stale exiting pointer in futex_lock_pi() retry path
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
dmaengine: xilinx_dma: Program interrupt delay timeout
Filipe Manana <fdmanana@suse.com>
btrfs: fix lost error when running device stats on multiple devices fs
Mark Harmstone <mark@harmstone.com>
btrfs: fix super block offset in error message in btrfs_validate_super()
Marek Vasut <marex@nabladev.com>
dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
Marek Vasut <marex@nabladev.com>
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
Marek Vasut <marex@nabladev.com>
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
Felix Gu <ustc.gu@gmail.com>
phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
Helen Koike <koike@igalia.com>
ext4: reject mount if bigalloc with s_first_data_block != 0
Ye Bin <yebin10@huawei.com>
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
Jan Kara <jack@suse.cz>
ext4: make recently_deleted() properly work with lazy itable initialization
Deepanshu Kartikey <kartikey406@gmail.com>
ext4: convert inline data to extents when truncate exceeds inline size
Milos Nikic <nikic.milos@gmail.com>
jbd2: gracefully abort on checkpointing state corruptions
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
scsi: ses: Handle positive SCSI error from ses_recv_diag()
Tyllis Xu <livelycarpet87@gmail.com>
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
Zhan Xusheng <zhanxusheng1024@gmail.com>
alarmtimer: Fix argument order in alarm_timer_forward()
xietangxin <xietangxin@yeah.net>
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Yuchan Nam <entropy1110@gmail.com>
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Viresh Kumar <viresh.kumar@linaro.org>
cpufreq: conservative: Reset requested_freq on limits change
Ali Norouzi <ali.norouzi@keysight.com>
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
Vasily Gorbik <gor@linux.ibm.com>
s390/barrier: Make array_index_mask_nospec() __always_inline
Marc Kleine-Budde <mkl@pengutronix.de>
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
Marc Buerg <buermarc@googlemail.com>
sysctl: fix uninitialized variable in proc_do_large_bitmap
Sanman Pradhan <psanman@juniper.net>
hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
Weiming Shi <bestswngs@gmail.com>
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: EC: Install address space handler at the namespace root
Hans de Goede <hdegoede@redhat.com>
ACPI: EC: Fix ECDT probe ordering issues
Hans de Goede <hdegoede@redhat.com>
ACPI: EC: Fix EC address space handler unregistration
Hans de Goede <hdegoede@redhat.com>
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
Hans de Goede <hdegoede@redhat.com>
ACPICA: include/acpi/acpixf.h: Fix indentation
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: catpt: Fix the device initialization
Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
Mike Rapoport (Microsoft) <rppt@kernel.org>
x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
Andy Lutomirski <luto@kernel.org>
x86/fault: Improve kernel-executing-user-memory handling
Andy Lutomirski <luto@kernel.org>
x86/fault: Fold mm_fault_error() into do_user_addr_fault()
Yihang Li <liyihang9@huawei.com>
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
Chuck Lever <chuck.lever@oracle.com>
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
regmap: Synchronize cache for the page selector
Paolo Valerio <pvalerio@redhat.com>
net: macb: use the current queue number for stats
David Carlier <devnexen@gmail.com>
netfilter: ctnetlink: use netlink policy range checks
Florian Westphal <fw@strlen.de>
netlink: allow be16 and be32 types in all uint policy checks
Florian Westphal <fw@strlen.de>
netlink: introduce bigendian integer types
Jakub Kicinski <kuba@kernel.org>
netlink: hide validation union fields from kdoc
Florian Westphal <fw@strlen.de>
netfilter: nft_payload: reject out-of-range attributes via policy
Florian Westphal <fw@strlen.de>
netlink: introduce NLA_POLICY_MAX_BE
Weiming Shi <bestswngs@gmail.com>
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
Ren Wei <n05ec@lzu.edu.cn>
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Weiming Shi <bestswngs@gmail.com>
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Pengpeng Hou <pengpeng@iscas.ac.cn>
Bluetooth: btusb: clamp SCO altsetting table indices
Hyunwoo Kim <imv4bel@gmail.com>
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Miguel Ojeda <ojeda@kernel.org>
dma-mapping: add missing `inline` for `dma_free_attrs`
Wei Fang <wei.fang@nxp.com>
net: enetc: fix the output issue of 'ethtool --show-ring'
Yochai Eisenrich <echelonh@gmail.com>
net: fix fanout UAF in packet_release() via NETDEV_UP race
Alok Tiwari <alok.a.tiwari@oracle.com>
platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
Sabrina Dubroca <sd@queasysnail.net>
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
Qi Tang <tpluszz77@gmail.com>
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
Yang Yang <n05ec@lzu.edu.cn>
openvswitch: validate MPLS set/set_masked payload length
Toke Høiland-Jørgensen <toke@redhat.com>
net: openvswitch: Avoid releasing netdev before teardown completes
Jakub Kicinski <kuba@kernel.org>
nfc: nci: fix circular locking dependency in nci_close_device
Luca Leonardo Scorcia <l.scorcia@gmail.com>
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Helen Koike <koike@igalia.com>
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Anas Iqbal <mohd.abd.6602@gmail.com>
Bluetooth: hci_ll: Fix firmware leak on error path
Hyunwoo Kim <imv4bel@gmail.com>
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Oliver Hartkopp <socketcan@hartkopp.net>
can: statistics: add missing atomic access in hot path
Eric Dumazet <edumazet@google.com>
af_key: validate families in pfkey_send_migrate()
Sabrina Dubroca <sd@queasysnail.net>
esp: fix skb leak with espintcp and async crypto
Steffen Klassert <steffen.klassert@secunet.com>
xfrm: Fix the usage of skb->sk
Sabrina Dubroca <sd@queasysnail.net>
xfrm: call xdo_dev_state_delete during state update
Uzair Mughal <contact@uzair.is-a.dev>
ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
Isaac J. Manjarres <isaacmanjarres@google.com>
dma-buf: Include ioctl.h in UAPI header
Mark Brown <broonie@kernel.org>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
Mark Brown <broonie@kernel.org>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
Romain Sioen <romain.sioen@microchip.com>
HID: mcp2221: cancel last I2C command on read error
Keith Busch <kbusch@kernel.org>
nvme-pci: ensure we're polling a polled queue
Hans de Goede <johannes.goede@oss.qualcomm.com>
platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
Leif Skunberg <diamondback@cohunt.app>
platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
Günther Noack <gnoack@google.com>
HID: asus: avoid memory leak in asus_report_fixup()
Danilo Krummrich <dakr@kernel.org>
sh: platform_early: remove pdev->driver_override check
Juergen Gross <jgross@suse.com>
xen/privcmd: add boot control for restricted usage in domU
Juergen Gross <jgross@suse.com>
xen/privcmd: restrict usage in unprivileged domU
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Josh Law <objecting@objecting.org>
tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
Kamal Dasu <kamal.dasu@broadcom.com>
mtd: rawnand: brcmnand: skip DMA during panic write
Kamal Dasu <kdasu.kdev@gmail.com>
mtd: rawnand: brcmnand: move to polling in pio mode on oops write
Kamal Dasu <kdasu.kdev@gmail.com>
mtd: rawnand: brcmnand: read/write oob during EDU transfer
Kamal Dasu <kamal.dasu@broadcom.com>
mtd: rawnand: serialize lock/unlock against other NAND operations
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
Sanman Pradhan <psanman@juniper.net>
hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
Weiming Shi <bestswngs@gmail.com>
icmp: fix NULL pointer dereference in icmp_tag_validation()
Anas Iqbal <mohd.abd.6602@gmail.com>
net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
Weiming Shi <bestswngs@gmail.com>
nfnetlink_osf: validate individual option lengths in fingerprints
Xiang Mei <xmei5@asu.edu>
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
Xiang Mei <xmei5@asu.edu>
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
Fedor Pchelkin <pchelkin@ispras.ru>
net: macb: fix uninitialized rx_fs_lock
Guenter Roeck <linux@roeck-us.net>
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
Xiang Mei <xmei5@asu.edu>
wifi: mac80211: fix NULL deref in mesh_matches_local()
Kohei Enju <kohei@enjuk.jp>
igc: fix missing update of skb->tail in igc_xmit_frame()
Nikola Z. Ivanov <zlatistiv@gmail.com>
net: usb: aqc111: Do not perform PM inside suspend callback
Bart Van Assche <bvanassche@acm.org>
PM: runtime: Fix a race condition related to device removal
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
sched: idle: Consolidate the handling of two special cases
Justin Chen <justin.chen@broadcom.com>
net: bcmgenet: increase WoL poll timeout
Jenny Guanni Qu <qguanni@gmail.com>
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
Jenny Guanni Qu <qguanni@gmail.com>
netfilter: xt_time: use unsigned int for monthday bit shift
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: xt_CT: drop pending enqueued packets on template removal
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_ct: drop pending enqueued packets on removal
Andrii Melnychenko <a.melnychenko@vyos.io>
netfilter: nft_ct: add seqadj extension for natted connections
Jenny Guanni Qu <qguanni@gmail.com>
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
Lukas Johannes Möller <research@johannes-moeller.dev>
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
Hyunwoo Kim <imv4bel@gmail.com>
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
Florian Westphal <fw@strlen.de>
netfilter: ctnetlink: remove refcounting in expectation dumpers
Jiayuan Chen <jiayuan.chen@shopee.com>
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: HIDP: Fix possible UAF
Christian Eggers <ceggers@arri.de>
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Christian Eggers <ceggers@arri.de>
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Christian Eggers <ceggers@arri.de>
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
Richard Genoud <richard.genoud@bootlin.com>
soc: fsl: qbman: fix race condition in qman_destroy_fq
Ethan Tidmore <ethantidmore06@gmail.com>
staging: rtl8723bs: fix null dereference in find_network
Eric Biggers <ebiggers@kernel.org>
net/tcp-md5: Fix MAC comparison to be constant-time
Eric Biggers <ebiggers@kernel.org>
smb: client: Compare MACs in constant time
Mehul Rao <mehulrao@gmail.com>
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
ALSA: pcm: fix wait_time calculations
Sean Christopherson <seanjc@google.com>
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
Marc Kleine-Budde <mkl@pengutronix.de>
can: gs_usb: gs_can_open(): always configure bitrates before starting device
Jiasheng Jiang <jiashengjiangcool@gmail.com>
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
Xu Yang <xu.yang_2@nxp.com>
usb: roles: get usb role switch from parent only for usb-b-connector
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix odr switch when turning buffer off
Maíra Canal <mcanal@igalia.com>
pmdomain: bcm: bcm2835-power: Increase ASB control timeout
Finn Thain <fthain@linux-m68k.org>
mtd: Avoid boot crash in RedBoot partition table parser
Corentin Labbe <clabbe@baylibre.com>
mtd: partitions: redboot: fix style issues
Jeff Layton <jlayton@kernel.org>
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
Chuck Lever <chuck.lever@oracle.com>
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
Tom Rix <trix@redhat.com>
nfsd: define exports_proc_ops with CONFIG_PROC_FS
Catalin Marinas <catalin.marinas@arm.com>
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
Thomas Fourier <fourier.thomas@gmail.com>
drm/msm: Fix dma_free_attrs() buffer size
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-sha204a - Fix OOM ->tfm_count leak
Long Li <leo.lilong@huawei.com>
xfs: fix integer overflow in bmap intent sort comparator
Long Li <leo.lilong@huawei.com>
xfs: ensure dquot item is deleted from AIL only after log shutdown
Harald Freudenberger <freude@linux.ibm.com>
s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix iface port assignment in parse_server_interfaces
Paulo Alcantara <pc@manguebit.org>
smb: client: fix atomic open with O_DIRECT & O_SYNC
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: light: bh1780: fix PM runtime leak on error path
Maíra Canal <mcanal@igalia.com>
pmdomain: bcm: bcm2835-power: Fix broken reset status read
Huiwen He <hehuiwen@kylinos.cn>
tracing: Fix syscall events activation by ensuring refcount hits zero
Darrick J. Wong <djwong@kernel.org>
iomap: reject delalloc mappings during writeback
Heiko Carstens <hca@linux.ibm.com>
s390/xor: Fix xor_xc_2() inline assembly constraints
Paul Moses <p@1g4.org>
net/sched: act_gate: snapshot parameters with RCU on replace
Natalie Vock <natalie.vock@gmx.de>
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
Andrew Lunn <andrew@lunn.ch>
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Thorsten Blum <thorsten.blum@linux.dev>
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
Daniil Dulov <d.dulov@aladdin.ru>
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
Vahagn Vardanian <vahagn@redrays.io>
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
Daniel Hodges <git@danielhodges.dev>
wifi: libertas: fix use-after-free in lbs_free_adapter()
Damien Le Moal <dlemoal@kernel.org>
ata: libata-scsi: refactor ata_scsi_translate()
Hannes Reinecke <hare@suse.de>
ata: libata: remove pointless VPRINTK() calls
Brian Foster <bfoster@redhat.com>
ext4: fix dirtyclusters double decrement on fs shutdown
Zhang Yi <yi.zhang@huawei.com>
ext4: drop extent cache when splitting extent fails
Zhang Yi <yi.zhang@huawei.com>
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
Jeongjun Park <aha310510@gmail.com>
drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
Jeongjun Park <aha310510@gmail.com>
drm/exynos: vidi: fix to avoid directly dereferencing user pointer
Jeongjun Park <aha310510@gmail.com>
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
Ankit Garg <nktgrg@google.com>
gve: defer interrupt enabling until NAPI registration
Frederic Weisbecker <frederic@kernel.org>
net: Handle napi_schedule() calls from non-interrupt
Alex Deucher <alexander.deucher@amd.com>
drm/radeon: apply state adjust rules to some additional HAINAN vairants
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Raul E Rangel <rrangel@chromium.org>
serial: 8250: Fix TX deadlock when using DMA
Martin Roukala (né Peres) <martin.roukala@mupuf.org>
serial: 8250_pci: add support for the AX99100
Guanghui Feng <guanghuifeng@linux.alibaba.com>
iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
Chen Ni <nichen@iscas.ac.cn>
mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
Luke Wang <ziniu.wang_1@nxp.com>
mmc: sdhci: fix timing selection for 1-bit bus width
Matthew Schwartz <matthew.schwartz@linux.dev>
mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
Lukas Johannes Möller <research@johannes-moeller.dev>
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Lukas Johannes Möller <research@johannes-moeller.dev>
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Fedor Pchelkin <pchelkin@ispras.ru>
net: macb: fix use-after-free access to PTP clock
Ian Ray <ian.ray@gehealthcare.com>
NFC: nxp-nci: allow GPIOs to sleep
Ira Weiny <ira.weiny@intel.com>
nvdimm/bus: Fix potential use after free in asynchronous initialization
Jeff Layton <jlayton@kernel.org>
sunrpc: fix cache_request leak in cache_release
Jens Axboe <axboe@kernel.dk>
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
Eric Dumazet <edumazet@google.com>
l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
Paul Chaignon <paul.chaignon@gmail.com>
bpf: Forget ranges when refining tnum after JSET
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix odr switch to the same value
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: gyro: mpu3050-i2c: fix pm_runtime error handling
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: gyro: mpu3050-core: fix pm_runtime error handling
Chris Spencer <spencercw@gmail.com>
iio: chemical: bme680: Fix measurement wait duration calculation
Lukas Schmid <lukas.schmid@netcube.li>
iio: potentiometer: mcp4131: fix double application of wiper shift
Oleksij Rempel <linux@rempel-privat.de>
iio: dac: ds4424: reject -128 RAW value
Filipe Manana <fdmanana@suse.com>
btrfs: abort transaction on failure to update root in the received subvol ioctl
Josh Law <objecting@objecting.org>
lib/bootconfig: check bounds before writing in __xbc_open_brace()
Josh Law <objecting@objecting.org>
lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
Shashank Balaji <shashank.mahadasyam@sony.com>
x86/apic: Disable x2apic on resume if the kernel expects so
Josh Law <objecting@objecting.org>
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
Calvin Owens <calvin@wbinvd.org>
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
Alysa Liu <Alysa.Liu@amd.com>
drm/amdgpu: Fix use-after-free race in VM acquire
Fan Wu <fanwu01@zju.edu.cn>
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Jian Zhang <zhangjian.3032@bytedance.com>
net: ncsi: fix skb leak in error paths
Helge Deller <deller@gmx.de>
parisc: Fix initial page table creation for boot
Dave Airlie <airlied@redhat.com>
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
Helge Deller <deller@gmx.de>
parisc: Increase initial mapping to 64 MB with KALLSYMS
Sven Eckelmann <sven@narfation.org>
batman-adv: Avoid double-rtnl_lock ELP metric worker
Ariel Silver <arielsilver77@gmail.com>
media: dvb-net: fix OOB access in ULE extension header tables
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
Luka Gejak <luka.gejak@linux.dev>
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
Marc Zyngier <maz@kernel.org>
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
Steven Rostedt <rostedt@goodmis.org>
time/jiffies: Mark jiffies_64_to_clock_t() notrace
Randy Dunlap <rdunlap@infradead.org>
time: add kernel-doc in time.c
Max Kellermann <max.kellermann@ionos.com>
ceph: fix i_nlink underrun during async unlink
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
Mehul Rao <mehulrao@gmail.com>
tipc: fix divide-by-zero in tipc_sk_filter_connect()
Felix Gu <ustc.gu@gmail.com>
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
Kalesh Singh <kaleshsingh@google.com>
mm/tracing: rss_stat: ensure curr is false from kthread context
Ziyi Guo <n7l8m4@u.northwestern.edu>
usb: image: mdc800: kill download URB on timeout
Oliver Neukum <oneukum@suse.com>
usb: mdc800: handle signal and read racing
Fan Wu <fanwu01@zju.edu.cn>
usb: renesas_usbhs: fix use-after-free in ISR during device removal
Oliver Neukum <oneukum@suse.com>
usb: class: cdc-wdm: fix reordering issue in read code path
Alan Stern <stern@rowland.harvard.edu>
USB: core: Limit the length of unkillable synchronous timeouts
Alan Stern <stern@rowland.harvard.edu>
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
Alan Stern <stern@rowland.harvard.edu>
USB: usbcore: Introduce usb_bulk_msg_killable()
Marc Zyngier <maz@kernel.org>
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
Gabor Juhos <j4g8y7@gmail.com>
usb: core: don't power off roothub PHYs if phy_set_mode() fails
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: misc: uss720: properly clean up reference in uss720_probe()
Oliver Neukum <oneukum@suse.com>
usb: yurex: fix race in probe
Zilin Guan <zilin@seu.edu.cn>
usb: xhci: Fix memory leak in xhci_disable_slot()
Christoffer Sandberg <cs@tuxedo.de>
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
Oleksij Rempel <linux@rempel-privat.de>
net: usb: lan78xx: skip LTM configuration for LAN7850
Oleksij Rempel <linux@rempel-privat.de>
net: usb: lan78xx: fix silent drop of packets with checksum errors
Qingye Zhao <zhaoqingye@honor.com>
cgroup: fix race between task migration and iteration
Casey Connolly <casey.connolly@linaro.org>
ASoC: detect empty DMI strings
Chen Ni <nichen@iscas.ac.cn>
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
Ben Dooks <ben.dooks@codethink.co.uk>
ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
Matt Vollrath <tactii@gmail.com>
e1000/e1000e: Fix leak in DMA error cleanup
Alok Tiwari <alok.a.tiwari@oracle.com>
i40e: fix src IP mask checks and memcpy argument names in cloud filter
Sungwoo Kim <iam@sung-woo.kim>
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
sched: idle: Make skipping governor callbacks more consistent
Peng Fan <peng.fan@nxp.com>
regulator: pca9450: Correct interrupt type
Frieder Schrempf <frieder.schrempf@kontron.de>
regulator: pca9450: Make IRQ optional
Yuan Tan <tanyuan98@outlook.com>
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
Hyunwoo Kim <imv4bel@gmail.com>
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Hyunwoo Kim <imv4bel@gmail.com>
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
David Dull <monderasdor@gmail.com>
netfilter: x_tables: guard option walkers against 1-byte tail reads
Jenny Guanni Qu <qguanni@gmail.com>
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
Wenyuan Li <2063309626@qq.com>
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
serial: caif: hold tty->link reference in ldisc_open and ser_release
matteo.cotifava <cotifavamatteo@gmail.com>
ASoC: soc-core: flush delayed work before removing DAIs and widgets
Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
ASoC: core: Do not call link_exit() on uninitialized rtd objects
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: core: Exit all links before removing their components
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
ASoC: don't indicate error message for snd_soc_[pcm_]dai_xxx()
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: topology: use inclusive language for bclk and fsync
matteo.cotifava <cotifavamatteo@gmail.com>
ASoC: soc-core: drop delayed_work_pending() check before flush
Weiming Shi <bestswngs@gmail.com>
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
Gal Pressman <gal@nvidia.com>
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Hangbin Liu <liuhangbin@gmail.com>
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
J. Neuschäfer <j.ne@posteo.net>
powerpc: 83xx: km83xx: Fix keymile vendor prefix
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
remoteproc: sysmon: Correct subsys_name_len type in QMI request
Christophe Leroy (CS GROUP) <chleroy@kernel.org>
powerpc/uaccess: Fix inline assembly for clang build on PPC32
Tomas Henzl <thenzl@redhat.com>
scsi: ses: Fix devices attaching to different hosts
Sofia Schneider <sofia@schn.dev>
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
Al Viro <viro@zeniv.linux.org.uk>
unshare: fix unshare_fs() handling
Piotr Mazek <pmazek@outlook.com>
ACPI: PM: Save NVS memory on Lenovo G70-35
Jan Kiszka <jan.kiszka@siemens.com>
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
Jiayuan Chen <jiayuan.chen@shopee.com>
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
Fernando Fernandez Mancera <fmancera@suse.de>
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
Fernando Fernandez Mancera <fmancera@suse.de>
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
Jakub Kicinski <kuba@kernel.org>
nfc: rawsock: cancel tx_work before socket teardown
Jakub Kicinski <kuba@kernel.org>
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
Jakub Kicinski <kuba@kernel.org>
nfc: nci: free skb on nci_transceive early error paths
Ian Ray <ian.ray@gehealthcare.com>
net: nfc: nci: Fix zero-length proprietary notifications
Raju Rangoju <Raju.Rangoju@amd.com>
amd-xgbe: fix sleep while atomic on suspend/resume
Jakub Kicinski <kuba@kernel.org>
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
David Thomson <dt@linux-mail.net>
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
Eric Dumazet <edumazet@google.com>
indirect_call_wrapper: do not reevaluate function pointer
Bart Van Assche <bvanassche@acm.org>
wifi: wlcore: Fix a locking bug
Bart Van Assche <bvanassche@acm.org>
wifi: cw1200: Fix locking in error paths
Alban Bedel <alban.bedel@lht.dlh.de>
can: mcp251x: fix deadlock in error path of mcp251x_open
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix locking for bcm_op runtime updates
Jiayuan Chen <jiayuan.chen@shopee.com>
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
Chintan Vankar <c-vankar@ti.com>
net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
Jonathan Teh <jonathan.teh@outlook.com>
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
Paolo Abeni <pabeni@redhat.com>
selftests: mptcp: more stable simult_flows tests
Lars Ellenberg <lars.ellenberg@linbit.com>
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Phillip Lougher <phillip@squashfs.org.uk>
Squashfs: check metadata block offset is within range
Davide Caratti <dcaratti@redhat.com>
net/sched: ets: fix divide by zero in the offload path
Jason Gunthorpe <jgg@ziepe.ca>
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
Johannes Berg <johannes.berg@intel.com>
wifi: radiotap: reject radiotap with unknown bits
Jun Seo <jun.seo.93@proton.me>
ALSA: usb-audio: Use correct version for UAC3 header validation
Mike Rapoport (Microsoft) <rppt@kernel.org>
x86/efi: defer freeing of boot services memory
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
can: ucan: Fix infinite loop from zero-length messages
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: usb: pegasus: validate USB endpoints
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: usb: kalmia: validate USB endpoints
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: usb: kaweth: validate USB endpoints
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nfc: pn533: properly drop the usb interface reference on disconnect
Jens Axboe <axboe@kernel.dk>
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
Ethan Nelson-Moore <enelsonmoore@gmail.com>
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
Takashi Iwai <tiwai@suse.de>
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
Gui-Dong Han <hanguidong02@gmail.com>
hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
Takashi Iwai <tiwai@suse.de>
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
Johan Hovold <johan@kernel.org>
clk: tegra: tegra124-emc: fix device leak on set_rate()
Johan Hovold <johan@kernel.org>
bus: omap-ocp2scp: fix OF populate on driver rebind
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
bus: omap-ocp2scp: Convert to platform remove callback returning void
Johan Hovold <johan@kernel.org>
drm/tegra: dsi: fix device leak on probe
Gui-Dong Han <hanguidong02@gmail.com>
bus: fsl-mc: fix use-after-free in driver_override_show()
Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions
Wentao Liang <vulab@iscas.ac.cn>
ARM: omap2: Fix reference count leaks in omap_control_init()
Wang Qing <wangqing@vivo.com>
ARM: OMAP2+: add missing of_node_put before break and return
Mark Harmstone <mark@harmstone.com>
btrfs: fix incorrect key offset in error message in check_dev_extent_item()
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Cap the packet size pre-calculations
Peter Wang <peter.wang@mediatek.com>
scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
Mathias Krause <minipli@grsecurity.net>
scsi: lpfc: Properly set WC for DPP mapping
Ben Hutchings <ben@decadent.org.uk>
ip6_tunnel: Fix usage of skb_vlan_inet_prepare()
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
ARM: clean up the memset64() C wrapper
-------------
Diffstat:
Documentation/hwmon/adm1177.rst | 8 +-
Makefile | 4 +-
arch/arm/include/asm/string.h | 14 +-
arch/arm/mach-omap2/cm_common.c | 8 +-
arch/arm/mach-omap2/control.c | 29 +-
arch/arm/mach-omap2/prm_common.c | 8 +-
.../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +-
arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 +
arch/arm64/include/asm/pgtable-prot.h | 10 +-
arch/mips/lib/multi3.c | 6 +-
arch/parisc/include/asm/pgtable.h | 2 +-
arch/parisc/kernel/head.S | 7 +-
arch/powerpc/include/asm/uaccess.h | 2 +-
arch/powerpc/platforms/83xx/km83xx.c | 4 +-
arch/riscv/kernel/kgdb.c | 7 +-
arch/s390/include/asm/barrier.h | 4 +-
arch/s390/kernel/entry.S | 7 +-
arch/s390/lib/xor.c | 4 +-
arch/sh/drivers/platform_early.c | 4 -
arch/x86/include/asm/efi.h | 2 +-
arch/x86/kernel/apic/apic.c | 6 +
arch/x86/kvm/svm/avic.c | 2 +-
arch/x86/kvm/svm/svm.c | 2 +-
arch/x86/mm/fault.c | 118 +++----
arch/x86/platform/efi/efi.c | 2 +-
arch/x86/platform/efi/quirks.c | 55 +++-
crypto/af_alg.c | 4 +-
drivers/acpi/acpica/evxfregn.c | 92 +++++-
drivers/acpi/ec.c | 49 ++-
drivers/acpi/osi.c | 13 +
drivers/acpi/osl.c | 2 +-
drivers/acpi/sleep.c | 8 +
drivers/ata/libata-core.c | 3 -
drivers/ata/libata-sata.c | 2 -
drivers/ata/libata-scsi.c | 123 +++-----
drivers/ata/libata-sff.c | 4 -
drivers/ata/libata.h | 1 -
drivers/base/power/runtime.c | 1 +
drivers/base/property.c | 205 ++++++++----
drivers/base/regmap/regmap.c | 30 +-
drivers/block/drbd/drbd_actlog.c | 53 ++--
drivers/block/drbd/drbd_interval.h | 5 +-
drivers/bluetooth/btusb.c | 5 +-
drivers/bluetooth/hci_ll.c | 2 +
drivers/bus/fsl-mc/fsl-mc-bus.c | 10 +-
drivers/bus/omap-ocp2scp.c | 19 +-
drivers/clk/tegra/clk-tegra124-emc.c | 2 +-
drivers/cpufreq/cpufreq_conservative.c | 12 +
drivers/cpufreq/cpufreq_governor.c | 13 +-
drivers/cpufreq/cpufreq_governor.h | 1 +
drivers/cpuidle/cpuidle.c | 10 -
drivers/crypto/atmel-sha204a.c | 5 +-
drivers/dma/xilinx/xilinx_dma.c | 66 ++--
drivers/firmware/efi/mokvar-table.c | 20 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +-
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
drivers/gpu/drm/ast/ast_dp501.c | 2 +-
drivers/gpu/drm/drm_file.c | 5 +-
drivers/gpu/drm/drm_ioc32.c | 2 +
drivers/gpu/drm/drm_mode_config.c | 9 +-
drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 +
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 72 ++++-
drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +-
drivers/gpu/drm/msm/msm_gpummu.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +
drivers/gpu/drm/radeon/si_dpm.c | 4 +-
drivers/gpu/drm/tegra/dsi.c | 6 +-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 +-
drivers/hid/hid-asus.c | 15 +-
drivers/hid/hid-cmedia.c | 2 +-
drivers/hid/hid-creative-sb0540.c | 2 +-
drivers/hid/hid-mcp2221.c | 2 +
drivers/hid/hid-multitouch.c | 7 +
drivers/hid/hid-zydacron.c | 2 +-
drivers/hid/wacom_wac.c | 10 +
drivers/hwmon/adm1177.c | 54 ++--
drivers/hwmon/max16065.c | 26 +-
drivers/hwmon/occ/common.c | 19 +-
drivers/hwmon/pmbus/isl68137.c | 7 +-
drivers/hwmon/pmbus/pxe1610.c | 5 +-
drivers/i2c/busses/i2c-fsi.c | 1 +
drivers/iio/chemical/bme680_core.c | 2 +-
drivers/iio/dac/ad5770r.c | 2 +-
drivers/iio/dac/ds4424.c | 2 +-
drivers/iio/gyro/mpu3050-core.c | 50 ++-
drivers/iio/gyro/mpu3050-i2c.c | 3 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 +
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 +
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 +
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 +
drivers/iio/light/bh1780.c | 4 +-
drivers/iio/light/vcnl4035.c | 18 +-
drivers/iio/potentiometer/mcp4131.c | 2 +-
drivers/infiniband/core/rw.c | 27 +-
drivers/infiniband/hw/mthca/mthca_provider.c | 5 +-
drivers/input/joystick/xpad.c | 2 +
drivers/input/misc/uinput.c | 35 ++-
drivers/input/rmi4/rmi_f54.c | 4 +-
drivers/input/serio/i8042-acpipnpio.h | 7 +
drivers/iommu/intel/dmar.c | 3 +-
drivers/irqchip/irq-gic-v3-its.c | 4 +
drivers/media/dvb-core/dmxdev.c | 4 +-
drivers/media/dvb-core/dvb_net.c | 3 +
drivers/media/dvb-frontends/dib7000p.c | 10 +-
drivers/media/mc/mc-request.c | 5 +
drivers/media/usb/uvc/uvc_ctrl.c | 33 +-
drivers/media/usb/uvc/uvc_driver.c | 234 ++++++++++++--
drivers/media/usb/uvc/uvc_entity.c | 1 +
drivers/media/usb/uvc/uvcvideo.h | 27 +-
drivers/media/v4l2-core/v4l2-ioctl.c | 5 +-
drivers/mmc/core/block.c | 2 +-
drivers/mmc/core/core.c | 110 +------
drivers/mmc/host/mmci_qcom_dml.c | 1 +
drivers/mmc/host/sdhci-pci-gli.c | 9 +
drivers/mmc/host/sdhci.c | 9 +-
drivers/mmc/host/vub300.c | 2 +-
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 63 +++-
drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +-
drivers/mtd/nand/raw/nand_base.c | 14 +-
drivers/mtd/parsers/redboot.c | 71 +++--
drivers/net/arcnet/com20020-pci.c | 16 +-
drivers/net/bonding/bond_debugfs.c | 16 +-
drivers/net/bonding/bond_main.c | 8 +-
drivers/net/caif/caif_serial.c | 3 +
drivers/net/can/spi/hi311x.c | 5 +-
drivers/net/can/spi/mcp251x.c | 15 +-
drivers/net/can/usb/ems_usb.c | 7 +-
drivers/net/can/usb/gs_usb.c | 13 +-
drivers/net/can/usb/ucan.c | 2 +-
drivers/net/dsa/bcm_sf2.c | 8 +-
drivers/net/ethernet/altera/altera_tse_main.c | 1 +
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 -
drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 -
drivers/net/ethernet/amd/xgbe/xgbe.h | 3 -
drivers/net/ethernet/arc/emac_main.c | 11 +
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +-
drivers/net/ethernet/broadcom/tg3.c | 2 +-
drivers/net/ethernet/cadence/macb_main.c | 18 +-
drivers/net/ethernet/cadence/macb_pci.c | 10 +-
drivers/net/ethernet/cadence/macb_ptp.c | 4 +-
drivers/net/ethernet/faraday/ftgmac100.c | 28 +-
.../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +
drivers/net/ethernet/google/gve/gve.h | 1 +
drivers/net/ethernet/google/gve/gve_main.c | 5 +-
drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -
drivers/net/ethernet/intel/e1000e/netdev.c | 2 -
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +-
drivers/net/ethernet/intel/igc/igc_main.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +-
.../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 -
drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-
.../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +-
drivers/net/ethernet/qualcomm/qca_uart.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +-
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +-
drivers/net/ethernet/ti/cpsw_ale.c | 9 +-
drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +-
drivers/net/phy/phy_device.c | 13 +-
drivers/net/usb/aqc111.c | 12 +-
drivers/net/usb/kalmia.c | 7 +
drivers/net/usb/kaweth.c | 13 +
drivers/net/usb/lan78xx.c | 8 +-
drivers/net/usb/lan78xx.h | 3 +
drivers/net/usb/pegasus.c | 13 +-
drivers/net/virtio_net.c | 1 +
drivers/net/vxlan/vxlan_core.c | 11 +-
.../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +-
drivers/net/wireless/marvell/libertas/main.c | 4 +-
drivers/net/wireless/microchip/wilc1000/hif.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +-
drivers/net/wireless/st/cw1200/pm.c | 2 +
drivers/net/wireless/ti/wlcore/main.c | 4 +-
drivers/net/wireless/ti/wlcore/tx.c | 2 +-
drivers/nfc/nxp-nci/i2c.c | 4 +-
drivers/nfc/pn533/uart.c | 14 +-
drivers/nfc/pn533/usb.c | 1 +
drivers/nvdimm/bus.c | 5 +-
drivers/nvme/host/fc.c | 2 +-
drivers/nvme/host/pci.c | 5 +-
drivers/nvme/target/tcp.c | 6 +-
drivers/pci/pci-driver.c | 8 -
drivers/pci/pci.c | 10 +-
drivers/pci/pci.h | 1 -
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 122 +++++---
drivers/phy/ti/phy-j721e-wiz.c | 2 +
drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +-
drivers/platform/olpc/olpc-xo175-ec.c | 2 +-
drivers/platform/x86/intel-hid.c | 7 +
drivers/platform/x86/thinkpad_acpi.c | 6 +-
drivers/platform/x86/touchscreen_dmi.c | 18 ++
drivers/regulator/pca9450-regulator.c | 41 ++-
drivers/remoteproc/qcom_sysmon.c | 2 +-
drivers/s390/crypto/zcrypt_ccamisc.c | 12 +-
drivers/s390/crypto/zcrypt_cex4.c | 3 +-
drivers/scsi/ibmvscsi/ibmvfc.c | 3 +-
drivers/scsi/lpfc/lpfc_init.c | 2 +
drivers/scsi/lpfc/lpfc_sli.c | 36 ++-
drivers/scsi/lpfc/lpfc_sli4.h | 3 +
drivers/scsi/scsi_lib.c | 3 +-
drivers/scsi/scsi_transport_sas.c | 2 +-
drivers/scsi/ses.c | 7 +-
drivers/scsi/storvsc_drv.c | 5 +-
drivers/scsi/ufs/ufshcd.c | 18 +-
drivers/soc/bcm/bcm2835-power.c | 33 +-
drivers/soc/fsl/qbman/qman.c | 24 +-
drivers/spi/spi-fsl-lpspi.c | 3 +-
drivers/staging/comedi/drivers.c | 8 +
drivers/staging/comedi/drivers/dt2815.c | 12 +
drivers/staging/comedi/drivers/me4000.c | 16 +-
drivers/staging/comedi/drivers/me_daq.c | 35 ++-
drivers/staging/comedi/drivers/ni_atmio16d.c | 3 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 16 +-
drivers/staging/rtl8723bs/core/rtw_mlme.c | 13 +-
drivers/thunderbolt/nhi.c | 2 +-
drivers/tty/serial/8250/8250_dma.c | 15 +
drivers/tty/serial/8250/8250_pci.c | 17 +
drivers/tty/serial/8250/8250_port.c | 6 +
drivers/usb/class/cdc-acm.c | 14 +
drivers/usb/class/cdc-acm.h | 2 +
drivers/usb/class/cdc-wdm.c | 4 +-
drivers/usb/class/usbtmc.c | 9 +-
drivers/usb/common/ulpi.c | 5 +-
drivers/usb/core/message.c | 97 ++++--
drivers/usb/core/phy.c | 8 +-
drivers/usb/core/quirks.c | 7 +
drivers/usb/gadget/function/f_hid.c | 11 +-
drivers/usb/gadget/function/f_rndis.c | 3 +
drivers/usb/gadget/function/f_subset.c | 7 +
drivers/usb/gadget/function/f_tcm.c | 14 +
drivers/usb/gadget/function/f_uac1_legacy.c | 47 ++-
drivers/usb/gadget/function/f_uvc.c | 46 ++-
drivers/usb/gadget/function/u_ether.c | 8 +-
drivers/usb/gadget/function/uvc.h | 3 +
drivers/usb/gadget/function/uvc_v4l2.c | 13 +-
drivers/usb/gadget/udc/dummy_hcd.c | 13 +-
drivers/usb/host/ehci-brcm.c | 4 +-
drivers/usb/host/xhci.c | 4 +-
drivers/usb/image/mdc800.c | 6 +-
drivers/usb/misc/uss720.c | 2 +-
drivers/usb/misc/yurex.c | 2 +-
drivers/usb/renesas_usbhs/common.c | 9 +
drivers/usb/roles/class.c | 7 +-
drivers/usb/serial/io_edgeport.c | 3 +
drivers/usb/serial/io_usbvend.h | 1 +
drivers/usb/serial/option.c | 4 +
drivers/xen/privcmd.c | 76 ++++-
drivers/xen/xen-acpi-processor.c | 7 +-
fs/btrfs/disk-io.c | 4 +-
fs/btrfs/ioctl.c | 3 +-
fs/btrfs/tree-checker.c | 2 +-
fs/btrfs/volumes.c | 5 +-
fs/ceph/dir.c | 15 +-
fs/cifs/cifsencrypt.c | 3 +-
fs/cifs/cifsglob.h | 11 +
fs/cifs/connect.c | 1 -
fs/cifs/dir.c | 1 +
fs/cifs/file.c | 17 +-
fs/cifs/smb2ops.c | 18 +-
fs/cifs/smb2transport.c | 4 +-
fs/ext4/extents.c | 22 +-
fs/ext4/fast_commit.c | 17 +-
fs/ext4/ialloc.c | 6 +
fs/ext4/inode.c | 27 +-
fs/ext4/mballoc.c | 37 +--
fs/ext4/super.c | 13 +-
fs/iomap/buffered-io.c | 7 +-
fs/jbd2/checkpoint.c | 15 +-
fs/nfsd/nfs4xdr.c | 9 +-
fs/nfsd/nfsctl.c | 31 +-
fs/nfsd/state.h | 17 +-
fs/squashfs/cache.c | 3 +
fs/xfs/xfs_bmap_item.c | 3 +-
fs/xfs/xfs_dquot.c | 8 +-
fs/xfs/xfs_dquot_item.c | 9 +-
fs/xfs/xfs_inode_item.c | 9 +-
fs/xfs/xfs_mount.c | 7 +-
include/acpi/acpixf.h | 138 +++++----
include/asm-generic/tlb.h | 77 ++++-
include/linux/dma-mapping.h | 4 +-
include/linux/fwnode.h | 10 +-
include/linux/hugetlb.h | 17 +-
include/linux/indirect_call_wrapper.h | 18 +-
include/linux/irqchip/arm-gic-v3.h | 1 +
include/linux/mm_types.h | 2 +
include/linux/mmc/host.h | 12 +-
include/linux/netfilter/ipset/ip_set.h | 2 +-
include/linux/property.h | 5 +-
include/linux/security.h | 1 +
include/linux/swapops.h | 6 +
include/linux/usb.h | 8 +-
include/net/netfilter/nf_conntrack_timeout.h | 1 +
include/net/netfilter/nf_tables.h | 5 +
include/net/netlink.h | 39 ++-
include/net/tc_act/tc_gate.h | 33 +-
include/net/udp_tunnel.h | 2 +-
include/sound/soc-dai.h | 85 ++++-
include/sound/soc.h | 2 +
include/trace/events/kmem.h | 8 +-
include/uapi/linux/dma-buf.h | 1 +
include/uapi/linux/netfilter/nf_conntrack_common.h | 4 +
include/uapi/sound/asoc.h | 22 +-
io_uring/io-wq.c | 2 +-
io_uring/io_uring.c | 39 ++-
kernel/bpf/verifier.c | 11 +-
kernel/cgroup/cgroup.c | 1 +
kernel/fork.c | 2 +-
kernel/futex/core.c | 3 +-
kernel/sched/idle.c | 39 ++-
kernel/sysctl.c | 2 +-
kernel/time/alarmtimer.c | 2 +-
kernel/time/time.c | 171 +++++++++-
kernel/trace/trace.c | 6 +-
kernel/trace/trace_events.c | 51 ++-
lib/bootconfig.c | 6 +-
lib/crypto/chacha.c | 4 +
lib/nlattr.c | 22 ++
mm/hugetlb.c | 143 ++++-----
mm/mmu_gather.c | 36 +++
mm/rmap.c | 20 +-
net/atm/lec.c | 98 +++---
net/atm/lec.h | 2 +-
net/batman-adv/bat_iv_ogm.c | 3 +
net/batman-adv/bat_v_elp.c | 10 +-
net/batman-adv/hard-interface.c | 8 +-
net/batman-adv/hard-interface.h | 1 +
net/batman-adv/translation-table.c | 9 +-
net/bluetooth/hidp/core.c | 16 +-
net/bluetooth/l2cap_core.c | 55 +++-
net/bluetooth/l2cap_sock.c | 3 +
net/bluetooth/mgmt.c | 3 +
net/bluetooth/smp.c | 13 +-
net/bridge/br_arp_nd_proxy.c | 18 +-
net/bridge/br_device.c | 2 +-
net/bridge/br_input.c | 2 +-
net/can/af_can.c | 4 +-
net/can/af_can.h | 2 +-
net/can/bcm.c | 1 +
net/can/gw.c | 6 +-
net/can/proc.c | 3 +-
net/ceph/auth.c | 6 +-
net/core/dev.c | 2 +-
net/core/rtnetlink.c | 9 +-
net/ipv4/esp4.c | 11 +-
net/ipv4/icmp.c | 4 +-
net/ipv4/tcp_ipv4.c | 5 +-
net/ipv6/addrconf.c | 6 +-
net/ipv6/datagram.c | 10 +
net/ipv6/esp6.c | 11 +-
net/ipv6/icmp.c | 3 +
net/ipv6/ip6_flowlabel.c | 5 -
net/ipv6/ip6_tunnel.c | 7 +-
net/ipv6/ndisc.c | 3 +
net/ipv6/netfilter/ip6t_rt.c | 4 +
net/ipv6/route.c | 11 +-
net/ipv6/seg6_iptunnel.c | 34 +-
net/ipv6/tcp_ipv6.c | 5 +-
net/ipv6/xfrm6_output.c | 4 +-
net/key/af_key.c | 19 +-
net/l2tp/l2tp_ppp.c | 25 +-
net/mac80211/mesh.c | 6 +
net/ncsi/ncsi-aen.c | 3 +-
net/ncsi/ncsi-rsp.c | 16 +-
net/netfilter/ipset/ip_set_core.c | 4 +-
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_list_set.c | 4 +-
net/netfilter/nf_conntrack_expect.c | 4 +
net/netfilter/nf_conntrack_h323_asn1.c | 4 +
net/netfilter/nf_conntrack_helper.c | 2 +-
net/netfilter/nf_conntrack_netlink.c | 89 +++---
net/netfilter/nf_conntrack_proto_tcp.c | 10 +-
net/netfilter/nf_conntrack_sip.c | 20 +-
net/netfilter/nf_tables_api.c | 12 +-
net/netfilter/nfnetlink_cthelper.c | 8 +-
net/netfilter/nfnetlink_log.c | 10 +-
net/netfilter/nfnetlink_osf.c | 13 +
net/netfilter/nfnetlink_queue.c | 4 +-
net/netfilter/nft_ct.c | 11 +-
net/netfilter/nft_payload.c | 6 +-
net/netfilter/nft_set_pipapo.c | 46 ++-
net/netfilter/nft_set_pipapo.h | 2 +
net/netfilter/x_tables.c | 23 ++
net/netfilter/xt_CT.c | 4 +
net/netfilter/xt_IDLETIMER.c | 6 +
net/netfilter/xt_cgroup.c | 6 +
net/netfilter/xt_dccp.c | 4 +-
net/netfilter/xt_rateest.c | 5 +
net/netfilter/xt_tcpudp.c | 6 +-
net/netfilter/xt_time.c | 4 +-
net/nfc/nci/core.c | 31 +-
net/nfc/nci/data.c | 12 +-
net/nfc/rawsock.c | 11 +
net/openvswitch/flow_netlink.c | 2 +
net/openvswitch/vport-netdev.c | 9 +-
net/packet/af_packet.c | 1 +
net/qrtr/af_qrtr.c | 66 ++--
net/rds/ib_rdma.c | 7 +-
net/rfkill/core.c | 40 ++-
net/rose/af_rose.c | 5 +
net/rxrpc/af_rxrpc.c | 6 -
net/rxrpc/key.c | 2 +-
net/sched/act_gate.c | 264 +++++++++++-----
net/sched/cls_api.c | 1 +
net/sched/cls_flow.c | 10 +-
net/sched/cls_fw.c | 14 +-
net/sched/sch_ets.c | 12 +-
net/sched/sch_hfsc.c | 4 +-
net/sched/sch_teql.c | 1 +
net/smc/smc_rx.c | 9 +-
net/sunrpc/cache.c | 26 +-
net/tipc/group.c | 6 +-
net/tipc/socket.c | 2 +
net/wireless/core.c | 1 +
net/wireless/pmsr.c | 1 +
net/wireless/radiotap.c | 4 +-
net/x25/x25_in.c | 9 +-
net/x25/x25_subr.c | 1 +
net/xfrm/xfrm_interface_core.c | 2 +-
net/xfrm/xfrm_output.c | 7 +-
net/xfrm/xfrm_policy.c | 2 +-
net/xfrm/xfrm_state.c | 1 +
net/xfrm/xfrm_user.c | 1 +
security/apparmor/apparmorfs.c | 228 ++++++++------
security/apparmor/include/label.h | 16 +-
security/apparmor/include/lib.h | 12 +
security/apparmor/include/match.h | 1 +
security/apparmor/include/policy.h | 13 +-
security/apparmor/include/policy_ns.h | 2 +
security/apparmor/include/policy_unpack.h | 83 +++--
security/apparmor/label.c | 12 +-
security/apparmor/match.c | 58 +++-
security/apparmor/policy.c | 82 ++++-
security/apparmor/policy_ns.c | 2 +
security/apparmor/policy_unpack.c | 74 +++--
security/security.c | 1 +
sound/core/pcm_lib.c | 11 +-
sound/core/pcm_native.c | 25 +-
sound/pci/ctxfi/ctdaio.c | 1 +
sound/pci/hda/patch_conexant.c | 11 +
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/amd/acp3x-rt5682-max9836.c | 9 +-
sound/soc/fsl/fsl_easrc.c | 14 +-
sound/soc/intel/catpt/device.c | 10 +-
sound/soc/intel/catpt/dsp.c | 3 -
sound/soc/meson/meson-codec-glue.c | 3 -
sound/soc/soc-core.c | 344 +++++++++++++++------
sound/soc/soc-dai.c | 63 ++++
sound/soc/soc-dapm.c | 24 +-
sound/soc/soc-pcm.c | 10 +-
sound/soc/soc-topology.c | 24 +-
sound/soc/soc-utils.c | 29 ++
sound/soc/sof/topology.c | 6 +-
sound/soc/tegra/tegra_pcm.c | 3 +
sound/usb/caiaq/device.c | 2 +-
sound/usb/endpoint.c | 3 +
sound/usb/validate.c | 2 +-
tools/bootconfig/main.c | 7 +-
tools/objtool/check.c | 5 +-
tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +-
458 files changed, 5215 insertions(+), 2261 deletions(-)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 001/491] ARM: clean up the memset64() C wrapper
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 002/491] ip6_tunnel: Fix usage of skb_vlan_inet_prepare() Greg Kroah-Hartman
` (494 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Linus Torvalds, Ben Hutchings
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit b52343d1cb47bb27ca32a3f4952cc2fd3cd165bf ]
The current logic to split the 64-bit argument into its 32-bit halves is
byte-order specific and a bit clunky. Use a union instead which is
easier to read and works in all cases.
GCC still generates the same machine code.
While at it, rename the arguments of the __memset64() prototype to
actually reflect their semantics.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Ben Hutchings <ben@decadent.org.uk> # for -stable
Link: https://lore.kernel.org/all/1a11526ae3d8664f705b541b8d6ea57b847b49a8.camel@decadent.org.uk/
Suggested-by: https://lore.kernel.org/all/aZonkWMwpbFhzDJq@casper.infradead.org/ # for -stable
Link: https://lore.kernel.org/all/aZonkWMwpbFhzDJq@casper.infradead.org/
---
arch/arm/include/asm/string.h | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h
index b5ad23acb303a..369781ec55112 100644
--- a/arch/arm/include/asm/string.h
+++ b/arch/arm/include/asm/string.h
@@ -33,13 +33,17 @@ static inline void *memset32(uint32_t *p, uint32_t v, __kernel_size_t n)
}
#define __HAVE_ARCH_MEMSET64
-extern void *__memset64(uint64_t *, uint32_t low, __kernel_size_t, uint32_t hi);
+extern void *__memset64(uint64_t *, uint32_t first, __kernel_size_t, uint32_t second);
static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n)
{
- if (IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN))
- return __memset64(p, v, n * 8, v >> 32);
- else
- return __memset64(p, v >> 32, n * 8, v);
+ union {
+ uint64_t val;
+ struct {
+ uint32_t first, second;
+ };
+ } word = { .val = v };
+
+ return __memset64(p, word.first, n * 8, word.second);
}
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 002/491] ip6_tunnel: Fix usage of skb_vlan_inet_prepare()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 001/491] ARM: clean up the memset64() C wrapper Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 003/491] scsi: lpfc: Properly set WC for DPP mapping Greg Kroah-Hartman
` (493 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ben Hutchings, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
Backports of commit 81c734dae203 "ip6_tunnel: use
skb_vlan_inet_prepare() in __ip6_tnl_rcv()" broke IPv6 tunnelling in
stable branches 5.10-6.12 inclusive. This is because the return value
of skb_vlan_inet_prepare() had the opposite sense (0 for error rather
than for success) before commit 9990ddf47d416 "net: tunnel: make
skb_vlan_inet_prepare() return drop reasons".
For branches including commit c504e5c2f964 "net: skb: introduce
kfree_skb_reason()" etc. (i.e. 6.1 and newer) it was simple to
backport commit 9990ddf47d416, but for 5.10 and 5.15 that doesn't seem
to be practical.
So just reverse the sense of the return value test here.
Fixes: f9c5c5b791d3 ("ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()")
Fixes: 64c71d60a21a ("ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()")
Signed-off-by: Ben Hutchings <benh@debian.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_tunnel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 855622a6a304f..e8c4e02e75d43 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -876,7 +876,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
skb_reset_network_header(skb);
- if (skb_vlan_inet_prepare(skb, true)) {
+ if (!skb_vlan_inet_prepare(skb, true)) {
DEV_STATS_INC(tunnel->dev, rx_length_errors);
DEV_STATS_INC(tunnel->dev, rx_errors);
goto drop;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 003/491] scsi: lpfc: Properly set WC for DPP mapping
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 001/491] ARM: clean up the memset64() C wrapper Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 002/491] ip6_tunnel: Fix usage of skb_vlan_inet_prepare() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 004/491] scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Greg Kroah-Hartman
` (492 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mathias Krause, Justin Tee,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@grsecurity.net>
[ Upstream commit bffda93a51b40afd67c11bf558dc5aae83ca0943 ]
Using set_memory_wc() to enable write-combining for the DPP portion of
the MMIO mapping is wrong as set_memory_*() is meant to operate on RAM
only, not MMIO mappings. In fact, as used currently triggers a BUG_ON()
with enabled CONFIG_DEBUG_VIRTUAL.
Simply map the DPP region separately and in addition to the already
existing mappings, avoiding any possible negative side effects for
these.
Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Reviewed-by: Mathias Krause <minipli@grsecurity.net>
Link: https://patch.msgid.link/20260212192327.141104-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_init.c | 2 ++
drivers/scsi/lpfc/lpfc_sli.c | 36 +++++++++++++++++++++++++++++------
drivers/scsi/lpfc/lpfc_sli4.h | 3 +++
3 files changed, 35 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 5f2009327a593..0f144fbf2a6cb 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -10558,6 +10558,8 @@ lpfc_sli4_pci_mem_unset(struct lpfc_hba *phba)
iounmap(phba->sli4_hba.conf_regs_memmap_p);
if (phba->sli4_hba.dpp_regs_memmap_p)
iounmap(phba->sli4_hba.dpp_regs_memmap_p);
+ if (phba->sli4_hba.dpp_regs_memmap_wc_p)
+ iounmap(phba->sli4_hba.dpp_regs_memmap_wc_p);
break;
case LPFC_SLI_INTF_IF_TYPE_1:
default:
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 49931577da38b..0b3242b058b99 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -14966,6 +14966,32 @@ lpfc_dual_chute_pci_bar_map(struct lpfc_hba *phba, uint16_t pci_barset)
return NULL;
}
+static __maybe_unused void __iomem *
+lpfc_dpp_wc_map(struct lpfc_hba *phba, uint8_t dpp_barset)
+{
+
+ /* DPP region is supposed to cover 64-bit BAR2 */
+ if (dpp_barset != WQ_PCI_BAR_4_AND_5) {
+ lpfc_log_msg(phba, KERN_WARNING, LOG_INIT,
+ "3273 dpp_barset x%x != WQ_PCI_BAR_4_AND_5\n",
+ dpp_barset);
+ return NULL;
+ }
+
+ if (!phba->sli4_hba.dpp_regs_memmap_wc_p) {
+ void __iomem *dpp_map;
+
+ dpp_map = ioremap_wc(phba->pci_bar2_map,
+ pci_resource_len(phba->pcidev,
+ PCI_64BIT_BAR4));
+
+ if (dpp_map)
+ phba->sli4_hba.dpp_regs_memmap_wc_p = dpp_map;
+ }
+
+ return phba->sli4_hba.dpp_regs_memmap_wc_p;
+}
+
/**
* lpfc_modify_hba_eq_delay - Modify Delay Multiplier on EQs
* @phba: HBA structure that EQs are on.
@@ -15876,9 +15902,6 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
uint8_t dpp_barset;
uint32_t dpp_offset;
uint8_t wq_create_version;
-#ifdef CONFIG_X86
- unsigned long pg_addr;
-#endif
/* sanity check on queue memory */
if (!wq || !cq)
@@ -16070,14 +16093,15 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq,
#ifdef CONFIG_X86
/* Enable combined writes for DPP aperture */
- pg_addr = (unsigned long)(wq->dpp_regaddr) & PAGE_MASK;
- rc = set_memory_wc(pg_addr, 1);
- if (rc) {
+ bar_memmap_p = lpfc_dpp_wc_map(phba, dpp_barset);
+ if (!bar_memmap_p) {
lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
"3272 Cannot setup Combined "
"Write on WQ[%d] - disable DPP\n",
wq->queue_id);
phba->cfg_enable_dpp = 0;
+ } else {
+ wq->dpp_regaddr = bar_memmap_p + dpp_offset;
}
#else
phba->cfg_enable_dpp = 0;
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index 100cb1a94811b..80c168b2a2ddd 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -772,6 +772,9 @@ struct lpfc_sli4_hba {
void __iomem *dpp_regs_memmap_p; /* Kernel memory mapped address for
* dpp registers
*/
+ void __iomem *dpp_regs_memmap_wc_p;/* Kernel memory mapped address for
+ * dpp registers with write combining
+ */
union {
struct {
/* IF Type 0, BAR 0 PCI cfg space reg mem map */
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 004/491] scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 003/491] scsi: lpfc: Properly set WC for DPP mapping Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 005/491] ALSA: usb-audio: Cap the packet size pre-calculations Greg Kroah-Hartman
` (491 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Wang, Bart Van Assche,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <peter.wang@mediatek.com>
[ Upstream commit 62c015373e1cdb1cdca824bd2dbce2dac0819467 ]
Move the link recovery trigger from ufshcd_uic_pwr_ctrl() to
__ufshcd_wl_resume(). Ensure link recovery is only attempted when hibern8
exit fails during resume, not during hibern8 enter in suspend. Improve
error handling and prevent unnecessary link recovery attempts.
Fixes: 35dabf4503b9 ("scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume")
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260223103906.2533654-1-peter.wang@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index c5f41023c71b8..c7bf0e6bc303d 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3880,14 +3880,6 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)
spin_unlock_irqrestore(hba->host->host_lock, flags);
mutex_unlock(&hba->uic_cmd_mutex);
- /*
- * If the h8 exit fails during the runtime resume process, it becomes
- * stuck and cannot be recovered through the error handler. To fix
- * this, use link recovery instead of the error handler.
- */
- if (ret && hba->pm_op_in_progress)
- ret = ufshcd_link_recovery(hba);
-
return ret;
}
@@ -8727,7 +8719,15 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
} else {
dev_err(hba->dev, "%s: hibern8 exit failed %d\n",
__func__, ret);
- goto vendor_suspend;
+ /*
+ * If the h8 exit fails during the runtime resume
+ * process, it becomes stuck and cannot be recovered
+ * through the error handler. To fix this, use link
+ * recovery instead of the error handler.
+ */
+ ret = ufshcd_link_recovery(hba);
+ if (ret)
+ goto vendor_suspend;
}
} else if (ufshcd_is_link_off(hba)) {
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 005/491] ALSA: usb-audio: Cap the packet size pre-calculations
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 004/491] scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 006/491] btrfs: fix incorrect key offset in error message in check_dev_extent_item() Greg Kroah-Hartman
` (490 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 7fe8dec3f628e9779f1631576f8e693370050348 ]
We calculate the possible packet sizes beforehand for adaptive and
synchronous endpoints, but we didn't take care of the max frame size
for those pre-calculated values. When a device or a bus limits the
packet size, a high sample rate or a high number of channels may lead
to the packet sizes that are larger than the given limit, which
results in an error from the USB core at submitting URBs.
As a simple workaround, just add the sanity checks of pre-calculated
packet sizes to have the upper boundary of ep->maxframesize.
Fixes: f0bd62b64016 ("ALSA: usb-audio: Improve frames size computation")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260225085233.316306-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/endpoint.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 21bcdc811a810..8e2b90cb5b952 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -1099,6 +1099,9 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
return -EINVAL;
}
+ ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
+ ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
+
/* calculate the frequency in 16.16 format */
ep->freqm = ep->freqn;
ep->freqshift = INT_MIN;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 006/491] btrfs: fix incorrect key offset in error message in check_dev_extent_item()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 005/491] ALSA: usb-audio: Cap the packet size pre-calculations Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 007/491] ARM: OMAP2+: add missing of_node_put before break and return Greg Kroah-Hartman
` (489 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Qu Wenruo,
Mark Harmstone, David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <mark@harmstone.com>
[ Upstream commit 511dc8912ae3e929c1a182f5e6b2326516fd42a0 ]
Fix the error message in check_dev_extent_item(), when an overlapping
stripe is encountered. For dev extents, objectid is the disk number and
offset the physical address, so prev_key->objectid should actually be
prev_key->offset.
(I can't take any credit for this one - this was discovered by Chris and
his friend Claude.)
Reported-by: Chris Mason <clm@fb.com>
Fixes: 008e2512dc56 ("btrfs: tree-checker: add dev extent item checks")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Mark Harmstone <mark@harmstone.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-checker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index fd4768c5e439a..dd27fdb9521a8 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -1630,7 +1630,7 @@ static int check_dev_extent_item(const struct extent_buffer *leaf,
if (unlikely(prev_key->offset + prev_len > key->offset)) {
generic_err(leaf, slot,
"dev extent overlap, prev offset %llu len %llu current offset %llu",
- prev_key->objectid, prev_len, key->offset);
+ prev_key->offset, prev_len, key->offset);
return -EUCLEAN;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 007/491] ARM: OMAP2+: add missing of_node_put before break and return
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 006/491] btrfs: fix incorrect key offset in error message in check_dev_extent_item() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 008/491] ARM: omap2: Fix reference count leaks in omap_control_init() Greg Kroah-Hartman
` (488 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Qing, Tony Lindgren,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Qing <wangqing@vivo.com>
[ Upstream commit 883f464c1d23663047eda4f2bcf622365e2d0dd0 ]
Fix following coccicheck warning:
WARNING: Function "for_each_matching_node_and_match"
should have of_node_put() before return.
Early exits from for_each_matching_node_and_match should decrement the
node reference counter.
Signed-off-by: Wang Qing <wangqing@vivo.com>
Message-Id: <1639388545-63615-1-git-send-email-wangqing@vivo.com>
[tony@atomide.com: updated for omap_hwmod.c that was already patched]
Signed-off-by: Tony Lindgren <tony@atomide.com>
Stable-dep-of: 93a04ab480c8 ("ARM: omap2: Fix reference count leaks in omap_control_init()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/cm_common.c | 8 ++++++--
arch/arm/mach-omap2/control.c | 19 ++++++++++++++-----
arch/arm/mach-omap2/prm_common.c | 8 ++++++--
3 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/arch/arm/mach-omap2/cm_common.c b/arch/arm/mach-omap2/cm_common.c
index b7ea609386d52..d86a36120738d 100644
--- a/arch/arm/mach-omap2/cm_common.c
+++ b/arch/arm/mach-omap2/cm_common.c
@@ -333,8 +333,10 @@ int __init omap2_cm_base_init(void)
data = (struct omap_prcm_init_data *)match->data;
ret = of_address_to_resource(np, 0, &res);
- if (ret)
+ if (ret) {
+ of_node_put(np);
return ret;
+ }
if (data->index == TI_CLKM_CM)
mem = &cm_base;
@@ -380,8 +382,10 @@ int __init omap_cm_init(void)
continue;
ret = omap2_clk_provider_init(np, data->index, NULL, data->mem);
- if (ret)
+ if (ret) {
+ of_node_put(np);
return ret;
+ }
}
return 0;
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 73338cf80d76c..9bc69caf338f1 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -774,8 +774,10 @@ int __init omap2_control_base_init(void)
data = (struct control_init_data *)match->data;
mem = of_iomap(np, 0);
- if (!mem)
+ if (!mem) {
+ of_node_put(np);
return -ENOMEM;
+ }
if (data->index == TI_CLKM_CTRL) {
omap2_ctrl_base = mem;
@@ -815,22 +817,24 @@ int __init omap_control_init(void)
if (scm_conf) {
syscon = syscon_node_to_regmap(scm_conf);
- if (IS_ERR(syscon))
- return PTR_ERR(syscon);
+ if (IS_ERR(syscon)) {
+ ret = PTR_ERR(syscon);
+ goto of_node_put;
+ }
if (of_get_child_by_name(scm_conf, "clocks")) {
ret = omap2_clk_provider_init(scm_conf,
data->index,
syscon, NULL);
if (ret)
- return ret;
+ goto of_node_put;
}
} else {
/* No scm_conf found, direct access */
ret = omap2_clk_provider_init(np, data->index, NULL,
data->mem);
if (ret)
- return ret;
+ goto of_node_put;
}
}
@@ -841,6 +845,11 @@ int __init omap_control_init(void)
}
return 0;
+
+of_node_put:
+ of_node_put(np);
+ return ret;
+
}
/**
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 65b2d82efa27b..fb2d48cfe756b 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -752,8 +752,10 @@ int __init omap2_prm_base_init(void)
data = (struct omap_prcm_init_data *)match->data;
ret = of_address_to_resource(np, 0, &res);
- if (ret)
+ if (ret) {
+ of_node_put(np);
return ret;
+ }
data->mem = ioremap(res.start, resource_size(&res));
@@ -799,8 +801,10 @@ int __init omap_prcm_init(void)
data = match->data;
ret = omap2_clk_provider_init(np, data->index, NULL, data->mem);
- if (ret)
+ if (ret) {
+ of_node_put(np);
return ret;
+ }
}
omap_cm_init();
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 008/491] ARM: omap2: Fix reference count leaks in omap_control_init()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 007/491] ARM: OMAP2+: add missing of_node_put before break and return Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 009/491] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions Greg Kroah-Hartman
` (487 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Andreas Kemnade,
Kevin Hilman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 93a04ab480c8bbcb7d9004be139c538c8a0c1bc8 ]
The of_get_child_by_name() function increments the reference count
of child nodes, causing multiple reference leaks in omap_control_init():
1. scm_conf node never released in normal/error paths
2. clocks node leak when checking existence
3. Missing scm_conf release before np in error paths
Fix these leaks by adding proper of_node_put() calls and separate error
handling.
Fixes: e5b635742e98 ("ARM: OMAP2+: control: add syscon support for register accesses")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20251217142122.1861292-1-vulab@iscas.ac.cn
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/control.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 9bc69caf338f1..a1288d438071b 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -798,7 +798,7 @@ int __init omap2_control_base_init(void)
*/
int __init omap_control_init(void)
{
- struct device_node *np, *scm_conf;
+ struct device_node *np, *scm_conf, *clocks_node;
const struct of_device_id *match;
const struct omap_prcm_init_data *data;
int ret;
@@ -819,16 +819,19 @@ int __init omap_control_init(void)
if (IS_ERR(syscon)) {
ret = PTR_ERR(syscon);
- goto of_node_put;
+ goto err_put_scm_conf;
}
- if (of_get_child_by_name(scm_conf, "clocks")) {
+ clocks_node = of_get_child_by_name(scm_conf, "clocks");
+ if (clocks_node) {
+ of_node_put(clocks_node);
ret = omap2_clk_provider_init(scm_conf,
data->index,
syscon, NULL);
if (ret)
- goto of_node_put;
+ goto err_put_scm_conf;
}
+ of_node_put(scm_conf);
} else {
/* No scm_conf found, direct access */
ret = omap2_clk_provider_init(np, data->index, NULL,
@@ -846,6 +849,9 @@ int __init omap_control_init(void)
return 0;
+err_put_scm_conf:
+ if (scm_conf)
+ of_node_put(scm_conf);
of_node_put:
of_node_put(np);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 009/491] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 008/491] ARM: omap2: Fix reference count leaks in omap_control_init() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show() Greg Kroah-Hartman
` (486 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chelsy Ratnawat, Ioana Ciornei,
Christophe Leroy, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
[ Upstream commit a50522c805a6c575c80f41b04706e084d814e116 ]
Use sysfs_emit() instead of snprintf()/sprintf() when writing
to sysfs buffers, as recommended by the kernel documentation.
Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Acked-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20250822124339.1739290-1-chelsyratnawat2001@gmail.com
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Stable-dep-of: 148891e95014 ("bus: fsl-mc: fix use-after-free in driver_override_show()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 4471cd1606424..8f7448da9258d 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -151,8 +151,8 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
{
struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
- return sprintf(buf, "fsl-mc:v%08Xd%s\n", mc_dev->obj_desc.vendor,
- mc_dev->obj_desc.type);
+ return sysfs_emit(buf, "fsl-mc:v%08Xd%s\n", mc_dev->obj_desc.vendor,
+ mc_dev->obj_desc.type);
}
static DEVICE_ATTR_RO(modalias);
@@ -195,7 +195,7 @@ static ssize_t driver_override_show(struct device *dev,
{
struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
- return snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override);
+ return sysfs_emit(buf, "%s\n", mc_dev->driver_override);
}
static DEVICE_ATTR_RW(driver_override);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 009/491] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-14 4:16 ` Gui-Dong Han
2026-04-13 15:54 ` [PATCH 5.10 011/491] drm/tegra: dsi: fix device leak on probe Greg Kroah-Hartman
` (485 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Ioana Ciornei,
Christophe Leroy (CS GROUP), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
The driver_override_show() function reads the driver_override string
without holding the device_lock. However, driver_override_store() uses
driver_set_override(), which modifies and frees the string while holding
the device_lock.
This can result in a concurrent use-after-free if the string is freed
by the store function while being read by the show function.
Fix this by holding the device_lock around the read operation.
Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 8f7448da9258d..49eaf5bddd5ad 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -194,8 +194,12 @@ static ssize_t driver_override_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
+ ssize_t len;
- return sysfs_emit(buf, "%s\n", mc_dev->driver_override);
+ device_lock(dev);
+ len = sysfs_emit(buf, "%s\n", mc_dev->driver_override);
+ device_unlock(dev);
+ return len;
}
static DEVICE_ATTR_RW(driver_override);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 011/491] drm/tegra: dsi: fix device leak on probe
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void Greg Kroah-Hartman
` (484 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thierry Reding, Johan Hovold,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit bfef062695570842cf96358f2f46f4c6642c6689 ]
Make sure to drop the reference taken when looking up the companion
(ganged) device and its driver data during probe().
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
Fixes: 221e3638feb8 ("drm/tegra: Fix reference leak in tegra_dsi_ganged_probe")
Cc: stable@vger.kernel.org # 3.19: 221e3638feb8
Cc: Thierry Reding <treding@nvidia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251121164201.13188-1-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dsi.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 7bb26655cb3cc..74d27b564d564 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -1539,11 +1539,9 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
return -EPROBE_DEFER;
dsi->slave = platform_get_drvdata(gangster);
-
- if (!dsi->slave) {
- put_device(&gangster->dev);
+ put_device(&gangster->dev);
+ if (!dsi->slave)
return -EPROBE_DEFER;
- }
dsi->slave->master = dsi;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 011/491] drm/tegra: dsi: fix device leak on probe Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-14 19:35 ` Ben Hutchings
2026-04-13 15:54 ` [PATCH 5.10 013/491] bus: omap-ocp2scp: fix OF populate on driver rebind Greg Kroah-Hartman
` (483 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 854f89a5b56354ba4135e0e1f0e57ab2caee59ee ]
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Link: https://lore.kernel.org/r/20231109202830.4124591-3-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Stable-dep-of: 5eb63e9bb65d ("bus: omap-ocp2scp: fix OF populate on driver rebind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/omap-ocp2scp.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index e02d0656242b8..7d7479ba0a759 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -84,12 +84,10 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
return ret;
}
-static int omap_ocp2scp_remove(struct platform_device *pdev)
+static void omap_ocp2scp_remove(struct platform_device *pdev)
{
pm_runtime_disable(&pdev->dev);
device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
-
- return 0;
}
#ifdef CONFIG_OF
@@ -103,7 +101,7 @@ MODULE_DEVICE_TABLE(of, omap_ocp2scp_id_table);
static struct platform_driver omap_ocp2scp_driver = {
.probe = omap_ocp2scp_probe,
- .remove = omap_ocp2scp_remove,
+ .remove_new = omap_ocp2scp_remove,
.driver = {
.name = "omap-ocp2scp",
.of_match_table = of_match_ptr(omap_ocp2scp_id_table),
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 013/491] bus: omap-ocp2scp: fix OF populate on driver rebind
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 014/491] clk: tegra: tegra124-emc: fix device leak on set_rate() Greg Kroah-Hartman
` (482 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Kevin Hilman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 5eb63e9bb65d88abde647ced50fe6ad40c11de1a ]
Since commit c6e126de43e7 ("of: Keep track of populated platform
devices") child devices will not be created by of_platform_populate()
if the devices had previously been deregistered individually so that the
OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that
the child devices are created if the driver is rebound.
Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251219110119.23507-1-johan@kernel.org
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/omap-ocp2scp.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index 7d7479ba0a759..87e290a3dc817 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -17,15 +17,6 @@
#define OCP2SCP_TIMING 0x18
#define SYNC2_MASK 0xf
-static int ocp2scp_remove_devices(struct device *dev, void *c)
-{
- struct platform_device *pdev = to_platform_device(dev);
-
- platform_device_unregister(pdev);
-
- return 0;
-}
-
static int omap_ocp2scp_probe(struct platform_device *pdev)
{
int ret;
@@ -79,7 +70,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
pm_runtime_disable(&pdev->dev);
err0:
- device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
+ of_platform_depopulate(&pdev->dev);
return ret;
}
@@ -87,7 +78,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
static void omap_ocp2scp_remove(struct platform_device *pdev)
{
pm_runtime_disable(&pdev->dev);
- device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
+ of_platform_depopulate(&pdev->dev);
}
#ifdef CONFIG_OF
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 014/491] clk: tegra: tegra124-emc: fix device leak on set_rate()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 013/491] bus: omap-ocp2scp: fix OF populate on driver rebind Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 015/491] ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 Greg Kroah-Hartman
` (481 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Miaoqian Lin,
Johan Hovold, Stephen Boyd, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit da61439c63d34ae6503d080a847f144d587e3a48 ]
Make sure to drop the reference taken when looking up the EMC device and
its driver data on first set_rate().
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Fixes: 6d6ef58c2470 ("clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver")
Cc: stable@vger.kernel.org # 4.2: 6d6ef58c2470
Cc: Mikko Perttunen <mperttunen@nvidia.com>
Cc: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 670bb6b0765f3..4e2fc9ba2b211 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -190,8 +190,8 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra)
tegra->emc_node = NULL;
tegra->emc = platform_get_drvdata(pdev);
+ put_device(&pdev->dev);
if (!tegra->emc) {
- put_device(&pdev->dev);
pr_err("%s: cannot find EMC driver\n", __func__);
return NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 015/491] ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 014/491] clk: tegra: tegra124-emc: fix device leak on set_rate() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 016/491] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Greg Kroah-Hartman
` (480 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 1585cf83e98db32463e5d54161b06a5f01fe9976 ]
It was reported that we need the same quirk for HP ZBook Studio G4
(SSID 103c:826b) as other HP models to make the mute-LED working.
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/64d78753-b9ff-4c64-8920-64d8d31cd20c@gmail.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221002
Link: https://patch.msgid.link/20260207131324.2428030-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index d1430ee344854..fae09c88a33c0 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1026,6 +1026,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
SND_PCI_QUIRK(0x103c, 0x8231, "HP ProBook 450 G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x826b, "HP ZBook Studio G4", CXT_FIXUP_MUTE_LED_GPIO),
SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 016/491] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 015/491] ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 017/491] ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Greg Kroah-Hartman
` (479 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Hutchings, Gui-Dong Han,
Guenter Roeck, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 007be4327e443d79c9dd9e56dc16c36f6395d208 ]
Simply copying shared data to a local variable cannot prevent data
races. The compiler is allowed to optimize away the local copy and
re-read the shared memory, causing a Time-of-Check Time-of-Use (TOCTOU)
issue if the data changes between the check and the usage.
To enforce the use of the local variable, use READ_ONCE() when reading
the shared data and WRITE_ONCE() when updating it. Apply these macros to
the three identified locations (curr_sense, adc, and fault) where local
variables are used for error validation, ensuring the value remains
consistent.
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Closes: https://lore.kernel.org/all/6fe17868327207e8b850cf9f88b7dc58b2021f73.camel@decadent.org.uk/
Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles")
Fixes: b8d5acdcf525 ("hwmon: (max16065) Use local variable to avoid TOCTOU")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://lore.kernel.org/r/20260203121443.5482-1-hanguidong02@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/max16065.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
index 5787db933fad6..b292ef48b80bf 100644
--- a/drivers/hwmon/max16065.c
+++ b/drivers/hwmon/max16065.c
@@ -151,27 +151,27 @@ static struct max16065_data *max16065_update_device(struct device *dev)
int i;
for (i = 0; i < data->num_adc; i++)
- data->adc[i]
- = max16065_read_adc(client, MAX16065_ADC(i));
+ WRITE_ONCE(data->adc[i],
+ max16065_read_adc(client, MAX16065_ADC(i)));
if (data->have_current) {
- data->adc[MAX16065_NUM_ADC]
- = max16065_read_adc(client, MAX16065_CSP_ADC);
- data->curr_sense
- = i2c_smbus_read_byte_data(client,
- MAX16065_CURR_SENSE);
+ WRITE_ONCE(data->adc[MAX16065_NUM_ADC],
+ max16065_read_adc(client, MAX16065_CSP_ADC));
+ WRITE_ONCE(data->curr_sense,
+ i2c_smbus_read_byte_data(client, MAX16065_CURR_SENSE));
}
for (i = 0; i < 2; i++)
- data->fault[i]
- = i2c_smbus_read_byte_data(client, MAX16065_FAULT(i));
+ WRITE_ONCE(data->fault[i],
+ i2c_smbus_read_byte_data(client, MAX16065_FAULT(i)));
/*
* MAX16067 and MAX16068 have separate undervoltage and
* overvoltage alarm bits. Squash them together.
*/
if (data->chip == max16067 || data->chip == max16068)
- data->fault[0] |= data->fault[1];
+ WRITE_ONCE(data->fault[0],
+ data->fault[0] | data->fault[1]);
data->last_updated = jiffies;
data->valid = 1;
@@ -185,7 +185,7 @@ static ssize_t max16065_alarm_show(struct device *dev,
{
struct sensor_device_attribute_2 *attr2 = to_sensor_dev_attr_2(da);
struct max16065_data *data = max16065_update_device(dev);
- int val = data->fault[attr2->nr];
+ int val = READ_ONCE(data->fault[attr2->nr]);
if (val < 0)
return val;
@@ -203,7 +203,7 @@ static ssize_t max16065_input_show(struct device *dev,
{
struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
struct max16065_data *data = max16065_update_device(dev);
- int adc = data->adc[attr->index];
+ int adc = READ_ONCE(data->adc[attr->index]);
if (unlikely(adc < 0))
return adc;
@@ -216,7 +216,7 @@ static ssize_t max16065_current_show(struct device *dev,
struct device_attribute *da, char *buf)
{
struct max16065_data *data = max16065_update_device(dev);
- int curr_sense = data->curr_sense;
+ int curr_sense = READ_ONCE(data->curr_sense);
if (unlikely(curr_sense < 0))
return curr_sense;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 017/491] ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 016/491] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 018/491] net: arcnet: com20020-pci: fix support for 2.5Mbit cards Greg Kroah-Hartman
` (478 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 7bc0df86c2384bc1e2012a2c946f82305054da64 ]
Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin
configurations for NID 0x16 and 0x19 to make the headphone / headset
jack working. NID 0x17 can remain as is for the working speaker, and
the built-in mic is supported via SOF.
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221086
Link: https://patch.msgid.link/20260217104414.62911-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_conexant.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index fae09c88a33c0..4d0bd1903ccbd 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -239,6 +239,7 @@ enum {
CXT_PINCFG_SWS_JS201D,
CXT_PINCFG_TOP_SPEAKER,
CXT_FIXUP_HP_A_U,
+ CXT_FIXUP_ACER_SWIFT_HP,
};
/* for hda_fixup_thinkpad_acpi() */
@@ -969,6 +970,14 @@ static const struct hda_fixup cxt_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = cxt_fixup_hp_a_u,
},
+ [CXT_FIXUP_ACER_SWIFT_HP] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x16, 0x0321403f }, /* Headphone */
+ { 0x19, 0x40f001f0 }, /* Mic */
+ { }
+ },
+ },
};
static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -1018,6 +1027,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x136d, "Acer Swift SF314", CXT_FIXUP_ACER_SWIFT_HP),
SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 018/491] net: arcnet: com20020-pci: fix support for 2.5Mbit cards
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 017/491] ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 019/491] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen Greg Kroah-Hartman
` (477 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, Ethan Nelson-Moore,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit c7d9be66b71af490446127c6ffcb66d6bb71b8b9 ]
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
converted the com20020-pci driver to use a card info structure instead
of a single flag mask in driver_data. However, it failed to take into
account that in the original code, driver_data of 0 indicates a card
with no special flags, not a card that should not have any card info
structure. This introduced a null pointer dereference when cards with
no flags were probed.
Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in
com20020pci_probe()") then papered over this issue by rejecting cards
with no driver_data instead of resolving the problem at its source.
Fix the original issue by introducing a new card info structure for
2.5Mbit cards that does not set any flags and using it if no
driver_data is present.
Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/arcnet/com20020-pci.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -114,6 +114,8 @@ static const struct attribute_group com2
.attrs = com20020_state_attrs,
};
+static struct com20020_pci_card_info card_info_2p5mbit;
+
static void com20020pci_remove(struct pci_dev *pdev);
static int com20020pci_probe(struct pci_dev *pdev,
@@ -139,7 +141,7 @@ static int com20020pci_probe(struct pci_
ci = (struct com20020_pci_card_info *)id->driver_data;
if (!ci)
- return -EINVAL;
+ ci = &card_info_2p5mbit;
priv->ci = ci;
mm = &ci->misc_map;
@@ -346,6 +348,18 @@ static struct com20020_pci_card_info car
.flags = ARC_IS_5MBIT,
};
+static struct com20020_pci_card_info card_info_2p5mbit = {
+ .name = "ARC-PCI",
+ .devcount = 1,
+ .chan_map_tbl = {
+ {
+ .bar = 2,
+ .offset = 0x00,
+ .size = 0x08,
+ },
+ },
+};
+
static struct com20020_pci_card_info card_info_sohard = {
.name = "SOHARD SH ARC-PCI",
.devcount = 1,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 019/491] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 018/491] net: arcnet: com20020-pci: fix support for 2.5Mbit cards Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 020/491] nfc: pn533: properly drop the usb interface reference on disconnect Greg Kroah-Hartman
` (476 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ab12f0c08dd7ab8d057c,
Jens Axboe, Linus Torvalds
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 upstream.
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the
DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which
reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the
same DVR device share it), this orphans any existing waitqueue entries
from io_uring poll or epoll, leaving them with stale prev/next pointers
while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly
initialized once in dvb_dmxdev_init(). The open path only needs to
reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct
assignment of data/size and a call to dvb_ringbuffer_reset(), which
properly resets pread, pwrite, and error with correct memory ordering
without touching the waitqueue or spinlock.
Cc: stable@vger.kernel.org
Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer")
Reported-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com
Tested-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-core/dmxdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *in
mutex_unlock(&dmxdev->mutex);
return -ENOMEM;
}
- dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
+ dmxdev->dvr_buffer.data = mem;
+ dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE;
+ dvb_ringbuffer_reset(&dmxdev->dvr_buffer);
if (dmxdev->may_do_mmap)
dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
file->f_flags & O_NONBLOCK);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 020/491] nfc: pn533: properly drop the usb interface reference on disconnect
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 019/491] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 021/491] net: usb: kaweth: validate USB endpoints Greg Kroah-Hartman
` (475 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 12133a483dfa832241fbbf09321109a0ea8a520e upstream.
When the device is disconnected from the driver, there is a "dangling"
reference count on the usb interface that was grabbed in the probe
callback. Fix this up by properly dropping the reference after we are
done with it.
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: c46ee38620a2 ("NFC: pn533: add NXP pn533 nfc device driver")
Link: https://patch.msgid.link/2026022329-flashing-ought-7573@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/pn533/usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -633,6 +633,7 @@ static void pn533_usb_disconnect(struct
usb_free_urb(phy->out_urb);
usb_free_urb(phy->ack_urb);
kfree(phy->ack_buffer);
+ usb_put_dev(phy->udev);
nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n");
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 021/491] net: usb: kaweth: validate USB endpoints
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 020/491] nfc: pn533: properly drop the usb interface reference on disconnect Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 022/491] net: usb: kalmia: " Greg Kroah-Hartman
` (474 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4b063c002ca759d1b299988ee23f564c9609c875 upstream.
The kaweth driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://patch.msgid.link/2026022305-substance-virtual-c728@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/kaweth.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -883,6 +883,13 @@ static int kaweth_probe(
const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
int result = 0;
int rv = -EIO;
+ static const u8 bulk_ep_addr[] = {
+ 1 | USB_DIR_IN,
+ 2 | USB_DIR_OUT,
+ 0};
+ static const u8 int_ep_addr[] = {
+ 3 | USB_DIR_IN,
+ 0};
dev_dbg(dev,
"Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -896,6 +903,12 @@ static int kaweth_probe(
(int)udev->descriptor.bLength,
(int)udev->descriptor.bDescriptorType);
+ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+ !usb_check_int_endpoints(intf, int_ep_addr)) {
+ dev_err(dev, "couldn't find required endpoints\n");
+ return -ENODEV;
+ }
+
netdev = alloc_etherdev(sizeof(*kaweth));
if (!netdev)
return -ENOMEM;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 022/491] net: usb: kalmia: validate USB endpoints
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 021/491] net: usb: kaweth: validate USB endpoints Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 023/491] net: usb: pegasus: " Greg Kroah-Hartman
` (473 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 upstream.
The kalmia driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730")
Link: https://patch.msgid.link/2026022326-shack-headstone-ef6f@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/kalmia.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/usb/kalmia.c
+++ b/drivers/net/usb/kalmia.c
@@ -132,11 +132,18 @@ kalmia_bind(struct usbnet *dev, struct u
{
int status;
u8 ethernet_addr[ETH_ALEN];
+ static const u8 ep_addr[] = {
+ 1 | USB_DIR_IN,
+ 2 | USB_DIR_OUT,
+ 0};
/* Don't bind to AT command interface */
if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
return -EINVAL;
+ if (!usb_check_bulk_endpoints(intf, ep_addr))
+ return -ENODEV;
+
dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK);
dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK);
dev->status = NULL;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 023/491] net: usb: pegasus: validate USB endpoints
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 022/491] net: usb: kalmia: " Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 024/491] can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message Greg Kroah-Hartman
` (472 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Petko Manolov, stable,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 upstream.
The pegasus driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Cc: Petko Manolov <petkan@nucleusys.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/pegasus.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -841,8 +841,19 @@ static void unlink_all_urbs(pegasus_t *p
static int alloc_urbs(pegasus_t *pegasus)
{
+ static const u8 bulk_ep_addr[] = {
+ 1 | USB_DIR_IN,
+ 2 | USB_DIR_OUT,
+ 0};
+ static const u8 int_ep_addr[] = {
+ 3 | USB_DIR_IN,
+ 0};
int res = -ENOMEM;
+ if (!usb_check_bulk_endpoints(pegasus->intf, bulk_ep_addr) ||
+ !usb_check_int_endpoints(pegasus->intf, int_ep_addr))
+ return -ENODEV;
+
pegasus->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!pegasus->rx_urb) {
return res;
@@ -1197,6 +1208,7 @@ static int pegasus_probe(struct usb_inte
pegasus = netdev_priv(net);
pegasus->dev_index = dev_index;
+ pegasus->intf = intf;
res = alloc_urbs(pegasus);
if (res < 0) {
@@ -1208,7 +1220,6 @@ static int pegasus_probe(struct usb_inte
INIT_DELAYED_WORK(&pegasus->carrier_check, check_carrier);
- pegasus->intf = intf;
pegasus->usb = dev;
pegasus->net = net;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 024/491] can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 023/491] net: usb: pegasus: " Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 025/491] can: ucan: Fix infinite loop from zero-length messages Greg Kroah-Hartman
` (471 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Marc Kleine-Budde,
stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 38a01c9700b0dcafe97dfa9dc7531bf4a245deff upstream.
When looking at the data in a USB urb, the actual_length is the size of
the buffer passed to the driver, not the transfer_buffer_length which is
set by the driver as the max size of the buffer.
When parsing the messages in ems_usb_read_bulk_callback() properly check
the size both at the beginning of parsing the message to make sure it is
big enough for the expected structure, and at the end of the message to
make sure we don't overflow past the end of the buffer for the next
message.
Cc: Vincent Mailhol <mailhol@kernel.org>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: stable@kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026022316-answering-strainer-a5db@gregkh
Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/ems_usb.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -438,6 +438,11 @@ static void ems_usb_read_bulk_callback(s
start = CPC_HEADER_SIZE;
while (msg_count) {
+ if (start + CPC_MSG_HEADER_LEN > urb->actual_length) {
+ netdev_err(netdev, "format error\n");
+ break;
+ }
+
msg = (struct ems_cpc_msg *)&ibuf[start];
switch (msg->type) {
@@ -467,7 +472,7 @@ static void ems_usb_read_bulk_callback(s
start += CPC_MSG_HEADER_LEN + msg->length;
msg_count--;
- if (start > urb->transfer_buffer_length) {
+ if (start > urb->actual_length) {
netdev_err(netdev, "format error\n");
break;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 025/491] can: ucan: Fix infinite loop from zero-length messages
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 024/491] can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 026/491] HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them Greg Kroah-Hartman
` (470 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Vincent Mailhol,
stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 upstream.
If a broken ucan device gets a message with the message length field set
to 0, then the driver will loop for forever in
ucan_read_bulk_callback(), hanging the system. If the length is 0, just
skip the message and go on to the next one.
This has been fixed in the kvaser_usb driver in the past in commit
0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in
command parsers"), so there must be some broken devices out there like
this somewhere.
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: Vincent Mailhol <mailhol@kernel.org>
Cc: stable@kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026022319-huff-absurd-6a18@gregkh
Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/ucan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/can/usb/ucan.c
+++ b/drivers/net/can/usb/ucan.c
@@ -745,7 +745,7 @@ static void ucan_read_bulk_callback(stru
len = le16_to_cpu(m->len);
/* check sanity (length of content) */
- if (urb->actual_length - pos < len) {
+ if ((len == 0) || (urb->actual_length - pos < len)) {
netdev_warn(up->netdev,
"invalid message (short; no data; l:%d)\n",
urb->actual_length);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 026/491] HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 025/491] can: ucan: Fix infinite loop from zero-length messages Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 027/491] x86/efi: defer freeing of boot services memory Greg Kroah-Hartman
` (469 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Kosina, Benjamin Tissoires,
Bastien Nocera, linux-input, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ecfa6f34492c493a9a1dc2900f3edeb01c79946b upstream.
In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at
raw event handle"), we handle the fact that raw event callbacks
can happen even for a HID device that has not been "claimed" causing a
crash if a broken device were attempted to be connected to the system.
Fix up the remaining in-tree HID drivers that forgot to add this same
check to resolve the same issue.
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Bastien Nocera <hadess@hadess.net>
Cc: linux-input@vger.kernel.org
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-cmedia.c | 2 +-
drivers/hid/hid-creative-sb0540.c | 2 +-
drivers/hid/hid-zydacron.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-cmedia.c
+++ b/drivers/hid/hid-cmedia.c
@@ -57,7 +57,7 @@ static int cmhid_raw_event(struct hid_de
{
struct cmhid *cm = hid_get_drvdata(hid);
- if (len != CM6533_JD_RAWEV_LEN)
+ if (len != CM6533_JD_RAWEV_LEN || !(hid->claimed & HID_CLAIMED_INPUT))
goto out;
if (memcmp(data+CM6533_JD_SFX_OFFSET, ji_sfx, sizeof(ji_sfx)))
goto out;
--- a/drivers/hid/hid-creative-sb0540.c
+++ b/drivers/hid/hid-creative-sb0540.c
@@ -153,7 +153,7 @@ static int creative_sb0540_raw_event(str
u64 code, main_code;
int key;
- if (len != 6)
+ if (len != 6 || !(hid->claimed & HID_CLAIMED_INPUT))
return 0;
/* From daemons/hw_hiddev.c sb0540_rec() in lirc */
--- a/drivers/hid/hid-zydacron.c
+++ b/drivers/hid/hid-zydacron.c
@@ -114,7 +114,7 @@ static int zc_raw_event(struct hid_devic
unsigned key;
unsigned short index;
- if (report->id == data[0]) {
+ if (report->id == data[0] && (hdev->claimed & HID_CLAIMED_INPUT)) {
/* break keys */
for (index = 0; index < 4; index++) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 027/491] x86/efi: defer freeing of boot services memory
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 026/491] HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 028/491] ALSA: usb-audio: Use correct version for UAC3 header validation Greg Kroah-Hartman
` (468 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Rapoport (Microsoft),
Benjamin Herrenschmidt, Ard Biesheuvel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 upstream.
efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE
and EFI_BOOT_SERVICES_DATA using memblock_free_late().
There are two issue with that: memblock_free_late() should be used for
memory allocated with memblock_alloc() while the memory reserved with
memblock_reserve() should be freed with free_reserved_area().
More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
efi_free_boot_services() is called before deferred initialization of the
memory map is complete.
Benjamin Herrenschmidt reports that this causes a leak of ~140MB of
RAM on EC2 t3a.nano instances which only have 512MB or RAM.
If the freed memory resides in the areas that memory map for them is
still uninitialized, they won't be actually freed because
memblock_free_late() calls memblock_free_pages() and the latter skips
uninitialized pages.
Using free_reserved_area() at this point is also problematic because
__free_page() accesses the buddy of the freed page and that again might
end up in uninitialized part of the memory map.
Delaying the entire efi_free_boot_services() could be problematic
because in addition to freeing boot services memory it updates
efi.memmap without any synchronization and that's undesirable late in
boot when there is concurrency.
More robust approach is to only defer freeing of the EFI boot services
memory.
Split efi_free_boot_services() in two. First efi_unmap_boot_services()
collects ranges that should be freed into an array then
efi_free_boot_services() later frees them after deferred init is complete.
Link: https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@kernel.crashing.org
Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode")
Cc: <stable@vger.kernel.org>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/efi.h | 2 -
arch/x86/platform/efi/efi.c | 2 -
arch/x86/platform/efi/quirks.c | 55 ++++++++++++++++++++++++++++++++++--
drivers/firmware/efi/mokvar-table.c | 2 -
4 files changed, 55 insertions(+), 6 deletions(-)
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -151,7 +151,7 @@ extern int __init efi_reuse_config(u64 t
extern void efi_delete_dummy_variable(void);
extern void efi_switch_mm(struct mm_struct *mm);
extern void efi_recover_from_page_fault(unsigned long phys_addr);
-extern void efi_free_boot_services(void);
+extern void efi_unmap_boot_services(void);
/* kexec external ABI */
struct efi_setup_data {
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -831,7 +831,7 @@ static void __init __efi_enter_virtual_m
}
efi_check_for_embedded_firmwares();
- efi_free_boot_services();
+ efi_unmap_boot_services();
if (!efi_is_mixed())
efi_native_runtime_setup();
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -333,7 +333,7 @@ void __init efi_reserve_boot_services(vo
/*
* Because the following memblock_reserve() is paired
- * with memblock_free_late() for this region in
+ * with free_reserved_area() for this region in
* efi_free_boot_services(), we must be extremely
* careful not to reserve, and subsequently free,
* critical regions of memory (like the kernel image) or
@@ -396,17 +396,33 @@ static void __init efi_unmap_pages(efi_m
pr_err("Failed to unmap VA mapping for 0x%llx\n", va);
}
-void __init efi_free_boot_services(void)
+struct efi_freeable_range {
+ u64 start;
+ u64 end;
+};
+
+static struct efi_freeable_range *ranges_to_free;
+
+void __init efi_unmap_boot_services(void)
{
struct efi_memory_map_data data = { 0 };
efi_memory_desc_t *md;
int num_entries = 0;
+ int idx = 0;
+ size_t sz;
void *new, *new_md;
/* Keep all regions for /sys/kernel/debug/efi */
if (efi_enabled(EFI_DBG))
return;
+ sz = sizeof(*ranges_to_free) * efi.memmap.nr_map + 1;
+ ranges_to_free = kzalloc(sz, GFP_KERNEL);
+ if (!ranges_to_free) {
+ pr_err("Failed to allocate storage for freeable EFI regions\n");
+ return;
+ }
+
for_each_efi_memory_desc(md) {
unsigned long long start = md->phys_addr;
unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
@@ -451,7 +467,15 @@ void __init efi_free_boot_services(void)
size -= rm_size;
}
- memblock_free_late(start, size);
+ /*
+ * With CONFIG_DEFERRED_STRUCT_PAGE_INIT parts of the memory
+ * map are still not initialized and we can't reliably free
+ * memory here.
+ * Queue the ranges to free at a later point.
+ */
+ ranges_to_free[idx].start = start;
+ ranges_to_free[idx].end = start + size;
+ idx++;
}
if (!num_entries)
@@ -492,6 +516,31 @@ void __init efi_free_boot_services(void)
}
}
+static int __init efi_free_boot_services(void)
+{
+ struct efi_freeable_range *range = ranges_to_free;
+ unsigned long freed = 0;
+
+ if (!ranges_to_free)
+ return 0;
+
+ while (range->start) {
+ void *start = phys_to_virt(range->start);
+ void *end = phys_to_virt(range->end);
+
+ free_reserved_area(start, end, -1, NULL);
+ freed += (end - start);
+ range++;
+ }
+ kfree(ranges_to_free);
+
+ if (freed)
+ pr_info("Freeing EFI boot services memory: %ldK\n", freed / SZ_1K);
+
+ return 0;
+}
+arch_initcall(efi_free_boot_services);
+
/*
* A number of config table entries get remapped to virtual addresses
* after entering EFI virtual mode. However, the kexec kernel requires
--- a/drivers/firmware/efi/mokvar-table.c
+++ b/drivers/firmware/efi/mokvar-table.c
@@ -85,7 +85,7 @@ static struct kobject *mokvar_kobj;
* as an alternative to ordinary EFI variables, due to platform-dependent
* limitations. The memory occupied by this table is marked as reserved.
*
- * This routine must be called before efi_free_boot_services() in order
+ * This routine must be called before efi_unmap_boot_services() in order
* to guarantee that it can mark the table as reserved.
*
* Implicit inputs:
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 028/491] ALSA: usb-audio: Use correct version for UAC3 header validation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 027/491] x86/efi: defer freeing of boot services memory Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 029/491] wifi: radiotap: reject radiotap with unknown bits Greg Kroah-Hartman
` (467 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jun Seo, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Seo <jun.seo.93@proton.me>
commit 54f9d645a5453d0bfece0c465d34aaf072ea99fa upstream.
The entry of the validators table for UAC3 AC header descriptor is
defined with the wrong protocol version UAC_VERSION_2, while it should
have been UAC_VERSION_3. This results in the validator never matching
for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
header descriptors to bypass validation entirely. A malicious USB
device presenting a truncated UAC3 header could exploit this to cause
out-of-bounds reads when the driver later accesses unvalidated
descriptor fields.
The bug was introduced in the same commit as the recently fixed UAC3
feature unit sub-type typo, and appears to be from the same copy-paste
error when the UAC3 section was created from the UAC2 section.
Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jun Seo <jun.seo.93@proton.me>
Link: https://patch.msgid.link/20260226010820.36529-1-jun.seo.93@proton.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/validate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/validate.c
+++ b/sound/usb/validate.c
@@ -281,7 +281,7 @@ static const struct usb_desc_validator a
/* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
/* UAC3 */
- FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
+ FIXED(UAC_VERSION_3, UAC_HEADER, struct uac3_ac_header_descriptor),
FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
struct uac3_input_terminal_descriptor),
FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 029/491] wifi: radiotap: reject radiotap with unknown bits
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 028/491] ALSA: usb-audio: Use correct version for UAC3 header validation Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 030/491] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Greg Kroah-Hartman
` (466 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b09c1af8764c0097bb19,
Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 upstream.
The radiotap parser is currently only used with the radiotap
namespace (not with vendor namespaces), but if the undefined
field 18 is used, the alignment/size is unknown as well. In
this case, iterator->_next_ns_data isn't initialized (it's
only set for skipping vendor namespaces), and syzbot points
out that we later compare against this uninitialized value.
Fix this by moving the rejection of unknown radiotap fields
down to after the in-namespace lookup, so it will really use
iterator->_next_ns_data only for vendor namespaces, even in
case undefined fields are present.
Cc: stable@vger.kernel.org
Fixes: 33e5a2f776e3 ("wireless: update radiotap parser")
Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com
Link: https://patch.msgid.link/20260217120526.162647-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/radiotap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -240,14 +240,14 @@ int ieee80211_radiotap_iterator_next(
default:
if (!iterator->current_namespace ||
iterator->_arg_index >= iterator->current_namespace->n_bits) {
- if (iterator->current_namespace == &radiotap_ns)
- return -ENOENT;
align = 0;
} else {
align = iterator->current_namespace->align_size[iterator->_arg_index].align;
size = iterator->current_namespace->align_size[iterator->_arg_index].size;
}
if (!align) {
+ if (iterator->current_namespace == &radiotap_ns)
+ return -ENOENT;
/* skip all subsequent data */
iterator->_arg = iterator->_next_ns_data;
/* give up on this namespace */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 030/491] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 029/491] wifi: radiotap: reject radiotap with unknown bits Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 031/491] net/sched: ets: fix divide by zero in the offload path Greg Kroah-Hartman
` (465 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Leon Romanovsky
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
commit 117942ca43e2e3c3d121faae530989931b7f67e1 upstream.
Fix a user triggerable leak on the system call failure path.
Cc: stable@vger.kernel.org
Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/2-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mthca/mthca_provider.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -436,6 +436,8 @@ static int mthca_create_srq(struct ib_sr
if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
mthca_free_srq(to_mdev(ibsrq->device), srq);
+ mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
+ context->db_tab, ucmd.db_index);
return -EFAULT;
}
@@ -444,6 +446,7 @@ static int mthca_create_srq(struct ib_sr
static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
{
+ mthca_free_srq(to_mdev(srq->device), to_msrq(srq));
if (udata) {
struct mthca_ucontext *context =
rdma_udata_to_drv_context(
@@ -454,8 +457,6 @@ static int mthca_destroy_srq(struct ib_s
mthca_unmap_user_db(to_mdev(srq->device), &context->uar,
context->db_tab, to_msrq(srq)->db_index);
}
-
- mthca_free_srq(to_mdev(srq->device), to_msrq(srq));
return 0;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 031/491] net/sched: ets: fix divide by zero in the offload path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 030/491] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 032/491] Squashfs: check metadata block offset is within range Greg Kroah-Hartman
` (464 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Davide Caratti, Jamal Hadi Salim,
Petr Machata, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <dcaratti@redhat.com>
commit e35626f610f3d2b7953ccddf6a77453da22b3a9e upstream.
Offloading ETS requires computing each class' WRR weight: this is done by
averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned
int, the same integer size as the individual DRR quanta, can overflow and
even cause division by zero, like it happened in the following splat:
Oops: divide error: 0000 [#1] SMP PTI
CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full)
Tainted: [E]=UNSIGNED_MODULE
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
Call Trace:
<TASK>
ets_qdisc_change+0x870/0xf40 [sch_ets]
qdisc_create+0x12b/0x540
tc_modify_qdisc+0x6d7/0xbd0
rtnetlink_rcv_msg+0x168/0x6b0
netlink_rcv_skb+0x5c/0x110
netlink_unicast+0x1d6/0x2b0
netlink_sendmsg+0x22e/0x470
____sys_sendmsg+0x38a/0x3c0
___sys_sendmsg+0x99/0xe0
__sys_sendmsg+0x8a/0xf0
do_syscall_64+0x111/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f440b81c77e
Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e
RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003
RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8
R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980
</TASK>
Modules linked in: sch_ets(E) netdevsim(E)
---[ end trace 0000000000000000 ]---
RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception ]---
Fix this using 64-bit integers for 'q_sum' and 'q_psum'.
Cc: stable@vger.kernel.org
Fixes: d35eb52bd2ac ("net: sch_ets: Make the ETS qdisc offloadable")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/28504887df314588c7255e9911769c36f751edee.1771964872.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_ets.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/net/sched/sch_ets.c
+++ b/net/sched/sch_ets.c
@@ -115,12 +115,12 @@ static void ets_offload_change(struct Qd
struct ets_sched *q = qdisc_priv(sch);
struct tc_ets_qopt_offload qopt;
unsigned int w_psum_prev = 0;
- unsigned int q_psum = 0;
- unsigned int q_sum = 0;
unsigned int quantum;
unsigned int w_psum;
unsigned int weight;
unsigned int i;
+ u64 q_psum = 0;
+ u64 q_sum = 0;
if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
return;
@@ -138,8 +138,12 @@ static void ets_offload_change(struct Qd
for (i = 0; i < q->nbands; i++) {
quantum = q->classes[i].quantum;
- q_psum += quantum;
- w_psum = quantum ? q_psum * 100 / q_sum : 0;
+ if (quantum) {
+ q_psum += quantum;
+ w_psum = div64_u64(q_psum * 100, q_sum);
+ } else {
+ w_psum = 0;
+ }
weight = w_psum - w_psum_prev;
w_psum_prev = w_psum;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 032/491] Squashfs: check metadata block offset is within range
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 031/491] net/sched: ets: fix divide by zero in the offload path Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 033/491] drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Greg Kroah-Hartman
` (463 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a9747fe1c35a5b115d3f,
Phillip Lougher, Christian Brauner, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <phillip@squashfs.org.uk>
commit fdb24a820a5832ec4532273282cbd4f22c291a0d upstream.
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.
The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.
Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
Fixes: f400e12656ab ("Squashfs: cache operations")
Reported-by: syzbot+a9747fe1c35a5b115d3f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/699234e2.a70a0220.2c38d7.00e2.GAE@google.com/
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/squashfs/cache.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -340,6 +340,9 @@ int squashfs_read_metadata(struct super_
if (unlikely(length < 0))
return -EIO;
+ if (unlikely(*offset < 0 || *offset >= SQUASHFS_METADATA_SIZE))
+ return -EIO;
+
while (length) {
entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
if (entry->error) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 033/491] drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 032/491] Squashfs: check metadata block offset is within range Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 034/491] selftests: mptcp: more stable simult_flows tests Greg Kroah-Hartman
` (462 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars Ellenberg <lars.ellenberg@linbit.com>
commit ab140365fb62c0bdab22b2f516aff563b2559e3b upstream.
Even though we check that we "should" be able to do lc_get_cumulative()
while holding the device->al_lock spinlock, it may still fail,
if some other code path decided to do lc_try_lock() with bad timing.
If that happened, we logged "LOGIC BUG for enr=...",
but still did not return an error.
The rest of the code now assumed that this request has references
for the relevant activity log extents.
The implcations are that during an active resync, mutual exclusivity of
resync versus application IO is not guaranteed. And a potential crash
at this point may not realizs that these extents could have been target
of in-flight IO and would need to be resynced just in case.
Also, once the request completes, it will give up activity log references it
does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().
Fix:
Do not crash the kernel for a condition that is harmless during normal
operation: also catch "e->refcnt == 0", not only "e == NULL"
when being noisy about "al_complete_io() called on inactive extent %u\n".
And do not try to be smart and "guess" whether something will work, then
be surprised when it does not.
Deal with the fact that it may or may not work. If it does not, remember a
possible "partially in activity log" state (only possible for requests that
cross extent boundaries), and return an error code from
drbd_al_begin_io_nonblock().
A latter call for the same request will then resume from where we left off.
Cc: stable@vger.kernel.org
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/drbd/drbd_actlog.c | 53 ++++++++++++++++---------------------
drivers/block/drbd/drbd_interval.h | 5 ++-
2 files changed, 27 insertions(+), 31 deletions(-)
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -483,38 +483,20 @@ void drbd_al_begin_io(struct drbd_device
int drbd_al_begin_io_nonblock(struct drbd_device *device, struct drbd_interval *i)
{
- struct lru_cache *al = device->act_log;
/* for bios crossing activity log extent boundaries,
* we may need to activate two extents in one go */
unsigned first = i->sector >> (AL_EXTENT_SHIFT-9);
unsigned last = i->size == 0 ? first : (i->sector + (i->size >> 9) - 1) >> (AL_EXTENT_SHIFT-9);
- unsigned nr_al_extents;
- unsigned available_update_slots;
unsigned enr;
- D_ASSERT(device, first <= last);
-
- nr_al_extents = 1 + last - first; /* worst case: all touched extends are cold. */
- available_update_slots = min(al->nr_elements - al->used,
- al->max_pending_changes - al->pending_changes);
-
- /* We want all necessary updates for a given request within the same transaction
- * We could first check how many updates are *actually* needed,
- * and use that instead of the worst-case nr_al_extents */
- if (available_update_slots < nr_al_extents) {
- /* Too many activity log extents are currently "hot".
- *
- * If we have accumulated pending changes already,
- * we made progress.
- *
- * If we cannot get even a single pending change through,
- * stop the fast path until we made some progress,
- * or requests to "cold" extents could be starved. */
- if (!al->pending_changes)
- __set_bit(__LC_STARVING, &device->act_log->flags);
- return -ENOBUFS;
+ if (i->partially_in_al_next_enr) {
+ D_ASSERT(device, first < i->partially_in_al_next_enr);
+ D_ASSERT(device, last >= i->partially_in_al_next_enr);
+ first = i->partially_in_al_next_enr;
}
+ D_ASSERT(device, first <= last);
+
/* Is resync active in this area? */
for (enr = first; enr <= last; enr++) {
struct lc_element *tmp;
@@ -529,14 +511,21 @@ int drbd_al_begin_io_nonblock(struct drb
}
}
- /* Checkout the refcounts.
- * Given that we checked for available elements and update slots above,
- * this has to be successful. */
+ /* Try to checkout the refcounts. */
for (enr = first; enr <= last; enr++) {
struct lc_element *al_ext;
al_ext = lc_get_cumulative(device->act_log, enr);
- if (!al_ext)
- drbd_info(device, "LOGIC BUG for enr=%u\n", enr);
+
+ if (!al_ext) {
+ /* Did not work. We may have exhausted the possible
+ * changes per transaction. Or raced with someone
+ * "locking" it against changes.
+ * Remember where to continue from.
+ */
+ if (enr > first)
+ i->partially_in_al_next_enr = enr;
+ return -ENOBUFS;
+ }
}
return 0;
}
@@ -556,7 +545,11 @@ void drbd_al_complete_io(struct drbd_dev
for (enr = first; enr <= last; enr++) {
extent = lc_find(device->act_log, enr);
- if (!extent) {
+ /* Yes, this masks a bug elsewhere. However, during normal
+ * operation this is harmless, so no need to crash the kernel
+ * by the BUG_ON(refcount == 0) in lc_put().
+ */
+ if (!extent || extent->refcnt == 0) {
drbd_err(device, "al_complete_io() called on inactive extent %u\n", enr);
continue;
}
--- a/drivers/block/drbd/drbd_interval.h
+++ b/drivers/block/drbd/drbd_interval.h
@@ -8,12 +8,15 @@
struct drbd_interval {
struct rb_node rb;
sector_t sector; /* start sector of the interval */
- unsigned int size; /* size in bytes */
sector_t end; /* highest interval end in subtree */
+ unsigned int size; /* size in bytes */
unsigned int local:1 /* local or remote request? */;
unsigned int waiting:1; /* someone is waiting for completion */
unsigned int completed:1; /* this has been completed already;
* ignore for conflict detection */
+
+ /* to resume a partially successful drbd_al_begin_io_nonblock(); */
+ unsigned int partially_in_al_next_enr;
};
static inline void drbd_clear_interval(struct drbd_interval *i)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 034/491] selftests: mptcp: more stable simult_flows tests
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 033/491] drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 035/491] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Greg Kroah-Hartman
` (461 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 8c09412e584d9bcc0e71d758ec1008d1c8d1a326 upstream.
By default, the netem qdisc can keep up to 1000 packets under its belly
to deal with the configured rate and delay. The simult flows test-case
simulates very low speed links, to avoid problems due to slow CPUs and
the TCP stack tend to transmit at a slightly higher rate than the
(virtual) link constraints.
All the above causes a relatively large amount of packets being enqueued
in the netem qdiscs - the longer the transfer, the longer the queue -
producing increasingly high TCP RTT samples and consequently increasingly
larger receive buffer size due to DRS.
When the receive buffer size becomes considerably larger than the needed
size, the tests results can flake, i.e. because minimal inaccuracy in the
pacing rate can lead to a single subflow usage towards the end of the
connection for a considerable amount of data.
Address the issue explicitly setting netem limits suitable for the
configured link speeds and unflake all the affected tests.
Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-1-4b5462b6f016@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/simult_flows.sh | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/tools/testing/selftests/net/mptcp/simult_flows.sh
+++ b/tools/testing/selftests/net/mptcp/simult_flows.sh
@@ -235,10 +235,13 @@ run_test()
for dev in ns2eth1 ns2eth2; do
tc -n $ns2 qdisc del dev $dev root >/dev/null 2>&1
done
- tc -n $ns1 qdisc add dev ns1eth1 root netem rate ${rate1}mbit $delay1
- tc -n $ns1 qdisc add dev ns1eth2 root netem rate ${rate2}mbit $delay2
- tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1
- tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2
+
+ # keep the queued pkts number low, or the RTT estimator will see
+ # increasing latency over time.
+ tc -n $ns1 qdisc add dev ns1eth1 root netem rate ${rate1}mbit $delay1 limit 50
+ tc -n $ns1 qdisc add dev ns1eth2 root netem rate ${rate2}mbit $delay2 limit 50
+ tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1 limit 50
+ tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2 limit 50
# time is measure in ms
local time=$((size * 8 * 1000 / (( $rate1 + $rate2) * 1024 *1024) ))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 035/491] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 034/491] selftests: mptcp: more stable simult_flows tests Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 036/491] net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table Greg Kroah-Hartman
` (460 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Teh, Mark Pearson,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Teh <jonathan.teh@outlook.com>
[ Upstream commit 53e977b1d50c46f2c4ec3865cd13a822f58ad3cd ]
Check whether the battery supports the relevant charge threshold before
reading the value to silence these errors:
thinkpad_acpi: acpi_evalf(BCTG, dd, ...) failed: AE_NOT_FOUND
ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCTG: evaluate failed
thinkpad_acpi: acpi_evalf(BCSG, dd, ...) failed: AE_NOT_FOUND
ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCSG: evaluate failed
when reading the charge thresholds via sysfs on platforms that do not
support them such as the ThinkPad T400.
Fixes: 2801b9683f74 ("thinkpad_acpi: Add support for battery thresholds")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202619
Signed-off-by: Jonathan Teh <jonathan.teh@outlook.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://patch.msgid.link/MI0P293MB01967B206E1CA6F337EBFB12926CA@MI0P293MB0196.ITAP293.PROD.OUTLOOK.COM
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/thinkpad_acpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index d18b6ddba9829..1dbf19fe85599 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -9412,14 +9412,16 @@ static int tpacpi_battery_get(int what, int battery, int *ret)
{
switch (what) {
case THRESHOLD_START:
- if ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_START, ret, battery))
+ if (!battery_info.batteries[battery].start_support ||
+ ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_START, ret, battery)))
return -ENODEV;
/* The value is in the low 8 bits of the response */
*ret = *ret & 0xFF;
return 0;
case THRESHOLD_STOP:
- if ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_STOP, ret, battery))
+ if (!battery_info.batteries[battery].stop_support ||
+ ACPI_FAILURE(tpacpi_battery_acpi_eval(GET_STOP, ret, battery)))
return -ENODEV;
/* Value is in lower 8 bits */
*ret = *ret & 0xFF;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 036/491] net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 035/491] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 037/491] atm: lec: fix null-ptr-deref in lec_arp_clear_vccs Greg Kroah-Hartman
` (459 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chintan Vankar, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chintan Vankar <c-vankar@ti.com>
[ Upstream commit be11a537224d72b906db6b98510619770298c8a4 ]
In the current implementation, flushing multicast entries in MAC mode
incorrectly deletes entries for all ports instead of only the target port,
disrupting multicast traffic on other ports. The cause is adding multicast
entries by setting only host port bit, and not setting the MAC port bits.
Fix this by setting the MAC port's bit in the port mask while adding the
multicast entry. Also fix the flush logic to preserve the host port bit
during removal of MAC port and free ALE entries when mask contains only
host port.
Fixes: 5c50a856d550 ("drivers: net: ethernet: cpsw: add multicast address to ALE table")
Signed-off-by: Chintan Vankar <c-vankar@ti.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224181359.2055322-1-c-vankar@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +-
drivers/net/ethernet/ti/cpsw_ale.c | 9 ++++-----
2 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index 07510e068742e..2dc3e5be1d717 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -305,7 +305,7 @@ static void am65_cpsw_nuss_ndo_slave_set_rx_mode(struct net_device *ndev)
cpsw_ale_set_allmulti(common->ale,
ndev->flags & IFF_ALLMULTI, port->port_id);
- port_mask = ALE_PORT_HOST;
+ port_mask = BIT(port->port_id) | ALE_PORT_HOST;
/* Clear all mcast from ALE */
cpsw_ale_flush_multicast(common->ale, port_mask, -1);
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index bec6a68a973c4..eb4262017d235 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -420,14 +420,13 @@ static void cpsw_ale_flush_mcast(struct cpsw_ale *ale, u32 *ale_entry,
ale->port_mask_bits);
if ((mask & port_mask) == 0)
return; /* ports dont intersect, not interested */
- mask &= ~port_mask;
+ mask &= (~port_mask | ALE_PORT_HOST);
- /* free if only remaining port is host port */
- if (mask)
+ if (mask == 0x0 || mask == ALE_PORT_HOST)
+ cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
+ else
cpsw_ale_set_port_mask(ale_entry, mask,
ale->port_mask_bits);
- else
- cpsw_ale_set_entry_type(ale_entry, ALE_TYPE_FREE);
}
int cpsw_ale_flush_multicast(struct cpsw_ale *ale, int port_mask, int vid)
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 037/491] atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 036/491] net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 038/491] can: bcm: fix locking for bcm_op runtime updates Greg Kroah-Hartman
` (458 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+72e3ea390c305de0e259,
Dan Carpenter, Simon Horman, Jiayuan Chen, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb ]
syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
This issue can be easily reproduced using the syzkaller reproducer.
In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
When the underlying VCC is closed, lec_vcc_close() iterates over all
ARP entries and calls lec_arp_clear_vccs() for each matched entry.
For example, when lec_vcc_close() iterates through the hlists in
priv->lec_arp_empty_ones or other ARP tables:
1. In the first iteration, for the first matched ARP entry sharing the VCC,
lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
and sets vcc->user_back to NULL.
2. In the second iteration, for the next matched ARP entry sharing the same
VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.
Fix this by adding a null check for vpriv before dereferencing
it. If vpriv is already NULL, it means the VCC has been cleared
by a previous call, so we can safely skip the cleanup and just
clear the entry's vcc/recv_vcc pointers.
The entire cleanup block (including vcc_release_async()) is placed inside
the vpriv guard because a NULL vpriv indicates the VCC has already been
fully released by a prior iteration — repeating the teardown would
redundantly set flags and trigger callbacks on an already-closing socket.
The Fixes tag points to the initial commit because the entry->vcc path has
been vulnerable since the original code. The entry->recv_vcc path was later
added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back")
with the same pattern, and both paths are fixed here.
Reported-by: syzbot+72e3ea390c305de0e259@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68c95a83.050a0220.3c6139.0e5c.GAE@google.com/T/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260225123250.189289-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/atm/lec.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 73078306504c0..768df9d7cd676 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1262,24 +1262,28 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)
struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
struct net_device *dev = (struct net_device *)vcc->proto_data;
- vcc->pop = vpriv->old_pop;
- if (vpriv->xoff)
- netif_wake_queue(dev);
- kfree(vpriv);
- vcc->user_back = NULL;
- vcc->push = entry->old_push;
- vcc_release_async(vcc, -EPIPE);
+ if (vpriv) {
+ vcc->pop = vpriv->old_pop;
+ if (vpriv->xoff)
+ netif_wake_queue(dev);
+ kfree(vpriv);
+ vcc->user_back = NULL;
+ vcc->push = entry->old_push;
+ vcc_release_async(vcc, -EPIPE);
+ }
entry->vcc = NULL;
}
if (entry->recv_vcc) {
struct atm_vcc *vcc = entry->recv_vcc;
struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
- kfree(vpriv);
- vcc->user_back = NULL;
+ if (vpriv) {
+ kfree(vpriv);
+ vcc->user_back = NULL;
- entry->recv_vcc->push = entry->old_recv_push;
- vcc_release_async(entry->recv_vcc, -EPIPE);
+ entry->recv_vcc->push = entry->old_recv_push;
+ vcc_release_async(entry->recv_vcc, -EPIPE);
+ }
entry->recv_vcc = NULL;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 038/491] can: bcm: fix locking for bcm_op runtime updates
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 037/491] atm: lec: fix null-ptr-deref in lec_arp_clear_vccs Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 039/491] can: mcp251x: fix deadlock in error path of mcp251x_open Greg Kroah-Hartman
` (457 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5b11eccc403dd1cea9f8,
Oliver Hartkopp, Marc Kleine-Budde, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
[ Upstream commit c35636e91e392e1540949bbc67932167cb48bc3a ]
Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
added a locking for some variables that can be modified at runtime when
updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().
Usually the RX_SETUP only handles and filters incoming traffic with one
exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is
sent when a specific RTR frame is received. Therefore the rx bcm_op uses
bcm_can_tx() which uses the bcm_tx_lock that was only initialized in
bcm_tx_setup(). Add the missing spin_lock_init() when allocating the
bcm_op in bcm_rx_setup() to handle the RTR case properly.
Fixes: c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
Reported-by: syzbot+5b11eccc403dd1cea9f8@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-can/699466e4.a70a0220.2c38d7.00ff.GAE@google.com/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260218-bcm_spin_lock_init-v1-1-592634c8a5b5@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 200b66e85c1c6..414a2bb17397b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1123,6 +1123,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (!op)
return -ENOMEM;
+ spin_lock_init(&op->bcm_tx_lock);
op->can_id = msg_head->can_id;
op->nframes = msg_head->nframes;
op->cfsiz = CFSIZ(msg_head->flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 039/491] can: mcp251x: fix deadlock in error path of mcp251x_open
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 038/491] can: bcm: fix locking for bcm_op runtime updates Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths Greg Kroah-Hartman
` (456 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alban Bedel, Marc Kleine-Budde,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Bedel <alban.bedel@lht.dlh.de>
[ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ]
The mcp251x_open() function call free_irq() in its error path with the
mpc_lock mutex held. But if an interrupt already occurred the
interrupt handler will be waiting for the mpc_lock and free_irq() will
deadlock waiting for the handler to finish.
This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can:
mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but
for the error path.
To solve this issue move the call to free_irq() after the lock is
released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ
handler will exit right away once it acquired the lock.
Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de
Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/spi/mcp251x.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index 88d065718e990..b06b15debafac 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -1207,6 +1207,7 @@ static int mcp251x_open(struct net_device *net)
{
struct mcp251x_priv *priv = netdev_priv(net);
struct spi_device *spi = priv->spi;
+ bool release_irq = false;
unsigned long flags = 0;
int ret;
@@ -1252,12 +1253,24 @@ static int mcp251x_open(struct net_device *net)
return 0;
out_free_irq:
- free_irq(spi->irq, priv);
+ /* The IRQ handler might be running, and if so it will be waiting
+ * for the lock. But free_irq() must wait for the handler to finish
+ * so calling it here would deadlock.
+ *
+ * Setting priv->force_quit will let the handler exit right away
+ * without any access to the hardware. This make it safe to call
+ * free_irq() after the lock is released.
+ */
+ priv->force_quit = 1;
+ release_irq = true;
+
mcp251x_hw_sleep(spi);
out_close:
mcp251x_power_enable(priv->transceiver, 0);
close_candev(net);
mutex_unlock(&priv->mcp_lock);
+ if (release_irq)
+ free_irq(spi->irq, priv);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 039/491] can: mcp251x: fix deadlock in error path of mcp251x_open Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-14 20:48 ` Ben Hutchings
2026-04-13 15:54 ` [PATCH 5.10 041/491] wifi: wlcore: Fix a locking bug Greg Kroah-Hartman
` (455 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit d98c24617a831e92e7224a07dcaed2dd0b02af96 ]
cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
returns zero. This mutex must be unlocked if an error is returned. Add
mutex_unlock() calls to the error paths from which that call is missing.
This has been detected by the Clang thread-safety analyzer.
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260223220102.2158611-25-bart.vanassche@linux.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/st/cw1200/pm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/st/cw1200/pm.c b/drivers/net/wireless/st/cw1200/pm.c
index a20ab577a3644..212b6f2af8de4 100644
--- a/drivers/net/wireless/st/cw1200/pm.c
+++ b/drivers/net/wireless/st/cw1200/pm.c
@@ -264,12 +264,14 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
wiphy_err(priv->hw->wiphy,
"PM request failed: %d. WoW is disabled.\n", ret);
cw1200_wow_resume(hw);
+ mutex_unlock(&priv->conf_mutex);
return -EBUSY;
}
/* Force resume if event is coming from the device. */
if (atomic_read(&priv->bh_rx)) {
cw1200_wow_resume(hw);
+ mutex_unlock(&priv->conf_mutex);
return -EAGAIN;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 041/491] wifi: wlcore: Fix a locking bug
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 042/491] indirect_call_wrapper: do not reevaluate function pointer Greg Kroah-Hartman
` (454 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 72c6df8f284b3a49812ce2ac136727ace70acc7c ]
Make sure that wl->mutex is locked before it is unlocked. This has been
detected by the Clang thread-safety analyzer.
Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260223220102.2158611-26-bart.vanassche@linux.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ti/wlcore/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 109c51e497926..30430b4a4188f 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1813,6 +1813,8 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
wl->wow_enabled);
WARN_ON(!wl->wow_enabled);
+ mutex_lock(&wl->mutex);
+
ret = pm_runtime_force_resume(wl->dev);
if (ret < 0) {
wl1271_error("ELP wakeup failure!");
@@ -1829,8 +1831,6 @@ static int __maybe_unused wl1271_op_resume(struct ieee80211_hw *hw)
run_irq_work = true;
spin_unlock_irqrestore(&wl->wl_lock, flags);
- mutex_lock(&wl->mutex);
-
/* test the recovery flag before calling any SDIO functions */
pending_recovery = test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS,
&wl->flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 042/491] indirect_call_wrapper: do not reevaluate function pointer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 041/491] wifi: wlcore: Fix a locking bug Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 043/491] xen/acpi-processor: fix _CST detection using undersized evaluation buffer Greg Kroah-Hartman
` (453 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Kuniyuki Iwashima,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 710f5c76580306cdb9ec51fac8fcf6a8faff7821 ]
We have an increasing number of READ_ONCE(xxx->function)
combined with INDIRECT_CALL_[1234]() helpers.
Unfortunately this forces INDIRECT_CALL_[1234]() to read
xxx->function many times, which is not what we wanted.
Fix these macros so that xxx->function value is not reloaded.
$ scripts/bloat-o-meter -t vmlinux.0 vmlinux
add/remove: 0/0 grow/shrink: 1/65 up/down: 122/-1084 (-962)
Function old new delta
ip_push_pending_frames 59 181 +122
ip6_finish_output 687 681 -6
__udp_enqueue_schedule_skb 1078 1072 -6
ioam6_output 2319 2312 -7
xfrm4_rcv_encap_finish2 64 56 -8
xfrm4_output 297 289 -8
vrf_ip_local_out 278 270 -8
vrf_ip6_local_out 278 270 -8
seg6_input_finish 64 56 -8
rpl_output 700 692 -8
ipmr_forward_finish 124 116 -8
ip_forward_finish 143 135 -8
ip6mr_forward2_finish 100 92 -8
ip6_forward_finish 73 65 -8
input_action_end_bpf 1091 1083 -8
dst_input 52 44 -8
__xfrm6_output 801 793 -8
__xfrm4_output 83 75 -8
bpf_input 500 491 -9
__tcp_check_space 530 521 -9
input_action_end_dt6 291 280 -11
vti6_tnl_xmit 1634 1622 -12
bpf_xmit 1203 1191 -12
rpl_input 497 483 -14
rawv6_send_hdrinc 1355 1341 -14
ndisc_send_skb 1030 1016 -14
ipv6_srh_rcv 1377 1363 -14
ip_send_unicast_reply 1253 1239 -14
ip_rcv_finish 226 212 -14
ip6_rcv_finish 300 286 -14
input_action_end_x_core 205 191 -14
input_action_end_x 355 341 -14
input_action_end_t 205 191 -14
input_action_end_dx6_finish 127 113 -14
input_action_end_dx4_finish 373 359 -14
input_action_end_dt4 426 412 -14
input_action_end_core 186 172 -14
input_action_end_b6_encap 292 278 -14
input_action_end_b6 198 184 -14
igmp6_send 1332 1318 -14
ip_sublist_rcv 864 848 -16
ip6_sublist_rcv 1091 1075 -16
ipv6_rpl_srh_rcv 1937 1920 -17
xfrm_policy_queue_process 1246 1228 -18
seg6_output_core 903 885 -18
mld_sendpack 856 836 -20
NF_HOOK 756 736 -20
vti_tunnel_xmit 1447 1426 -21
input_action_end_dx6 664 642 -22
input_action_end 1502 1480 -22
sock_sendmsg_nosec 134 111 -23
ip6mr_forward2 388 364 -24
sock_recvmsg_nosec 134 109 -25
seg6_input_core 836 810 -26
ip_send_skb 172 146 -26
ip_local_out 140 114 -26
ip6_local_out 140 114 -26
__sock_sendmsg 162 136 -26
__ip_queue_xmit 1196 1170 -26
__ip_finish_output 405 379 -26
ipmr_queue_fwd_xmit 373 346 -27
sock_recvmsg 173 145 -28
ip6_xmit 1635 1607 -28
xfrm_output_resume 1418 1389 -29
ip_build_and_send_pkt 625 591 -34
dst_output 504 432 -72
Total: Before=25217686, After=25216724, chg -0.00%
Fixes: 283c16a2dfd3 ("indirect call wrappers: helpers to speed-up indirect calls of builtin")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260227172603.1700433-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/indirect_call_wrapper.h | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/include/linux/indirect_call_wrapper.h b/include/linux/indirect_call_wrapper.h
index cfcfef37b2f1a..6afdd080c7c1b 100644
--- a/include/linux/indirect_call_wrapper.h
+++ b/include/linux/indirect_call_wrapper.h
@@ -16,22 +16,26 @@
*/
#define INDIRECT_CALL_1(f, f1, ...) \
({ \
- likely(f == f1) ? f1(__VA_ARGS__) : f(__VA_ARGS__); \
+ typeof(f) __f1 = (f); \
+ likely(__f1 == f1) ? f1(__VA_ARGS__) : __f1(__VA_ARGS__); \
})
#define INDIRECT_CALL_2(f, f2, f1, ...) \
({ \
- likely(f == f2) ? f2(__VA_ARGS__) : \
- INDIRECT_CALL_1(f, f1, __VA_ARGS__); \
+ typeof(f) __f2 = (f); \
+ likely(__f2 == f2) ? f2(__VA_ARGS__) : \
+ INDIRECT_CALL_1(__f2, f1, __VA_ARGS__); \
})
#define INDIRECT_CALL_3(f, f3, f2, f1, ...) \
({ \
- likely(f == f3) ? f3(__VA_ARGS__) : \
- INDIRECT_CALL_2(f, f2, f1, __VA_ARGS__); \
+ typeof(f) __f3 = (f); \
+ likely(__f3 == f3) ? f3(__VA_ARGS__) : \
+ INDIRECT_CALL_2(__f3, f2, f1, __VA_ARGS__); \
})
#define INDIRECT_CALL_4(f, f4, f3, f2, f1, ...) \
({ \
- likely(f == f4) ? f4(__VA_ARGS__) : \
- INDIRECT_CALL_3(f, f3, f2, f1, __VA_ARGS__); \
+ typeof(f) __f4 = (f); \
+ likely(__f4 == f4) ? f4(__VA_ARGS__) : \
+ INDIRECT_CALL_3(__f4, f3, f2, f1, __VA_ARGS__); \
})
#define INDIRECT_CALLABLE_DECLARE(f) f
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 043/491] xen/acpi-processor: fix _CST detection using undersized evaluation buffer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 042/491] indirect_call_wrapper: do not reevaluate function pointer Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 044/491] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() Greg Kroah-Hartman
` (452 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Thomson, Jan Beulich,
Juergen Gross, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thomson <dt@linux-mail.net>
[ Upstream commit 8b57227d59a86fc06d4f09de08f98133680f2cae ]
read_acpi_id() attempts to evaluate _CST using a stack buffer of
sizeof(union acpi_object) (48 bytes), but _CST returns a nested Package
of sub-Packages (one per C-state, each containing a register descriptor,
type, latency, and power) requiring hundreds of bytes. The evaluation
always fails with AE_BUFFER_OVERFLOW.
On modern systems using FFH/MWAIT entry (where pblk is zero), this
causes the function to return before setting the acpi_id_cst_present
bit. In check_acpi_ids(), flags.power is then zero for all Phase 2 CPUs
(physical CPUs beyond dom0's vCPU count), so push_cxx_to_hypervisor() is
never called for them.
On a system with dom0_max_vcpus=2 and 8 physical CPUs, only PCPUs 0-1
receive C-state data. PCPUs 2-7 are stuck in C0/C1 idle, unable to
enter C2/C3. This costs measurable wall power (4W observed on an Intel
Core Ultra 7 265K with Xen 4.20).
The function never uses the _CST return value -- it only needs to know
whether _CST exists. Replace the broken acpi_evaluate_object() call with
acpi_has_method(), which correctly detects _CST presence using
acpi_get_handle() without any buffer allocation. This brings C-state
detection to parity with the P-state path, which already works correctly
for Phase 2 CPUs.
Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
Signed-off-by: David Thomson <dt@linux-mail.net>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260224093707.19679-1-dt@linux-mail.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xen-acpi-processor.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index ce8ffb595a468..cb2affe11b02f 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -378,11 +378,8 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
acpi_psd[acpi_id].domain);
}
- status = acpi_evaluate_object(handle, "_CST", NULL, &buffer);
- if (ACPI_FAILURE(status)) {
- if (!pblk)
- return AE_OK;
- }
+ if (!pblk && !acpi_has_method(handle, "_CST"))
+ return AE_OK;
/* .. and it has a C-state */
__set_bit(acpi_id, acpi_id_cst_present);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 044/491] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 043/491] xen/acpi-processor: fix _CST detection using undersized evaluation buffer Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 045/491] amd-xgbe: fix sleep while atomic on suspend/resume Greg Kroah-Hartman
` (451 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a ]
l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.
Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260301194548.927324-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b47f89600c2f8..ac24f8b624e34 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1013,7 +1013,8 @@ static struct net_device *ip6_rt_get_dev_rcu(const struct fib6_result *res)
*/
if (netif_is_l3_slave(dev) &&
!rt6_need_strict(&res->f6i->fib6_dst.addr))
- dev = l3mdev_master_dev_rcu(dev);
+ dev = l3mdev_master_dev_rcu(dev) ? :
+ dev_net(dev)->loopback_dev;
else if (!netif_is_l3_master(dev))
dev = dev_net(dev)->loopback_dev;
/* last case is netif_is_l3_master(dev) is true in which
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 045/491] amd-xgbe: fix sleep while atomic on suspend/resume
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 044/491] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 046/491] net: nfc: nci: Fix zero-length proprietary notifications Greg Kroah-Hartman
` (450 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raju Rangoju, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <Raju.Rangoju@amd.com>
[ Upstream commit e2f27363aa6d983504c6836dd0975535e2e9dba0 ]
The xgbe_powerdown() and xgbe_powerup() functions use spinlocks
(spin_lock_irqsave) while calling functions that may sleep:
- napi_disable() can sleep waiting for NAPI polling to complete
- flush_workqueue() can sleep waiting for pending work items
This causes a "BUG: scheduling while atomic" error during suspend/resume
cycles on systems using the AMD XGBE Ethernet controller.
The spinlock protection in these functions is unnecessary as these
functions are called from suspend/resume paths which are already serialized
by the PM core
Fix this by removing the spinlock. Since only code that takes this lock
is xgbe_powerdown() and xgbe_powerup(), remove it completely.
Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver")
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Link: https://patch.msgid.link/20260302042124.1386445-1-Raju.Rangoju@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 10 ----------
drivers/net/ethernet/amd/xgbe/xgbe-main.c | 1 -
drivers/net/ethernet/amd/xgbe/xgbe.h | 3 ---
3 files changed, 14 deletions(-)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 3de7674a84675..00f2df29ed617 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1181,7 +1181,6 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
{
struct xgbe_prv_data *pdata = netdev_priv(netdev);
struct xgbe_hw_if *hw_if = &pdata->hw_if;
- unsigned long flags;
DBGPR("-->xgbe_powerdown\n");
@@ -1192,8 +1191,6 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
return -EINVAL;
}
- spin_lock_irqsave(&pdata->lock, flags);
-
if (caller == XGMAC_DRIVER_CONTEXT)
netif_device_detach(netdev);
@@ -1209,8 +1206,6 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
pdata->power_down = 1;
- spin_unlock_irqrestore(&pdata->lock, flags);
-
DBGPR("<--xgbe_powerdown\n");
return 0;
@@ -1220,7 +1215,6 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
{
struct xgbe_prv_data *pdata = netdev_priv(netdev);
struct xgbe_hw_if *hw_if = &pdata->hw_if;
- unsigned long flags;
DBGPR("-->xgbe_powerup\n");
@@ -1231,8 +1225,6 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
return -EINVAL;
}
- spin_lock_irqsave(&pdata->lock, flags);
-
pdata->power_down = 0;
xgbe_napi_enable(pdata, 0);
@@ -1247,8 +1239,6 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
xgbe_start_timers(pdata);
- spin_unlock_irqrestore(&pdata->lock, flags);
-
DBGPR("<--xgbe_powerup\n");
return 0;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index a218dc6f2edd5..dfd1add6dbaac 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -185,7 +185,6 @@ struct xgbe_prv_data *xgbe_alloc_pdata(struct device *dev)
pdata->netdev = netdev;
pdata->dev = dev;
- spin_lock_init(&pdata->lock);
spin_lock_init(&pdata->xpcs_lock);
mutex_init(&pdata->rss_mutex);
spin_lock_init(&pdata->tstamp_lock);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 61f22462197ae..7a755c1fd5ef2 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -1050,9 +1050,6 @@ struct xgbe_prv_data {
unsigned int pp3;
unsigned int pp4;
- /* Overall device lock */
- spinlock_t lock;
-
/* XPCS indirect addressing lock */
spinlock_t xpcs_lock;
unsigned int xpcs_window_def_reg;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 046/491] net: nfc: nci: Fix zero-length proprietary notifications
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 045/491] amd-xgbe: fix sleep while atomic on suspend/resume Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 047/491] nfc: nci: free skb on nci_transceive early error paths Greg Kroah-Hartman
` (449 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Ray, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Ray <ian.ray@gehealthcare.com>
[ Upstream commit f7d92f11bd33a6eb49c7c812255ef4ab13681f0f ]
NCI NFC controllers may have proprietary OIDs with zero-length payload.
One example is: drivers/nfc/nxp-nci/core.c, NXP_NCI_RF_TXLDO_ERROR_NTF.
Allow a zero length payload in proprietary notifications *only*.
Before:
-- >8 --
kernel: nci: nci_recv_frame: len 3
-- >8 --
After:
-- >8 --
kernel: nci: nci_recv_frame: len 3
kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x23, plen=0
kernel: nci: nci_ntf_packet: unknown ntf opcode 0x123
kernel: nfc nfc0: NFC: RF transmitter couldn't start. Bad power and/or configuration?
-- >8 --
After fixing the hardware:
-- >8 --
kernel: nci: nci_recv_frame: len 27
kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x5, plen=24
kernel: nci: nci_rf_intf_activated_ntf_packet: rf_discovery_id 1
-- >8 --
Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
Link: https://patch.msgid.link/20260302163238.140576-1-ian.ray@gehealthcare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/core.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 3514686eb53f9..188677c322f4c 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1460,10 +1460,20 @@ static bool nci_valid_size(struct sk_buff *skb)
BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE);
if (skb->len < hdr_size ||
- !nci_plen(skb->data) ||
skb->len < hdr_size + nci_plen(skb->data)) {
return false;
}
+
+ if (!nci_plen(skb->data)) {
+ /* Allow zero length in proprietary notifications (0x20 - 0x3F). */
+ if (nci_opcode_oid(nci_opcode(skb->data)) >= 0x20 &&
+ nci_mt(skb->data) == NCI_MT_NTF_PKT)
+ return true;
+
+ /* Disallow zero length otherwise. */
+ return false;
+ }
+
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 047/491] nfc: nci: free skb on nci_transceive early error paths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 046/491] net: nfc: nci: Fix zero-length proprietary notifications Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 048/491] nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Greg Kroah-Hartman
` (448 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joe Damato, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c ]
nci_transceive() takes ownership of the skb passed by the caller,
but the -EPROTO, -EINVAL, and -EBUSY error paths return without
freeing it.
Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes
the nci/nci_dev selftest hits the error path occasionally in NIPA,
and kmemleak detects leaks:
unreferenced object 0xff11000015ce6a40 (size 640):
comm "nci_dev", pid 3954, jiffies 4295441246
hex dump (first 32 bytes):
6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk
6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
backtrace (crc 7c40cc2a):
kmem_cache_alloc_node_noprof+0x492/0x630
__alloc_skb+0x11e/0x5f0
alloc_skb_with_frags+0xc6/0x8f0
sock_alloc_send_pskb+0x326/0x3f0
nfc_alloc_send_skb+0x94/0x1d0
rawsock_sendmsg+0x162/0x4c0
do_syscall_64+0x117/0xfc0
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/core.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 188677c322f4c..873c9073e4111 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1014,18 +1014,23 @@ static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,
struct nci_conn_info *conn_info;
conn_info = ndev->rf_conn_info;
- if (!conn_info)
+ if (!conn_info) {
+ kfree_skb(skb);
return -EPROTO;
+ }
pr_debug("target_idx %d, len %d\n", target->idx, skb->len);
if (!ndev->target_active_prot) {
pr_err("unable to exchange data, no active target\n");
+ kfree_skb(skb);
return -EINVAL;
}
- if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags))
+ if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags)) {
+ kfree_skb(skb);
return -EBUSY;
+ }
/* store cb and context to be used on receiving data */
conn_info->data_exchange_cb = cb;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 048/491] nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 047/491] nfc: nci: free skb on nci_transceive early error paths Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 049/491] nfc: rawsock: cancel tx_work before socket teardown Greg Kroah-Hartman
` (447 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joe Damato, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 0efdc02f4f6d52f8ca5d5889560f325a836ce0a8 ]
Move clear_bit(NCI_DATA_EXCHANGE) before invoking the data exchange
callback in nci_data_exchange_complete().
The callback (e.g. rawsock_data_exchange_complete) may immediately
schedule another data exchange via schedule_work(tx_work). On a
multi-CPU system, tx_work can run and reach nci_transceive() before
the current nci_data_exchange_complete() clears the flag, causing
test_and_set_bit(NCI_DATA_EXCHANGE) to return -EBUSY and the new
transfer to fail.
This causes intermittent flakes in nci/nci_dev in NIPA:
# # RUN NCI.NCI1_0.t4t_tag_read ...
# # t4t_tag_read: Test terminated by timeout
# # FAIL NCI.NCI1_0.t4t_tag_read
# not ok 3 NCI.NCI1_0.t4t_tag_read
Fixes: 38f04c6b1b68 ("NFC: protect nci_data_exchange transactions")
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-5-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/data.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index b4548d8874899..4f06a2903ae75 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -33,7 +33,8 @@ void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);
if (!conn_info) {
kfree_skb(skb);
- goto exit;
+ clear_bit(NCI_DATA_EXCHANGE, &ndev->flags);
+ return;
}
cb = conn_info->data_exchange_cb;
@@ -45,6 +46,12 @@ void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
del_timer_sync(&ndev->data_timer);
clear_bit(NCI_DATA_EXCHANGE_TO, &ndev->flags);
+ /* Mark the exchange as done before calling the callback.
+ * The callback (e.g. rawsock_data_exchange_complete) may
+ * want to immediately queue another data exchange.
+ */
+ clear_bit(NCI_DATA_EXCHANGE, &ndev->flags);
+
if (cb) {
/* forward skb to nfc core */
cb(cb_context, skb, err);
@@ -54,9 +61,6 @@ void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
/* no waiting callback, free skb */
kfree_skb(skb);
}
-
-exit:
- clear_bit(NCI_DATA_EXCHANGE, &ndev->flags);
}
/* ----------------- NCI TX Data ----------------- */
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 049/491] nfc: rawsock: cancel tx_work before socket teardown
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 048/491] nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 050/491] net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled Greg Kroah-Hartman
` (446 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joe Damato, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit d793458c45df2aed498d7f74145eab7ee22d25aa ]
In rawsock_release(), cancel any pending tx_work and purge the write
queue before orphaning the socket. rawsock_tx_work runs on the system
workqueue and calls nfc_data_exchange which dereferences the NCI
device. Without synchronization, tx_work can race with socket and
device teardown when a process is killed (e.g. by SIGKILL), leading
to use-after-free or leaked references.
Set SEND_SHUTDOWN first so that if tx_work is already running it will
see the flag and skip transmitting, then use cancel_work_sync to wait
for any in-progress execution to finish, and finally purge any
remaining queued skbs.
Fixes: 23b7869c0fd0 ("NFC: add the NFC socket raw protocol")
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-6-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/rawsock.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 5f1d438a0a23f..0e59706e4e8ab 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -66,6 +66,17 @@ static int rawsock_release(struct socket *sock)
if (sock->type == SOCK_RAW)
nfc_sock_unlink(&raw_sk_list, sk);
+ if (sk->sk_state == TCP_ESTABLISHED) {
+ /* Prevent rawsock_tx_work from starting new transmits and
+ * wait for any in-progress work to finish. This must happen
+ * before the socket is orphaned to avoid a race where
+ * rawsock_tx_work runs after the NCI device has been freed.
+ */
+ sk->sk_shutdown |= SEND_SHUTDOWN;
+ cancel_work_sync(&nfc_rawsock(sk)->tx_work);
+ rawsock_write_queue_purge(sk);
+ }
+
sock_orphan(sk);
sock_put(sk);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 050/491] net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 049/491] nfc: rawsock: cancel tx_work before socket teardown Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 051/491] net: vxlan: " Greg Kroah-Hartman
` (445 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guruprasad C P,
Fernando Fernandez Mancera, Ido Schimmel, Nikolay Aleksandrov,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit e5e890630533bdc15b26a34bb8e7ef539bdf1322 ]
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. Then, if neigh_suppress is enabled and an ICMPv6
Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will
dereference ipv6_stub->nd_tbl which is NULL, passing it to
neigh_lookup(). This causes a kernel NULL pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000268
Oops: 0000 [#1] PREEMPT SMP NOPTI
[...]
RIP: 0010:neigh_lookup+0x16/0xe0
[...]
Call Trace:
<IRQ>
? neigh_lookup+0x16/0xe0
br_do_suppress_nd+0x160/0x290 [bridge]
br_handle_frame_finish+0x500/0x620 [bridge]
br_handle_frame+0x353/0x440 [bridge]
__netif_receive_skb_core.constprop.0+0x298/0x1110
__netif_receive_skb_one_core+0x3d/0xa0
process_backlog+0xa0/0x140
__napi_poll+0x2c/0x170
net_rx_action+0x2c4/0x3a0
handle_softirqs+0xd0/0x270
do_softirq+0x3f/0x60
Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in
the callers. This is in essence disabling NS/NA suppression when IPv6 is
disabled.
Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
Reported-by: Guruprasad C P <gurucp2005@gmail.com>
Closes: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp=utE2H2VTX5nqfgs7LDxQ@mail.gmail.com/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_device.c | 2 +-
net/bridge/br_input.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 84e37108c6b5e..2c59e3f918ca2 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -70,7 +70,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) &&
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) {
br_do_proxy_suppress_arp(skb, br, vid, NULL);
- } else if (IS_ENABLED(CONFIG_IPV6) &&
+ } else if (ipv6_mod_enabled() &&
skb->protocol == htons(ETH_P_IPV6) &&
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
pskb_may_pull(skb, sizeof(struct ipv6hdr) +
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index f9d4b86e3186d..4d7e99a547784 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -124,7 +124,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
(skb->protocol == htons(ETH_P_ARP) ||
skb->protocol == htons(ETH_P_RARP))) {
br_do_proxy_suppress_arp(skb, br, vid, p);
- } else if (IS_ENABLED(CONFIG_IPV6) &&
+ } else if (ipv6_mod_enabled() &&
skb->protocol == htons(ETH_P_IPV6) &&
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
pskb_may_pull(skb, sizeof(struct ipv6hdr) +
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 051/491] net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 050/491] net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 052/491] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Greg Kroah-Hartman
` (444 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 168ff39e4758897d2eee4756977d036d52884c7e ]
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. If an IPv6 packet is injected into the interface,
route_shortcircuit() is called and a NULL pointer dereference happens on
neigh_lookup().
BUG: kernel NULL pointer dereference, address: 0000000000000380
Oops: Oops: 0000 [#1] SMP NOPTI
[...]
RIP: 0010:neigh_lookup+0x20/0x270
[...]
Call Trace:
<TASK>
vxlan_xmit+0x638/0x1ef0 [vxlan]
dev_hard_start_xmit+0x9e/0x2e0
__dev_queue_xmit+0xbee/0x14e0
packet_sendmsg+0x116f/0x1930
__sys_sendto+0x1f5/0x200
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x12f/0x1590
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix this by adding an early check on route_shortcircuit() when protocol
is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because
VXLAN can be built-in even when IPv6 is built as a module.
Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan/vxlan_core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 7973d4070ee3b..c24535dc051c0 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2258,6 +2258,11 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
{
struct ipv6hdr *pip6;
+ /* check if nd_tbl is not initiliazed due to
+ * ipv6.disable=1 set during boot
+ */
+ if (!ipv6_stub->nd_tbl)
+ return false;
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
return false;
pip6 = ipv6_hdr(skb);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 052/491] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 051/491] net: vxlan: " Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 053/491] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Greg Kroah-Hartman
` (443 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel,
syzbot+334190e097a98a1b81bb, Jiayuan Chen, David Ahern,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 21ec92774d1536f71bdc90b0e3d052eff99cf093 ]
When a standalone IPv6 nexthop object is created with a loopback device
(e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies
it as a reject route. This is because nexthop objects have no destination
prefix (fc_dst=::), causing fib6_is_reject() to match any loopback
nexthop. The reject path skips fib_nh_common_init(), leaving
nhc_pcpu_rth_output unallocated. If an IPv4 route later references this
nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and
panics.
Simplify the check in fib6_nh_init() to only match explicit reject
routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback
promotion heuristic in fib6_is_reject() is handled separately by
ip6_route_info_create_nh(). After this change, the three cases behave
as follows:
1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"):
RTF_REJECT is set, enters reject path, skips fib_nh_common_init().
No behavior change.
2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"):
RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
called. ip6_route_info_create_nh() still promotes it to reject
afterward. nhc_pcpu_rth_output is allocated but unused, which is
harmless.
3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"):
RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
called. nhc_pcpu_rth_output is properly allocated, fixing the crash
when IPv4 routes reference this nexthop.
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects")
Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ac24f8b624e34..27736b5847378 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3408,7 +3408,6 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
{
struct net_device *dev = NULL;
struct inet6_dev *idev = NULL;
- int addr_type;
int err;
fib6_nh->fib_nh_family = AF_INET6;
@@ -3449,11 +3448,10 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
fib6_nh->fib_nh_weight = 1;
- /* We cannot add true routes via loopback here,
- * they would result in kernel looping; promote them to reject routes
+ /* Reset the nexthop device to the loopback device in case of reject
+ * routes.
*/
- addr_type = ipv6_addr_type(&cfg->fc_dst);
- if (fib6_is_reject(cfg->fc_flags, dev, addr_type)) {
+ if (cfg->fc_flags & RTF_REJECT) {
/* hold loopback dev/idev if we haven't done so. */
if (dev != net->loopback_dev) {
if (dev) {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 053/491] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 052/491] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 054/491] ACPI: PM: Save NVS memory on Lenovo G70-35 Greg Kroah-Hartman
` (442 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kiszka, Florian Bezdeka,
Michael Kelley, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <jan.kiszka@siemens.com>
[ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ]
This resolves the follow splat and lock-up when running with PREEMPT_RT
enabled on Hyper-V:
[ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002
[ 415.140822] INFO: lockdep is turned off.
[ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common
[ 415.140846] Preemption disabled at:
[ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)}
[ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024
[ 415.140857] Call Trace:
[ 415.140861] <TASK>
[ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140863] dump_stack_lvl+0x91/0xb0
[ 415.140870] __schedule_bug+0x9c/0xc0
[ 415.140875] __schedule+0xdf6/0x1300
[ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980
[ 415.140879] ? rcu_is_watching+0x12/0x60
[ 415.140883] schedule_rtlock+0x21/0x40
[ 415.140885] rtlock_slowlock_locked+0x502/0x1980
[ 415.140891] rt_spin_lock+0x89/0x1e0
[ 415.140893] hv_ringbuffer_write+0x87/0x2a0
[ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0
[ 415.140900] ? rcu_is_watching+0x12/0x60
[ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc]
[ 415.140904] ? HARDIRQ_verbose+0x10/0x10
[ 415.140908] ? __rq_qos_issue+0x28/0x40
[ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod]
[ 415.140926] __blk_mq_issue_directly+0x4a/0xc0
[ 415.140928] blk_mq_issue_direct+0x87/0x2b0
[ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440
[ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0
[ 415.140935] __blk_flush_plug+0xf4/0x150
[ 415.140940] __submit_bio+0x2b2/0x5c0
[ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360
[ 415.140946] submit_bio_noacct_nocheck+0x272/0x360
[ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4]
[ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4]
[ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4]
[ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4]
[ 415.141060] generic_perform_write+0x14e/0x2c0
[ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4]
[ 415.141083] vfs_write+0x2ca/0x570
[ 415.141087] ksys_write+0x76/0xf0
[ 415.141089] do_syscall_64+0x99/0x1490
[ 415.141093] ? rcu_is_watching+0x12/0x60
[ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0
[ 415.141097] ? rcu_is_watching+0x12/0x60
[ 415.141098] ? lock_release+0x1f0/0x2a0
[ 415.141100] ? rcu_is_watching+0x12/0x60
[ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0
[ 415.141103] ? rcu_is_watching+0x12/0x60
[ 415.141104] ? __schedule+0xb34/0x1300
[ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170
[ 415.141109] ? do_nanosleep+0x8b/0x160
[ 415.141111] ? hrtimer_nanosleep+0x89/0x100
[ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 415.141116] ? xfd_validate_state+0x26/0x90
[ 415.141118] ? rcu_is_watching+0x12/0x60
[ 415.141120] ? do_syscall_64+0x1e0/0x1490
[ 415.141121] ? do_syscall_64+0x1e0/0x1490
[ 415.141123] ? rcu_is_watching+0x12/0x60
[ 415.141124] ? do_syscall_64+0x1e0/0x1490
[ 415.141125] ? do_syscall_64+0x1e0/0x1490
[ 415.141127] ? irqentry_exit+0x140/0x7e0
[ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e
get_cpu() disables preemption while the spinlock hv_ringbuffer_write is
using is converted to an rt-mutex under PREEMPT_RT.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Tested-by: Florian Bezdeka <florian.bezdeka@siemens.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/storvsc_drv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 917ba169d418b..d91e022a0154c 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1832,8 +1832,9 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
cmd_request->payload_sz = payload_sz;
/* Invokes the vsc to start an IO */
- ret = storvsc_do_io(dev, cmd_request, get_cpu());
- put_cpu();
+ migrate_disable();
+ ret = storvsc_do_io(dev, cmd_request, smp_processor_id());
+ migrate_enable();
if (ret == -EAGAIN) {
if (payload_sz > sizeof(cmd_request->mpb))
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 054/491] ACPI: PM: Save NVS memory on Lenovo G70-35
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 053/491] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Greg Kroah-Hartman
@ 2026-04-13 15:54 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 055/491] unshare: fix unshare_fs() handling Greg Kroah-Hartman
` (441 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Piotr Mazek, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Mazek <pmazek@outlook.com>
[ Upstream commit 023cd6d90f8aa2ef7b72d84be84a18e61ecebd64 ]
[821d6f0359b0614792ab8e2fb93b503e25a65079] prevented machines
produced later than 2012 from saving NVS region to accelerate S3.
Despite being made after 2012, Lenovo G70-35 still needs NVS memory
saving during S3. A quirk is introduced for this platform.
Signed-off-by: Piotr Mazek <pmazek@outlook.com>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/GV2PPF3CD5B63CC2442EE3F76F8443EAD90D499A@GV2PPF3CD5B63CC.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/sleep.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index e79c004ca0b24..df03b6ed16fbb 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -372,6 +372,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
DMI_MATCH(DMI_PRODUCT_NAME, "80E1"),
},
},
+ {
+ .callback = init_nvs_save_s3,
+ .ident = "Lenovo G70-35",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "80Q5"),
+ },
+ },
/*
* ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using
* the Low Power S0 Idle firmware interface (see
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 055/491] unshare: fix unshare_fs() handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-04-13 15:54 ` [PATCH 5.10 054/491] ACPI: PM: Save NVS memory on Lenovo G70-35 Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 056/491] ACPI: OSI: Add DMI quirk for Acer Aspire One D255 Greg Kroah-Hartman
` (440 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Al Viro, Waiman Long,
Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 6c4b2243cb6c0755159bd567130d5e12e7b10d9f ]
There's an unpleasant corner case in unshare(2), when we have a
CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that
case copy_mnt_ns() gets passed current->fs instead of a private copy,
which causes interesting warts in proof of correctness]
> I guess if private means fs->users == 1, the condition could still be true.
Unfortunately, it's worse than just a convoluted proof of correctness.
Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS
(and current->fs->users == 1).
We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and
flips current->fs->{pwd,root} to corresponding locations in the new namespace.
Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).
We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's
destroyed and its mount tree is dissolved, but... current->fs->root and
current->fs->pwd are both left pointing to now detached mounts.
They are pinning those, so it's not a UAF, but it leaves the calling
process with unshare(2) failing with -ENOMEM _and_ leaving it with
pwd and root on detached isolated mounts. The last part is clearly a bug.
There is other fun related to that mess (races with pivot_root(), including
the one between pivot_root() and fork(), of all things), but this one
is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new
fs_struct even if it hadn't been shared in the first place". Sure, we could
go for something like "if both CLONE_NEWNS *and* one of the things that might
end up failing after copy_mnt_ns() call in create_new_namespaces() are set,
force allocation of new fs_struct", but let's keep it simple - the cost
of copy_fs_struct() is trivial.
Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets
a freshly allocated fs_struct, yet to be attached to anything. That
seriously simplifies the analysis...
FWIW, that bug had been there since the introduction of unshare(2) ;-/
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20260207082524.GE3183987@ZenIV
Tested-by: Waiman Long <longman@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/fork.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index 072fe9d6c47b6..531de2d1b3bfe 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2989,7 +2989,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
return 0;
/* don't need lock here; in the worst case we'll do useless copy */
- if (fs->users == 1)
+ if (!(unshare_flags & CLONE_NEWNS) && fs->users == 1)
return 0;
*new_fsp = copy_fs_struct(fs);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 056/491] ACPI: OSI: Add DMI quirk for Acer Aspire One D255
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 055/491] unshare: fix unshare_fs() handling Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 057/491] scsi: ses: Fix devices attaching to different hosts Greg Kroah-Hartman
` (439 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sofia Schneider, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sofia Schneider <sofia@schn.dev>
[ Upstream commit 5ede90206273ff156a778254f0f972a55e973c89 ]
The screen backlight turns off during boot (specifically during udev device
initialization) when returning true for _OSI("Windows 2009").
Analyzing the device's DSDT reveals that the firmware takes a different
code path when Windows 7 is reported, which leads to the backlight shutoff.
Add a DMI quirk to invoke dmi_disable_osi_win7 for this model.
Signed-off-by: Sofia Schneider <sofia@schn.dev>
Link: https://patch.msgid.link/20260223025240.518509-1-sofia@schn.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/osi.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/acpi/osi.c b/drivers/acpi/osi.c
index d93409f2b2a07..6913264490225 100644
--- a/drivers/acpi/osi.c
+++ b/drivers/acpi/osi.c
@@ -413,6 +413,19 @@ static const struct dmi_system_id acpi_osi_dmi_table[] __initconst = {
},
},
+ /*
+ * The screen backlight turns off during udev device creation
+ * when returning true for _OSI("Windows 2009")
+ */
+ {
+ .callback = dmi_disable_osi_win7,
+ .ident = "Acer Aspire One D255",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "AOD255"),
+ },
+ },
+
/*
* The wireless hotkey does not work on those machines when
* returning true for _OSI("Windows 2012")
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 057/491] scsi: ses: Fix devices attaching to different hosts
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 056/491] ACPI: OSI: Add DMI quirk for Acer Aspire One D255 Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 058/491] powerpc/uaccess: Fix inline assembly for clang build on PPC32 Greg Kroah-Hartman
` (438 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Jeffery, Tomas Henzl,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Henzl <thenzl@redhat.com>
[ Upstream commit 70ca8caa96ce473647054f5c7b9dab5423902402 ]
On a multipath SAS system some devices don't end up with correct symlinks
from the SCSI device to its enclosure. Some devices even have enclosure
links pointing to enclosures attached to different SCSI hosts.
ses_match_to_enclosure() calls enclosure_for_each_device() which iterates
over all enclosures on the system, not just enclosures attached to the
current SCSI host.
Replace the iteration with a direct call to ses_enclosure_find_by_addr().
Reviewed-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://patch.msgid.link/20260210191850.36784-1-thenzl@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ses.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 6a1428d453f3e..92b3fd10058dd 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -497,9 +497,8 @@ struct efd {
};
static int ses_enclosure_find_by_addr(struct enclosure_device *edev,
- void *data)
+ struct efd *efd)
{
- struct efd *efd = data;
int i;
struct ses_component *scomp;
@@ -652,7 +651,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
if (efd.addr) {
efd.dev = &sdev->sdev_gendev;
- enclosure_for_each_device(ses_enclosure_find_by_addr, &efd);
+ ses_enclosure_find_by_addr(edev, &efd);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 058/491] powerpc/uaccess: Fix inline assembly for clang build on PPC32
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 057/491] scsi: ses: Fix devices attaching to different hosts Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 059/491] remoteproc: sysmon: Correct subsys_name_len type in QMI request Greg Kroah-Hartman
` (437 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Christophe Leroy (CS GROUP), Nathan Chancellor,
Madhavan Srinivasan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
[ Upstream commit 0ee95a1d458630272d0415d0ffa9424fcb606c90 ]
Test robot reports the following error with clang-16.0.6:
In file included from kernel/rseq.c:75:
include/linux/rseq_entry.h:141:3: error: invalid operand for instruction
unsafe_get_user(offset, &ucs->post_commit_offset, efault);
^
include/linux/uaccess.h:608:2: note: expanded from macro 'unsafe_get_user'
arch_unsafe_get_user(x, ptr, local_label); \
^
arch/powerpc/include/asm/uaccess.h:518:2: note: expanded from macro 'arch_unsafe_get_user'
__get_user_size_goto(__gu_val, __gu_addr, sizeof(*(p)), e); \
^
arch/powerpc/include/asm/uaccess.h:284:2: note: expanded from macro '__get_user_size_goto'
__get_user_size_allowed(x, ptr, size, __gus_retval); \
^
arch/powerpc/include/asm/uaccess.h:275:10: note: expanded from macro '__get_user_size_allowed'
case 8: __get_user_asm2(x, (u64 __user *)ptr, retval); break; \
^
arch/powerpc/include/asm/uaccess.h:258:4: note: expanded from macro '__get_user_asm2'
" li %1+1,0\n" \
^
<inline asm>:7:5: note: instantiated into assembly here
li 31+1,0
^
1 error generated.
On PPC32, for 64 bits vars a pair of registers is used. Usually the
lower register in the pair is the high part and the higher register is
the low part. GCC uses r3/r4 ... r11/r12 ... r14/r15 ... r30/r31
In older kernel code inline assembly was using %1 and %1+1 to represent
64 bits values. However here it looks like clang uses r31 as high part,
allthough r32 doesn't exist hence the error.
Allthoug %1+1 should work, most places now use %L1 instead of %1+1, so
let's do the same here.
With that change, the build doesn't fail anymore and a disassembly shows
clang uses r17/r18 and r31/r14 pair when GCC would have used r16/r17 and
r30/r31:
Disassembly of section .fixup:
00000000 <.fixup>:
0: 38 a0 ff f2 li r5,-14
4: 3a 20 00 00 li r17,0
8: 3a 40 00 00 li r18,0
c: 48 00 00 00 b c <.fixup+0xc>
c: R_PPC_REL24 .text+0xbc
10: 38 a0 ff f2 li r5,-14
14: 3b e0 00 00 li r31,0
18: 39 c0 00 00 li r14,0
1c: 48 00 00 00 b 1c <.fixup+0x1c>
1c: R_PPC_REL24 .text+0x144
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202602021825.otcItxGi-lkp@intel.com/
Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()")
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/8ca3a657a650e497a96bfe7acde2f637dadab344.1770103646.git.chleroy@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/uaccess.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 6df110c1254e2..ab9efc429615f 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -279,7 +279,7 @@ extern long __get_user_bad(void);
".section .fixup,\"ax\"\n" \
"4: li %0,%3\n" \
" li %1,0\n" \
- " li %1+1,0\n" \
+ " li %L1,0\n" \
" b 3b\n" \
".previous\n" \
EX_TABLE(1b, 4b) \
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 059/491] remoteproc: sysmon: Correct subsys_name_len type in QMI request
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 058/491] powerpc/uaccess: Fix inline assembly for clang build on PPC32 Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 060/491] powerpc: 83xx: km83xx: Fix keymile vendor prefix Greg Kroah-Hartman
` (436 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Chris Lew,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit da994db94e60f9a9411108ddf4d1836147ad4c9c ]
The QMI message encoder has up until recently read a single byte (as
elem_size == 1), but with the introduction of big endian support it's
become apparent that this field is expected to be a full u32 -
regardless of the size of the length in the encoded message (which is
what elem_size specifies).
The result is that the encoder now reads past the length byte and
rejects the unreasonably large length formed when including the
following 3 bytes from the subsys_name array.
Fix this by changing to the expected type.
Fixes: 1fb82ee806d1 ("remoteproc: qcom: Introduce sysmon")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Chris Lew <christopher.lew@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260220-qmi-encode-invalid-length-v2-1-5674be35ab29@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_sysmon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/remoteproc/qcom_sysmon.c b/drivers/remoteproc/qcom_sysmon.c
index c348ea35e47c3..be3a2fa12394b 100644
--- a/drivers/remoteproc/qcom_sysmon.c
+++ b/drivers/remoteproc/qcom_sysmon.c
@@ -196,7 +196,7 @@ static struct qmi_elem_info ssctl_shutdown_resp_ei[] = {
};
struct ssctl_subsys_event_req {
- u8 subsys_name_len;
+ u32 subsys_name_len;
char subsys_name[SSCTL_SUBSYS_NAME_LENGTH];
u32 event;
u8 evt_driven_valid;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 060/491] powerpc: 83xx: km83xx: Fix keymile vendor prefix
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 059/491] remoteproc: sysmon: Correct subsys_name_len type in QMI request Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 061/491] bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states Greg Kroah-Hartman
` (435 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, J . Neuschäfer, Heiko Schocher,
Madhavan Srinivasan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Neuschäfer <j.ne@posteo.net>
[ Upstream commit 691417ffe7821721e0a28bd25ad8c0dc0d4ae4ad ]
When kmeter.c was refactored into km83xx.c in 2011, the "keymile" vendor
prefix was changed to upper-case "Keymile". The devicetree at
arch/powerpc/boot/dts/kmeter1.dts never underwent the same change,
suggesting that this was simply a mistake.
Fixes: 93e2b95c81042d ("powerpc/83xx: rename and update kmeter1")
Signed-off-by: J. Neuschäfer <j.ne@posteo.net>
Reviewed-by: Heiko Schocher <hs@nabladev.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260303-keymile-v1-1-463a11e71702@posteo.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/83xx/km83xx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/platforms/83xx/km83xx.c b/arch/powerpc/platforms/83xx/km83xx.c
index bcdc2c203ec93..e108d316a744e 100644
--- a/arch/powerpc/platforms/83xx/km83xx.c
+++ b/arch/powerpc/platforms/83xx/km83xx.c
@@ -156,8 +156,8 @@ machine_device_initcall(mpc83xx_km, mpc83xx_declare_of_platform_devices);
/* list of the supported boards */
static char *board[] __initdata = {
- "Keymile,KMETER1",
- "Keymile,kmpbec8321",
+ "keymile,KMETER1",
+ "keymile,kmpbec8321",
NULL
};
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 061/491] bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 060/491] powerpc: 83xx: km83xx: Fix keymile vendor prefix Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 062/491] net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery Greg Kroah-Hartman
` (434 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 3348be7978f450ede0c308a4e8416ac716cf1015 ]
Before the fixed commit, we check slave->new_link during commit
state, which values are only BOND_LINK_{NOCHANGE, UP, DOWN}. After
the commit, we start using slave->link_new_state, which state also could
be BOND_LINK_{FAIL, BACK}.
For example, when we set updelay/downdelay, after a failover,
the slave->link_new_state could be set to BOND_LINK_{FAIL, BACK} in
bond_miimon_inspect(). And later in bond_miimon_commit(), it will treat
it as invalid and print an error, which would cause confusion for users.
[ 106.440254] bond0: (slave veth2): link status down for interface, disabling it in 200 ms
[ 106.440265] bond0: (slave veth2): invalid new link 1 on slave
[ 106.648276] bond0: (slave veth2): link status definitely down, disabling slave
[ 107.480271] bond0: (slave veth2): link status up, enabling it in 200 ms
[ 107.480288] bond0: (slave veth2): invalid new link 3 on slave
[ 107.688302] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
Let's handle BOND_LINK_{FAIL, BACK} as valid link states.
Fixes: 1899bb325149 ("bonding: fix state transition issue in link monitoring")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-2-f72eb2e454d0@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 87e23796680b3..812e1792c232e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2592,8 +2592,14 @@ static void bond_miimon_commit(struct bonding *bond)
continue;
+ case BOND_LINK_FAIL:
+ case BOND_LINK_BACK:
+ slave_dbg(bond->dev, slave->dev, "link_new_state %d on slave\n",
+ slave->link_new_state);
+ continue;
+
default:
- slave_err(bond->dev, slave->dev, "invalid new link %d on slave\n",
+ slave_err(bond->dev, slave->dev, "invalid link_new_state %d on slave\n",
slave->link_new_state);
bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 062/491] net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 061/491] bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 063/491] net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit Greg Kroah-Hartman
` (433 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Dragos Tatulea,
Tariq Toukan, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 1633111d69053512d099658d4a05fc736fab36b0 ]
In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,
desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old
dma_fifo_pc, while the consumer reads from position 0.
This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart.
At the point of reset, all WQEs have been flushed so dma_fifo_cc is
already equal to dma_fifo_pc. There is no need to reset either counter,
similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the following WARNING:
WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00
Call Trace:
<IRQ>
? __warn+0x7d/0x110
? iommu_dma_unmap_page+0x79/0x90
? report_bug+0x16d/0x180
? handle_bug+0x4f/0x90
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? iommu_dma_unmap_page+0x79/0x90
? iommu_dma_unmap_page+0x2e/0x90
dma_unmap_page_attrs+0x10d/0x1b0
mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]
mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]
mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]
__napi_poll+0x24/0x190
net_rx_action+0x32a/0x3b0
? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]
? notifier_call_chain+0x35/0xa0
handle_softirqs+0xc9/0x270
irq_exit_rcu+0x71/0xd0
common_interrupt+0x7f/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40
Fixes: db75373c91b0 ("net/mlx5e: Recover Send Queue (SQ) from error state")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260305142634.1813208-4-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
index 13dd34c571b9f..ce533e7d679a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -28,7 +28,6 @@ static void mlx5e_reset_txqsq_cc_pc(struct mlx5e_txqsq *sq)
"SQ 0x%x: cc (0x%x) != pc (0x%x)\n",
sq->sqn, sq->cc, sq->pc);
sq->cc = 0;
- sq->dma_fifo_cc = 0;
sq->pc = 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 063/491] net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 062/491] net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 064/491] ASoC: soc-core: drop delayed_work_pending() check before flush Greg Kroah-Hartman
` (432 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 ]
teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit
through slave devices, but does not update skb->dev to the slave device
beforehand.
When a gretap tunnel is a TEQL slave, the transmit path reaches
iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0
master) and later calls iptunnel_xmit_stats(dev, pkt_len). This
function does:
get_cpu_ptr(dev->tstats)
Since teql_master_setup() does not set dev->pcpu_stat_type to
NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats
for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes
NULL + __per_cpu_offset[cpu], resulting in a page fault.
BUG: unable to handle page fault for address: ffff8880e6659018
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 68bc067 P4D 68bc067 PUD 0
Oops: Oops: 0002 [#1] SMP KASAN PTI
RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)
Call Trace:
<TASK>
ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
__gre_xmit (net/ipv4/ip_gre.c:478)
gre_tap_xmit (net/ipv4/ip_gre.c:779)
teql_master_xmit (net/sched/sch_teql.c:319)
dev_hard_start_xmit (net/core/dev.c:3887)
sch_direct_xmit (net/sched/sch_generic.c:347)
__dev_queue_xmit (net/core/dev.c:4802)
neigh_direct_output (net/core/neighbour.c:1660)
ip_finish_output2 (net/ipv4/ip_output.c:237)
__ip_finish_output.part.0 (net/ipv4/ip_output.c:315)
ip_mc_output (net/ipv4/ip_output.c:369)
ip_send_skb (net/ipv4/ip_output.c:1508)
udp_send_skb (net/ipv4/udp.c:1195)
udp_sendmsg (net/ipv4/udp.c:1485)
inet_sendmsg (net/ipv4/af_inet.c:859)
__sys_sendto (net/socket.c:2206)
Fix this by setting skb->dev = slave before calling
netdev_start_xmit(), so that tunnel xmit functions see the correct
slave device with properly allocated tstats.
Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260304044216.3517851-3-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_teql.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index e9dfa140799c3..4c65b4ed5ccd3 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -315,6 +315,7 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
if (__netif_tx_trylock(slave_txq)) {
unsigned int length = qdisc_pkt_len(skb);
+ skb->dev = slave;
if (!netif_xmit_frozen_or_stopped(slave_txq) &&
netdev_start_xmit(skb, slave, slave_txq, false) ==
NETDEV_TX_OK) {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 064/491] ASoC: soc-core: drop delayed_work_pending() check before flush
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 063/491] net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 065/491] ASoC: topology: use inclusive language for bclk and fsync Greg Kroah-Hartman
` (431 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matteo Cotifava, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <cotifavamatteo@gmail.com>
[ Upstream commit 3c99c9f0ed60582c1c9852b685d78d5d3a50de63 ]
The delayed_work_pending() check before flush_delayed_work() in
soc_free_pcm_runtime() is unnecessary and racy. flush_delayed_work()
is safe to call unconditionally - it is a no-op when no work is
pending. Remove the check.
The original check was added by commit 9c9b65203492 ("ASoC: core:
only flush inited work during free") but delayed_work_pending()
followed by flush_delayed_work() has a time-of-check/time-of-use
window where work can become pending between the two calls.
Fixes: 9c9b65203492 ("ASoC: core: only flush inited work during free")
Signed-off-by: Matteo Cotifava <cotifavamatteo@gmail.com>
Link: https://patch.msgid.link/20260309215412.545628-2-cotifavamatteo@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 1120d669fe2e3..77f8d458406b0 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -401,8 +401,7 @@ static void soc_free_pcm_runtime(struct snd_soc_pcm_runtime *rtd)
list_del(&rtd->list);
- if (delayed_work_pending(&rtd->delayed_work))
- flush_delayed_work(&rtd->delayed_work);
+ flush_delayed_work(&rtd->delayed_work);
snd_soc_pcm_component_free(rtd);
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 065/491] ASoC: topology: use inclusive language for bclk and fsync
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 064/491] ASoC: soc-core: drop delayed_work_pending() check before flush Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 066/491] ASoC: dont indicate error message for snd_soc_[pcm_]dai_xxx() Greg Kroah-Hartman
` (430 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre-Louis Bossart, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit f026c123001bcc15b78311495cec79a8b73c3cf2 ]
Mirror suggested changes in alsa-lib.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20201112163100.5081-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/sound/soc-dai.h | 32 ++++++++++++++++++++------------
include/uapi/sound/asoc.h | 22 ++++++++++++++--------
sound/soc/soc-topology.c | 24 ++++++++++++------------
sound/soc/sof/topology.c | 6 +++---
4 files changed, 49 insertions(+), 35 deletions(-)
diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h
index fe86172e86020..580d1e6b935e6 100644
--- a/include/sound/soc-dai.h
+++ b/include/sound/soc-dai.h
@@ -72,21 +72,29 @@ struct snd_compr_stream;
#define SND_SOC_DAIFMT_IB_IF (4 << 8) /* invert BCLK + FRM */
/*
- * DAI hardware clock masters.
+ * DAI hardware clock providers/consumers
*
* This is wrt the codec, the inverse is true for the interface
- * i.e. if the codec is clk and FRM master then the interface is
- * clk and frame secondary.
+ * i.e. if the codec is clk and FRM provider then the interface is
+ * clk and frame consumer.
*/
-#define SND_SOC_DAIFMT_CBM_CFM (1 << 12) /* codec clk & FRM master */
-#define SND_SOC_DAIFMT_CBS_CFM (2 << 12) /* codec clk secondary & FRM master */
-#define SND_SOC_DAIFMT_CBM_CFS (3 << 12) /* codec clk master & frame secondary */
-#define SND_SOC_DAIFMT_CBS_CFS (4 << 12) /* codec clk & FRM secondary */
-
-#define SND_SOC_DAIFMT_FORMAT_MASK 0x000f
-#define SND_SOC_DAIFMT_CLOCK_MASK 0x00f0
-#define SND_SOC_DAIFMT_INV_MASK 0x0f00
-#define SND_SOC_DAIFMT_MASTER_MASK 0xf000
+#define SND_SOC_DAIFMT_CBP_CFP (1 << 12) /* codec clk provider & frame provider */
+#define SND_SOC_DAIFMT_CBC_CFP (2 << 12) /* codec clk consumer & frame provider */
+#define SND_SOC_DAIFMT_CBP_CFC (3 << 12) /* codec clk provider & frame consumer */
+#define SND_SOC_DAIFMT_CBC_CFC (4 << 12) /* codec clk consumer & frame follower */
+
+/* previous definitions kept for backwards-compatibility, do not use in new contributions */
+#define SND_SOC_DAIFMT_CBM_CFM SND_SOC_DAIFMT_CBP_CFP
+#define SND_SOC_DAIFMT_CBS_CFM SND_SOC_DAIFMT_CBC_CFP
+#define SND_SOC_DAIFMT_CBM_CFS SND_SOC_DAIFMT_CBP_CFC
+#define SND_SOC_DAIFMT_CBS_CFS SND_SOC_DAIFMT_CBC_CFC
+
+#define SND_SOC_DAIFMT_FORMAT_MASK 0x000f
+#define SND_SOC_DAIFMT_CLOCK_MASK 0x00f0
+#define SND_SOC_DAIFMT_INV_MASK 0x0f00
+#define SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK 0xf000
+
+#define SND_SOC_DAIFMT_MASTER_MASK SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK
/*
* Master Clock Directions
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index a74ca232f1fc1..da61398b1f8f3 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -170,16 +170,22 @@
#define SND_SOC_TPLG_LNK_FLGBIT_VOICE_WAKEUP (1 << 3)
/* DAI topology BCLK parameter
- * For the backwards capability, by default codec is bclk master
+ * For the backwards capability, by default codec is bclk provider
*/
-#define SND_SOC_TPLG_BCLK_CM 0 /* codec is bclk master */
-#define SND_SOC_TPLG_BCLK_CS 1 /* codec is bclk slave */
+#define SND_SOC_TPLG_BCLK_CP 0 /* codec is bclk provider */
+#define SND_SOC_TPLG_BCLK_CC 1 /* codec is bclk consumer */
+/* keep previous definitions for compatibility */
+#define SND_SOC_TPLG_BCLK_CM SND_SOC_TPLG_BCLK_CP
+#define SND_SOC_TPLG_BCLK_CS SND_SOC_TPLG_BCLK_CC
/* DAI topology FSYNC parameter
- * For the backwards capability, by default codec is fsync master
+ * For the backwards capability, by default codec is fsync provider
*/
-#define SND_SOC_TPLG_FSYNC_CM 0 /* codec is fsync master */
-#define SND_SOC_TPLG_FSYNC_CS 1 /* codec is fsync slave */
+#define SND_SOC_TPLG_FSYNC_CP 0 /* codec is fsync provider */
+#define SND_SOC_TPLG_FSYNC_CC 1 /* codec is fsync consumer */
+/* keep previous definitions for compatibility */
+#define SND_SOC_TPLG_FSYNC_CM SND_SOC_TPLG_FSYNC_CP
+#define SND_SOC_TPLG_FSYNC_CS SND_SOC_TPLG_FSYNC_CC
/*
* Block Header.
@@ -336,8 +342,8 @@ struct snd_soc_tplg_hw_config {
__u8 clock_gated; /* SND_SOC_TPLG_DAI_CLK_GATE_ value */
__u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */
__u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */
- __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */
- __u8 fsync_master; /* SND_SOC_TPLG_FSYNC_ value */
+ __u8 bclk_provider; /* SND_SOC_TPLG_BCLK_ value */
+ __u8 fsync_provider; /* SND_SOC_TPLG_FSYNC_ value */
__u8 mclk_direction; /* SND_SOC_TPLG_MCLK_ value */
__le16 reserved; /* for 32bit alignment */
__le32 mclk_rate; /* MCLK or SYSCLK freqency in Hz */
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index aa57f796e9dd3..b9ef95c99c6ee 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -2173,7 +2173,7 @@ static void set_link_hw_format(struct snd_soc_dai_link *link,
struct snd_soc_tplg_link_config *cfg)
{
struct snd_soc_tplg_hw_config *hw_config;
- unsigned char bclk_master, fsync_master;
+ unsigned char bclk_provider, fsync_provider;
unsigned char invert_bclk, invert_fsync;
int i;
@@ -2213,18 +2213,18 @@ static void set_link_hw_format(struct snd_soc_dai_link *link,
link->dai_fmt |= SND_SOC_DAIFMT_IB_IF;
/* clock masters */
- bclk_master = (hw_config->bclk_master ==
- SND_SOC_TPLG_BCLK_CM);
- fsync_master = (hw_config->fsync_master ==
- SND_SOC_TPLG_FSYNC_CM);
- if (bclk_master && fsync_master)
- link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM;
- else if (!bclk_master && fsync_master)
- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM;
- else if (bclk_master && !fsync_master)
- link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFS;
+ bclk_provider = (hw_config->bclk_provider ==
+ SND_SOC_TPLG_BCLK_CP);
+ fsync_provider = (hw_config->fsync_provider ==
+ SND_SOC_TPLG_FSYNC_CP);
+ if (bclk_provider && fsync_provider)
+ link->dai_fmt |= SND_SOC_DAIFMT_CBP_CFP;
+ else if (!bclk_provider && fsync_provider)
+ link->dai_fmt |= SND_SOC_DAIFMT_CBC_CFP;
+ else if (bclk_provider && !fsync_provider)
+ link->dai_fmt |= SND_SOC_DAIFMT_CBP_CFC;
else
- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
+ link->dai_fmt |= SND_SOC_DAIFMT_CBC_CFC;
}
}
diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
index b6327c30c2b5a..e3aa9fa0f112f 100644
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -2786,15 +2786,15 @@ static void sof_dai_set_format(struct snd_soc_tplg_hw_config *hw_config,
struct sof_ipc_dai_config *config)
{
/* clock directions wrt codec */
- if (hw_config->bclk_master == SND_SOC_TPLG_BCLK_CM) {
+ if (hw_config->bclk_provider == SND_SOC_TPLG_BCLK_CM) {
/* codec is bclk master */
- if (hw_config->fsync_master == SND_SOC_TPLG_FSYNC_CM)
+ if (hw_config->fsync_provider == SND_SOC_TPLG_FSYNC_CM)
config->format |= SOF_DAI_FMT_CBM_CFM;
else
config->format |= SOF_DAI_FMT_CBM_CFS;
} else {
/* codec is bclk slave */
- if (hw_config->fsync_master == SND_SOC_TPLG_FSYNC_CM)
+ if (hw_config->fsync_provider == SND_SOC_TPLG_FSYNC_CM)
config->format |= SOF_DAI_FMT_CBS_CFM;
else
config->format |= SOF_DAI_FMT_CBS_CFS;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 066/491] ASoC: dont indicate error message for snd_soc_[pcm_]dai_xxx()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 065/491] ASoC: topology: use inclusive language for bclk and fsync Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 067/491] ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside Greg Kroah-Hartman
` (429 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 62462e018220895267450155b188f5804f54c202 ]
All snd_soc_dai_xxx() and snd_soc_pcm_dai_xxx() itself
indicate error message if failed.
Its caller doesn't need to indicate duplicated error message.
This patch removes it.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87a6r5utaa.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 16 +++-------------
sound/soc/soc-dapm.c | 24 ++++++------------------
sound/soc/soc-pcm.c | 10 ++--------
3 files changed, 11 insertions(+), 39 deletions(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 77f8d458406b0..8620e415f6fce 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1099,12 +1099,8 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
/* create compress_device if possible */
ret = snd_soc_dai_compress_new(cpu_dai, rtd, num);
- if (ret != -ENOTSUPP) {
- if (ret < 0)
- dev_err(card->dev, "ASoC: can't create compress %s\n",
- dai_link->stream_name);
+ if (ret != -ENOTSUPP)
return ret;
- }
/* create the pcm */
ret = soc_new_pcm(rtd, num);
@@ -1432,11 +1428,8 @@ int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
for_each_rtd_codec_dais(rtd, i, codec_dai) {
ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
- if (ret != 0 && ret != -ENOTSUPP) {
- dev_warn(codec_dai->dev,
- "ASoC: Failed to set DAI format: %d\n", ret);
+ if (ret != 0 && ret != -ENOTSUPP)
return ret;
- }
}
/*
@@ -1465,11 +1458,8 @@ int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
fmt = inv_dai_fmt;
ret = snd_soc_dai_set_fmt(cpu_dai, fmt);
- if (ret != 0 && ret != -ENOTSUPP) {
- dev_warn(cpu_dai->dev,
- "ASoC: Failed to set DAI format: %d\n", ret);
+ if (ret != 0 && ret != -ENOTSUPP)
return ret;
- }
}
return 0;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 175c8c264b62b..a3bebea5879b1 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3856,11 +3856,9 @@ snd_soc_dai_link_event_pre_pmu(struct snd_soc_dapm_widget *w,
source = path->source->priv;
ret = snd_soc_dai_startup(source, substream);
- if (ret < 0) {
- dev_err(source->dev,
- "ASoC: startup() failed: %d\n", ret);
+ if (ret < 0)
goto out;
- }
+
snd_soc_dai_activate(source, substream->stream);
}
@@ -3869,11 +3867,9 @@ snd_soc_dai_link_event_pre_pmu(struct snd_soc_dapm_widget *w,
sink = path->sink->priv;
ret = snd_soc_dai_startup(sink, substream);
- if (ret < 0) {
- dev_err(sink->dev,
- "ASoC: startup() failed: %d\n", ret);
+ if (ret < 0)
goto out;
- }
+
snd_soc_dai_activate(sink, substream->stream);
}
@@ -3968,11 +3964,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
snd_soc_dapm_widget_for_each_sink_path(w, path) {
sink = path->sink->priv;
- ret = snd_soc_dai_digital_mute(sink, 0,
- SNDRV_PCM_STREAM_PLAYBACK);
- if (ret != 0 && ret != -ENOTSUPP)
- dev_warn(sink->dev,
- "ASoC: Failed to unmute: %d\n", ret);
+ snd_soc_dai_digital_mute(sink, 0, SNDRV_PCM_STREAM_PLAYBACK);
ret = 0;
}
break;
@@ -3981,11 +3973,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
snd_soc_dapm_widget_for_each_sink_path(w, path) {
sink = path->sink->priv;
- ret = snd_soc_dai_digital_mute(sink, 1,
- SNDRV_PCM_STREAM_PLAYBACK);
- if (ret != 0 && ret != -ENOTSUPP)
- dev_warn(sink->dev,
- "ASoC: Failed to mute: %d\n", ret);
+ snd_soc_dai_digital_mute(sink, 1, SNDRV_PCM_STREAM_PLAYBACK);
ret = 0;
}
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index e52c030bd17a2..c82d653e6c378 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -821,10 +821,8 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream)
goto out;
ret = snd_soc_pcm_dai_prepare(substream);
- if (ret < 0) {
- dev_err(rtd->dev, "ASoC: DAI prepare error: %d\n", ret);
+ if (ret < 0)
goto out;
- }
/* cancel any delayed stream shutdown that is pending */
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
@@ -2414,8 +2412,6 @@ static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream)
fe->dai_link->name);
err = snd_soc_pcm_dai_bespoke_trigger(substream, SNDRV_PCM_TRIGGER_STOP);
- if (err < 0)
- dev_err(fe->dev,"ASoC: trigger FE failed %d\n", err);
} else {
dev_dbg(fe->dev, "ASoC: trigger FE %s cmd stop\n",
fe->dai_link->name);
@@ -2492,10 +2488,8 @@ static int dpcm_run_update_startup(struct snd_soc_pcm_runtime *fe, int stream)
fe->dai_link->name);
ret = snd_soc_pcm_dai_bespoke_trigger(substream, SNDRV_PCM_TRIGGER_START);
- if (ret < 0) {
- dev_err(fe->dev,"ASoC: bespoke trigger FE failed %d\n", ret);
+ if (ret < 0)
goto hw_free;
- }
} else {
dev_dbg(fe->dev, "ASoC: trigger FE %s cmd start\n",
fe->dai_link->name);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 067/491] ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 066/491] ASoC: dont indicate error message for snd_soc_[pcm_]dai_xxx() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 068/491] ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
` (428 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 4d1a98b5f1abaad0ba7177fdb389a9f78584bc3a ]
This patch moves snd_soc_runtime_set_dai_fmt() to upside.
This is prepare to support snd_soc_runtime_get_dai_fmt().
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87im34nc9r.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 124 +++++++++++++++++++++----------------------
1 file changed, 62 insertions(+), 62 deletions(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 8620e415f6fce..71219ceea3934 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1055,6 +1055,68 @@ int snd_soc_add_pcm_runtime(struct snd_soc_card *card,
}
EXPORT_SYMBOL_GPL(snd_soc_add_pcm_runtime);
+/**
+ * snd_soc_runtime_set_dai_fmt() - Change DAI link format for a ASoC runtime
+ * @rtd: The runtime for which the DAI link format should be changed
+ * @dai_fmt: The new DAI link format
+ *
+ * This function updates the DAI link format for all DAIs connected to the DAI
+ * link for the specified runtime.
+ *
+ * Note: For setups with a static format set the dai_fmt field in the
+ * corresponding snd_dai_link struct instead of using this function.
+ *
+ * Returns 0 on success, otherwise a negative error code.
+ */
+int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
+ unsigned int dai_fmt)
+{
+ struct snd_soc_dai *cpu_dai;
+ struct snd_soc_dai *codec_dai;
+ unsigned int inv_dai_fmt;
+ unsigned int i;
+ int ret;
+
+ for_each_rtd_codec_dais(rtd, i, codec_dai) {
+ ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
+ if (ret != 0 && ret != -ENOTSUPP)
+ return ret;
+ }
+
+ /*
+ * Flip the polarity for the "CPU" end of a CODEC<->CODEC link
+ * the component which has non_legacy_dai_naming is Codec
+ */
+ inv_dai_fmt = dai_fmt & ~SND_SOC_DAIFMT_MASTER_MASK;
+ switch (dai_fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+ case SND_SOC_DAIFMT_CBM_CFM:
+ inv_dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
+ break;
+ case SND_SOC_DAIFMT_CBM_CFS:
+ inv_dai_fmt |= SND_SOC_DAIFMT_CBS_CFM;
+ break;
+ case SND_SOC_DAIFMT_CBS_CFM:
+ inv_dai_fmt |= SND_SOC_DAIFMT_CBM_CFS;
+ break;
+ case SND_SOC_DAIFMT_CBS_CFS:
+ inv_dai_fmt |= SND_SOC_DAIFMT_CBM_CFM;
+ break;
+ }
+ for_each_rtd_cpu_dais(rtd, i, cpu_dai) {
+ unsigned int fmt = dai_fmt;
+
+ if (cpu_dai->component->driver->non_legacy_dai_naming)
+ fmt = inv_dai_fmt;
+
+ ret = snd_soc_dai_set_fmt(cpu_dai, fmt);
+ if (ret != 0 && ret != -ENOTSUPP)
+ return ret;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(snd_soc_runtime_set_dai_fmt);
+
static int soc_init_pcm_runtime(struct snd_soc_card *card,
struct snd_soc_pcm_runtime *rtd)
{
@@ -1404,68 +1466,6 @@ static void soc_remove_aux_devices(struct snd_soc_card *card)
}
}
-/**
- * snd_soc_runtime_set_dai_fmt() - Change DAI link format for a ASoC runtime
- * @rtd: The runtime for which the DAI link format should be changed
- * @dai_fmt: The new DAI link format
- *
- * This function updates the DAI link format for all DAIs connected to the DAI
- * link for the specified runtime.
- *
- * Note: For setups with a static format set the dai_fmt field in the
- * corresponding snd_dai_link struct instead of using this function.
- *
- * Returns 0 on success, otherwise a negative error code.
- */
-int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
- unsigned int dai_fmt)
-{
- struct snd_soc_dai *cpu_dai;
- struct snd_soc_dai *codec_dai;
- unsigned int inv_dai_fmt;
- unsigned int i;
- int ret;
-
- for_each_rtd_codec_dais(rtd, i, codec_dai) {
- ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
- if (ret != 0 && ret != -ENOTSUPP)
- return ret;
- }
-
- /*
- * Flip the polarity for the "CPU" end of a CODEC<->CODEC link
- * the component which has non_legacy_dai_naming is Codec
- */
- inv_dai_fmt = dai_fmt & ~SND_SOC_DAIFMT_MASTER_MASK;
- switch (dai_fmt & SND_SOC_DAIFMT_MASTER_MASK) {
- case SND_SOC_DAIFMT_CBM_CFM:
- inv_dai_fmt |= SND_SOC_DAIFMT_CBS_CFS;
- break;
- case SND_SOC_DAIFMT_CBM_CFS:
- inv_dai_fmt |= SND_SOC_DAIFMT_CBS_CFM;
- break;
- case SND_SOC_DAIFMT_CBS_CFM:
- inv_dai_fmt |= SND_SOC_DAIFMT_CBM_CFS;
- break;
- case SND_SOC_DAIFMT_CBS_CFS:
- inv_dai_fmt |= SND_SOC_DAIFMT_CBM_CFM;
- break;
- }
- for_each_rtd_cpu_dais(rtd, i, cpu_dai) {
- unsigned int fmt = dai_fmt;
-
- if (cpu_dai->component->driver->non_legacy_dai_naming)
- fmt = inv_dai_fmt;
-
- ret = snd_soc_dai_set_fmt(cpu_dai, fmt);
- if (ret != 0 && ret != -ENOTSUPP)
- return ret;
- }
-
- return 0;
-}
-EXPORT_SYMBOL_GPL(snd_soc_runtime_set_dai_fmt);
-
#ifdef CONFIG_DMI
/*
* If a DMI filed contain strings in this blacklist (e.g.
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 068/491] ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 067/491] ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 069/491] ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() Greg Kroah-Hartman
` (427 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit ba9e82a1c8919340bee0dd7f7cafb8749810aabe ]
ASoC is using dai_link which specify DAI format (= dai_link->dai_fmt),
and it is selected by "Sound Card" driver in corrent implementation.
In other words, Sound Card *needs* to setup it.
But, it should be possible to automatically selected from CPU and
Codec driver settings.
This patch adds new .auto_selectable_formats support
at snd_soc_dai_ops.
By this patch, dai_fmt can be automatically selected from each
driver if both CPU / Codec driver had it.
Automatically selectable *field* is depends on each drivers.
For example, some driver want to select format "automatically",
but want to select other fields "manually", because of complex limitation.
Or other example, in case of both CPU and Codec are possible to be
clock provider, but the quality was different.
In these case, user need/want to *manually* select each fields
from Sound Card driver.
This .auto_selectable_formats can set priority.
For example, no limitaion format can be HI priority,
supported but has picky limitation format can be next priority, etc.
It uses Sound Card specified fields preferentially, and try to select
non-specific fields from CPU and Codec driver automatically
if all drivers have .auto_selectable_formats.
In other words, we can select all dai_fmt via Sound Card driver
same as before.
Link: https://lore.kernel.org/r/871rb3hypy.wl-kuninori.morimoto.gx@renesas.com
Link: https://lore.kernel.org/r/871racbx0w.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87h7ionc8s.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/sound/soc-dai.h | 55 ++++++++++++++
sound/soc/soc-core.c | 164 ++++++++++++++++++++++++++++++++++++++++
sound/soc/soc-dai.c | 63 +++++++++++++++
sound/soc/soc-utils.c | 29 +++++++
4 files changed, 311 insertions(+)
diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h
index 580d1e6b935e6..2b8ae0c89e3fe 100644
--- a/include/sound/soc-dai.h
+++ b/include/sound/soc-dai.h
@@ -36,6 +36,22 @@ struct snd_compr_stream;
#define SND_SOC_DAIFMT_MSB SND_SOC_DAIFMT_LEFT_J
#define SND_SOC_DAIFMT_LSB SND_SOC_DAIFMT_RIGHT_J
+/* Describes the possible PCM format */
+/*
+ * use SND_SOC_DAI_FORMAT_xx as eash shift.
+ * see
+ * snd_soc_runtime_get_dai_fmt()
+ */
+#define SND_SOC_POSSIBLE_DAIFMT_FORMAT_SHIFT 0
+#define SND_SOC_POSSIBLE_DAIFMT_FORMAT_MASK (0xFFFF << SND_SOC_POSSIBLE_DAIFMT_FORMAT_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_I2S (1 << SND_SOC_DAI_FORMAT_I2S)
+#define SND_SOC_POSSIBLE_DAIFMT_RIGHT_J (1 << SND_SOC_DAI_FORMAT_RIGHT_J)
+#define SND_SOC_POSSIBLE_DAIFMT_LEFT_J (1 << SND_SOC_DAI_FORMAT_LEFT_J)
+#define SND_SOC_POSSIBLE_DAIFMT_DSP_A (1 << SND_SOC_DAI_FORMAT_DSP_A)
+#define SND_SOC_POSSIBLE_DAIFMT_DSP_B (1 << SND_SOC_DAI_FORMAT_DSP_B)
+#define SND_SOC_POSSIBLE_DAIFMT_AC97 (1 << SND_SOC_DAI_FORMAT_AC97)
+#define SND_SOC_POSSIBLE_DAIFMT_PDM (1 << SND_SOC_DAI_FORMAT_PDM)
+
/*
* DAI Clock gating.
*
@@ -45,6 +61,17 @@ struct snd_compr_stream;
#define SND_SOC_DAIFMT_CONT (1 << 4) /* continuous clock */
#define SND_SOC_DAIFMT_GATED (0 << 4) /* clock is gated */
+/* Describes the possible PCM format */
+/*
+ * define GATED -> CONT. GATED will be selected if both are selected.
+ * see
+ * snd_soc_runtime_get_dai_fmt()
+ */
+#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT 16
+#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_MASK (0xFFFF << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_GATED (0x1ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_CONT (0x2ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT)
+
/*
* DAI hardware signal polarity.
*
@@ -71,6 +98,14 @@ struct snd_compr_stream;
#define SND_SOC_DAIFMT_IB_NF (3 << 8) /* invert BCLK + nor FRM */
#define SND_SOC_DAIFMT_IB_IF (4 << 8) /* invert BCLK + FRM */
+/* Describes the possible PCM format */
+#define SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT 32
+#define SND_SOC_POSSIBLE_DAIFMT_INV_MASK (0xFFFFULL << SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_NB_NF (0x1ULL << SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_NB_IF (0x2ULL << SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_IB_NF (0x4ULL << SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_IB_IF (0x8ULL << SND_SOC_POSSIBLE_DAIFMT_INV_SHIFT)
+
/*
* DAI hardware clock providers/consumers
*
@@ -89,6 +124,14 @@ struct snd_compr_stream;
#define SND_SOC_DAIFMT_CBM_CFS SND_SOC_DAIFMT_CBP_CFC
#define SND_SOC_DAIFMT_CBS_CFS SND_SOC_DAIFMT_CBC_CFC
+/* Describes the possible PCM format */
+#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT 48
+#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_MASK (0xFFFFULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_CBP_CFP (0x1ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_CBC_CFP (0x2ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_CBP_CFC (0x4ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT)
+#define SND_SOC_POSSIBLE_DAIFMT_CBC_CFC (0x8ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT)
+
#define SND_SOC_DAIFMT_FORMAT_MASK 0x000f
#define SND_SOC_DAIFMT_CLOCK_MASK 0x00f0
#define SND_SOC_DAIFMT_INV_MASK 0x0f00
@@ -131,6 +174,8 @@ int snd_soc_dai_set_pll(struct snd_soc_dai *dai,
int snd_soc_dai_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio);
/* Digital Audio interface formatting */
+int snd_soc_dai_get_fmt_max_priority(struct snd_soc_pcm_runtime *rtd);
+u64 snd_soc_dai_get_fmt(struct snd_soc_dai *dai, int priority);
int snd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt);
int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai,
@@ -289,6 +334,16 @@ struct snd_soc_dai_ops {
snd_pcm_sframes_t (*delay)(struct snd_pcm_substream *,
struct snd_soc_dai *);
+ /*
+ * Format list for auto selection.
+ * Format will be increased if priority format was
+ * not selected.
+ * see
+ * snd_soc_dai_get_fmt()
+ */
+ u64 *auto_selectable_formats;
+ int num_auto_selectable_formats;
+
/* bit field */
unsigned int no_capture_mute:1;
};
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 71219ceea3934..2fca5d03fd4f7 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1055,6 +1055,169 @@ int snd_soc_add_pcm_runtime(struct snd_soc_card *card,
}
EXPORT_SYMBOL_GPL(snd_soc_add_pcm_runtime);
+static void snd_soc_runtime_get_dai_fmt(struct snd_soc_pcm_runtime *rtd)
+{
+ struct snd_soc_dai_link *dai_link = rtd->dai_link;
+ struct snd_soc_dai *dai, *not_used;
+ struct device *dev = rtd->dev;
+ u64 pos, possible_fmt;
+ unsigned int mask = 0, dai_fmt = 0;
+ int i, j, priority, pri, until;
+
+ /*
+ * Get selectable format from each DAIs.
+ *
+ ****************************
+ * NOTE
+ * Using .auto_selectable_formats is not mandatory,
+ * we can select format manually from Sound Card.
+ * When use it, driver should list well tested format only.
+ ****************************
+ *
+ * ex)
+ * auto_selectable_formats (= SND_SOC_POSSIBLE_xxx)
+ * (A) (B) (C)
+ * DAI0_: { 0x000F, 0x00F0, 0x0F00 };
+ * DAI1 : { 0xF000, 0x0F00 };
+ * (X) (Y)
+ *
+ * "until" will be 3 in this case (MAX array size from DAI0 and DAI1)
+ * Here is dev_dbg() message and comments
+ *
+ * priority = 1
+ * DAI0: (pri, fmt) = (1, 000000000000000F) // 1st check (A) DAI1 is not selected
+ * DAI1: (pri, fmt) = (0, 0000000000000000) // Necessary Waste
+ * DAI0: (pri, fmt) = (1, 000000000000000F) // 2nd check (A)
+ * DAI1: (pri, fmt) = (1, 000000000000F000) // (X)
+ * priority = 2
+ * DAI0: (pri, fmt) = (2, 00000000000000FF) // 3rd check (A) + (B)
+ * DAI1: (pri, fmt) = (1, 000000000000F000) // (X)
+ * DAI0: (pri, fmt) = (2, 00000000000000FF) // 4th check (A) + (B)
+ * DAI1: (pri, fmt) = (2, 000000000000FF00) // (X) + (Y)
+ * priority = 3
+ * DAI0: (pri, fmt) = (3, 0000000000000FFF) // 5th check (A) + (B) + (C)
+ * DAI1: (pri, fmt) = (2, 000000000000FF00) // (X) + (Y)
+ * found auto selected format: 0000000000000F00
+ */
+ until = snd_soc_dai_get_fmt_max_priority(rtd);
+ for (priority = 1; priority <= until; priority++) {
+
+ dev_dbg(dev, "priority = %d\n", priority);
+ for_each_rtd_dais(rtd, j, not_used) {
+
+ possible_fmt = ULLONG_MAX;
+ for_each_rtd_dais(rtd, i, dai) {
+ u64 fmt = 0;
+
+ pri = (j >= i) ? priority : priority - 1;
+ fmt = snd_soc_dai_get_fmt(dai, pri);
+ dev_dbg(dev, "%s: (pri, fmt) = (%d, %016llX)\n", dai->name, pri, fmt);
+ possible_fmt &= fmt;
+ }
+ if (possible_fmt)
+ goto found;
+ }
+ }
+ /* Not Found */
+ return;
+found:
+ dev_dbg(dev, "found auto selected format: %016llX\n", possible_fmt);
+
+ /*
+ * convert POSSIBLE_DAIFMT to DAIFMT
+ *
+ * Some basic/default settings on each is defined as 0.
+ * see
+ * SND_SOC_DAIFMT_NB_NF
+ * SND_SOC_DAIFMT_GATED
+ *
+ * SND_SOC_DAIFMT_xxx_MASK can't notice it if Sound Card specify
+ * these value, and will be overwrite to auto selected value.
+ *
+ * To avoid such issue, loop from 63 to 0 here.
+ * Small number of SND_SOC_POSSIBLE_xxx will be Hi priority.
+ * Basic/Default settings of each part and aboves are defined
+ * as Hi priority (= small number) of SND_SOC_POSSIBLE_xxx.
+ */
+ for (i = 63; i >= 0; i--) {
+ pos = 1ULL << i;
+ switch (possible_fmt & pos) {
+ /*
+ * for format
+ */
+ case SND_SOC_POSSIBLE_DAIFMT_I2S:
+ case SND_SOC_POSSIBLE_DAIFMT_RIGHT_J:
+ case SND_SOC_POSSIBLE_DAIFMT_LEFT_J:
+ case SND_SOC_POSSIBLE_DAIFMT_DSP_A:
+ case SND_SOC_POSSIBLE_DAIFMT_DSP_B:
+ case SND_SOC_POSSIBLE_DAIFMT_AC97:
+ case SND_SOC_POSSIBLE_DAIFMT_PDM:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) | i;
+ break;
+ /*
+ * for clock
+ */
+ case SND_SOC_POSSIBLE_DAIFMT_CONT:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_MASK) | SND_SOC_DAIFMT_CONT;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_GATED:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_MASK) | SND_SOC_DAIFMT_GATED;
+ break;
+ /*
+ * for clock invert
+ */
+ case SND_SOC_POSSIBLE_DAIFMT_NB_NF:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_INV_MASK) | SND_SOC_DAIFMT_NB_NF;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_NB_IF:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_INV_MASK) | SND_SOC_DAIFMT_NB_IF;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_IB_NF:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_INV_MASK) | SND_SOC_DAIFMT_IB_NF;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_IB_IF:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_INV_MASK) | SND_SOC_DAIFMT_IB_IF;
+ break;
+ /*
+ * for clock provider / consumer
+ */
+ case SND_SOC_POSSIBLE_DAIFMT_CBP_CFP:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) | SND_SOC_DAIFMT_CBP_CFP;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_CBC_CFP:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) | SND_SOC_DAIFMT_CBC_CFP;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_CBP_CFC:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) | SND_SOC_DAIFMT_CBP_CFC;
+ break;
+ case SND_SOC_POSSIBLE_DAIFMT_CBC_CFC:
+ dai_fmt = (dai_fmt & ~SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) | SND_SOC_DAIFMT_CBC_CFC;
+ break;
+ }
+ }
+
+ /*
+ * Some driver might have very complex limitation.
+ * In such case, user want to auto-select non-limitation part,
+ * and want to manually specify complex part.
+ *
+ * Or for example, if both CPU and Codec can be clock provider,
+ * but because of its quality, user want to specify it manually.
+ *
+ * Use manually specified settings if sound card did.
+ */
+ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_FORMAT_MASK))
+ mask |= SND_SOC_DAIFMT_FORMAT_MASK;
+ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_CLOCK_MASK))
+ mask |= SND_SOC_DAIFMT_CLOCK_MASK;
+ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_INV_MASK))
+ mask |= SND_SOC_DAIFMT_INV_MASK;
+ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_MASTER_MASK))
+ mask |= SND_SOC_DAIFMT_MASTER_MASK;
+
+ dai_link->dai_fmt |= (dai_fmt & mask);
+}
+
/**
* snd_soc_runtime_set_dai_fmt() - Change DAI link format for a ASoC runtime
* @rtd: The runtime for which the DAI link format should be changed
@@ -1133,6 +1296,7 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
if (ret < 0)
return ret;
+ snd_soc_runtime_get_dai_fmt(rtd);
if (dai_link->dai_fmt) {
ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
if (ret)
diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
index 583b18d0f4465..a76d876f6729b 100644
--- a/sound/soc/soc-dai.c
+++ b/sound/soc/soc-dai.c
@@ -134,6 +134,69 @@ int snd_soc_dai_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio)
}
EXPORT_SYMBOL_GPL(snd_soc_dai_set_bclk_ratio);
+int snd_soc_dai_get_fmt_max_priority(struct snd_soc_pcm_runtime *rtd)
+{
+ struct snd_soc_dai *dai;
+ int i, max = 0;
+
+ /*
+ * return max num if *ALL* DAIs have .auto_selectable_formats
+ */
+ for_each_rtd_dais(rtd, i, dai) {
+ if (dai->driver->ops &&
+ dai->driver->ops->num_auto_selectable_formats)
+ max = max(max, dai->driver->ops->num_auto_selectable_formats);
+ else
+ return 0;
+ }
+
+ return max;
+}
+
+/**
+ * snd_soc_dai_get_fmt - get supported audio format.
+ * @dai: DAI
+ * @priority: priority level of supported audio format.
+ *
+ * This should return only formats implemented with high
+ * quality by the DAI so that the core can configure a
+ * format which will work well with other devices.
+ * For example devices which don't support both edges of the
+ * LRCLK signal in I2S style formats should only list DSP
+ * modes. This will mean that sometimes fewer formats
+ * are reported here than are supported by set_fmt().
+ */
+u64 snd_soc_dai_get_fmt(struct snd_soc_dai *dai, int priority)
+{
+ const struct snd_soc_dai_ops *ops = dai->driver->ops;
+ u64 fmt = 0;
+ int i, max = 0, until = priority;
+
+ /*
+ * Collect auto_selectable_formats until priority
+ *
+ * ex)
+ * auto_selectable_formats[] = { A, B, C };
+ * (A, B, C = SND_SOC_POSSIBLE_DAIFMT_xxx)
+ *
+ * priority = 1 : A
+ * priority = 2 : A | B
+ * priority = 3 : A | B | C
+ * priority = 4 : A | B | C
+ * ...
+ */
+ if (ops)
+ max = ops->num_auto_selectable_formats;
+
+ if (max < until)
+ until = max;
+
+ for (i = 0; i < until; i++)
+ fmt |= ops->auto_selectable_formats[i];
+
+ return fmt;
+}
+
/**
* snd_soc_dai_set_fmt - configure DAI hardware audio format.
* @dai: DAI
diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
index 6b398ffabb02e..104d5ec135503 100644
--- a/sound/soc/soc-utils.c
+++ b/sound/soc/soc-utils.c
@@ -97,6 +97,34 @@ static const struct snd_soc_component_driver dummy_codec = {
SNDRV_PCM_FMTBIT_S32_LE | \
SNDRV_PCM_FMTBIT_U32_LE | \
SNDRV_PCM_FMTBIT_IEC958_SUBFRAME_LE)
+
+/*
+ * Select these from Sound Card Manually
+ * SND_SOC_POSSIBLE_DAIFMT_CBP_CFP
+ * SND_SOC_POSSIBLE_DAIFMT_CBP_CFC
+ * SND_SOC_POSSIBLE_DAIFMT_CBC_CFP
+ * SND_SOC_POSSIBLE_DAIFMT_CBC_CFC
+ */
+static u64 dummy_dai_formats =
+ SND_SOC_POSSIBLE_DAIFMT_I2S |
+ SND_SOC_POSSIBLE_DAIFMT_RIGHT_J |
+ SND_SOC_POSSIBLE_DAIFMT_LEFT_J |
+ SND_SOC_POSSIBLE_DAIFMT_DSP_A |
+ SND_SOC_POSSIBLE_DAIFMT_DSP_B |
+ SND_SOC_POSSIBLE_DAIFMT_AC97 |
+ SND_SOC_POSSIBLE_DAIFMT_PDM |
+ SND_SOC_POSSIBLE_DAIFMT_GATED |
+ SND_SOC_POSSIBLE_DAIFMT_CONT |
+ SND_SOC_POSSIBLE_DAIFMT_NB_NF |
+ SND_SOC_POSSIBLE_DAIFMT_NB_IF |
+ SND_SOC_POSSIBLE_DAIFMT_IB_NF |
+ SND_SOC_POSSIBLE_DAIFMT_IB_IF;
+
+static const struct snd_soc_dai_ops dummy_dai_ops = {
+ .auto_selectable_formats = &dummy_dai_formats,
+ .num_auto_selectable_formats = 1,
+};
+
/*
* The dummy CODEC is only meant to be used in situations where there is no
* actual hardware.
@@ -122,6 +150,7 @@ static struct snd_soc_dai_driver dummy_dai = {
.rates = STUB_RATES,
.formats = STUB_FORMATS,
},
+ .ops = &dummy_dai_ops,
};
int snd_soc_dai_is_dummy(struct snd_soc_dai *dai)
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 069/491] ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 068/491] ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components Greg Kroah-Hartman
` (426 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 7db07e37e13cfd46039d82aed91092185eac6565 ]
Do nothing if format was zero at snd_soc_runtime_set_dai_fmt().
soc-core.c can be more simple code by this patch.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87ee8jt7d3.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/meson/meson-codec-glue.c | 3 ---
sound/soc/soc-core.c | 11 ++++++-----
2 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/sound/soc/meson/meson-codec-glue.c b/sound/soc/meson/meson-codec-glue.c
index d07270d17cee7..2870cfad813ac 100644
--- a/sound/soc/meson/meson-codec-glue.c
+++ b/sound/soc/meson/meson-codec-glue.c
@@ -113,9 +113,6 @@ int meson_codec_glue_output_startup(struct snd_pcm_substream *substream,
/* Replace link params with the input params */
rtd->dai_link->params = &in_data->params;
- if (!in_data->fmt)
- return 0;
-
return snd_soc_runtime_set_dai_fmt(rtd, in_data->fmt);
}
EXPORT_SYMBOL_GPL(meson_codec_glue_output_startup);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 2fca5d03fd4f7..4294206dff362 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1240,6 +1240,9 @@ int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
unsigned int i;
int ret;
+ if (!dai_fmt)
+ return 0;
+
for_each_rtd_codec_dais(rtd, i, codec_dai) {
ret = snd_soc_dai_set_fmt(codec_dai, dai_fmt);
if (ret != 0 && ret != -ENOTSUPP)
@@ -1297,11 +1300,9 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
return ret;
snd_soc_runtime_get_dai_fmt(rtd);
- if (dai_link->dai_fmt) {
- ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
- if (ret)
- return ret;
- }
+ ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+ if (ret)
+ return ret;
/* add DPCM sysfs entries */
soc_dpcm_debugfs_add(rtd);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 069/491] ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-14 22:15 ` Ben Hutchings
2026-04-13 15:55 ` [PATCH 5.10 071/491] ASoC: core: Do not call link_exit() on uninitialized rtd objects Greg Kroah-Hartman
` (425 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski,
Amadeusz Sławiński, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit c7eb967d70446971413061effca3226578cb4dab ]
Flows leading to link->init() and link->exit() are not symmetric.
Currently the relevant part of card probe sequence goes as:
for_each_card_rtds(card, rtd)
for_each_rtd_components(rtd, i, component)
component->probe()
for_each_card_rtds(card, rtd)
for_each_rtd_dais(rtd, i, dai)
dai->probe()
for_each_card_rtds(card, rtd)
rtd->init()
On the other side, equivalent remove sequence goes as:
for_each_card_rtds(card, rtd)
for_each_rtd_dais(rtd, i, dai)
dai->remove()
for_each_card_rtds(card, rtd)
for_each_rtd_components(rtd, i, component)
component->remove()
for_each_card_rtds(card, rtd)
rtd->exit()
what can lead to errors as link->exit() may still operate on resources
owned by its components despite the probability of them being freed
during the component->remove().
This change modifies the remove sequence to:
for_each_card_rtds(card, rtd)
rtd->exit()
for_each_card_rtds(card, rtd)
for_each_rtd_dais(rtd, i, dai)
dai->remove()
for_each_card_rtds(card, rtd)
for_each_rtd_components(rtd, i, component)
component->remove()
so code found in link->exit() is safe to touch any component stuff as
component->remove() has not been called yet.
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20221027085840.1562698-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4294206dff362..562fbc0fb3475 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -962,9 +962,6 @@ void snd_soc_remove_pcm_runtime(struct snd_soc_card *card,
lockdep_assert_held(&client_mutex);
- /* release machine specific resources */
- snd_soc_link_exit(rtd);
-
/*
* Notify the machine driver for extra destruction
*/
@@ -1928,6 +1925,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
snd_soc_dapm_shutdown(card);
+ /* release machine specific resources */
+ for_each_card_rtds(card, rtd)
+ snd_soc_link_exit(rtd);
/* remove and free each DAI */
soc_remove_link_dais(card);
soc_remove_link_components(card);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 071/491] ASoC: core: Do not call link_exit() on uninitialized rtd objects
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 072/491] ASoC: soc-core: flush delayed work before removing DAIs and widgets Greg Kroah-Hartman
` (424 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski,
Amadeusz Sławiński, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
[ Upstream commit dd9f9cc1e6b9391140afa5cf27bb47c9e2a08d02 ]
On init we have sequence:
for_each_card_prelinks(card, i, dai_link) {
ret = snd_soc_add_pcm_runtime(card, dai_link);
ret = init_some_other_things(...);
if (ret)
goto probe_end:
for_each_card_rtds(card, rtd) {
ret = soc_init_pcm_runtime(card, rtd);
probe_end:
while on exit:
for_each_card_rtds(card, rtd)
snd_soc_link_exit(rtd);
If init_some_other_things() step fails due to error we end up with
not fully setup rtds and try to call snd_soc_link_exit on them, which
depending on contents on .link_exit handler, can end up dereferencing
NULL pointer.
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20230929103243.705433-2-amadeuszx.slawinski@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 95bc5c225513 ("ASoC: soc-core: flush delayed work before removing DAIs and widgets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/sound/soc.h | 2 ++
sound/soc/soc-core.c | 20 +++++++++++++++-----
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index e973044143bc9..ea343235098d6 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -1177,6 +1177,8 @@ struct snd_soc_pcm_runtime {
unsigned int pop_wait:1;
unsigned int fe_compr:1; /* for Dynamic PCM */
+ bool initialized;
+
int num_components;
struct snd_soc_component *components[]; /* CPU/Codec/Platform */
};
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 562fbc0fb3475..39d511c21796e 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1299,7 +1299,7 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
snd_soc_runtime_get_dai_fmt(rtd);
ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
if (ret)
- return ret;
+ goto err;
/* add DPCM sysfs entries */
soc_dpcm_debugfs_add(rtd);
@@ -1324,17 +1324,26 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
/* create compress_device if possible */
ret = snd_soc_dai_compress_new(cpu_dai, rtd, num);
if (ret != -ENOTSUPP)
- return ret;
+ goto err;
/* create the pcm */
ret = soc_new_pcm(rtd, num);
if (ret < 0) {
dev_err(card->dev, "ASoC: can't create pcm %s :%d\n",
dai_link->stream_name, ret);
- return ret;
+ goto err;
}
- return snd_soc_pcm_dai_new(rtd);
+ ret = snd_soc_pcm_dai_new(rtd);
+ if (ret < 0)
+ goto err;
+
+ rtd->initialized = true;
+
+ return 0;
+err:
+ snd_soc_link_exit(rtd);
+ return ret;
}
static void soc_set_name_prefix(struct snd_soc_card *card,
@@ -1927,7 +1936,8 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
/* release machine specific resources */
for_each_card_rtds(card, rtd)
- snd_soc_link_exit(rtd);
+ if (rtd->initialized)
+ snd_soc_link_exit(rtd);
/* remove and free each DAI */
soc_remove_link_dais(card);
soc_remove_link_components(card);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 072/491] ASoC: soc-core: flush delayed work before removing DAIs and widgets
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 071/491] ASoC: core: Do not call link_exit() on uninitialized rtd objects Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 073/491] serial: caif: hold tty->link reference in ldisc_open and ser_release Greg Kroah-Hartman
` (423 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matteo Cotifava, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <cotifavamatteo@gmail.com>
[ Upstream commit 95bc5c225513fc3c4ce169563fb5e3929fbb938b ]
When a sound card is unbound while a PCM stream is open, a
use-after-free can occur in snd_soc_dapm_stream_event(), called from
the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then
calls soc_cleanup_card_resources(). Inside cleanup,
snd_card_disconnect_sync() releases all PCM file descriptors, and
the resulting PCM close path can call snd_soc_dapm_stream_stop()
which schedules new delayed work with a pmdown_time timer delay.
Since this happens after the flush in snd_soc_unbind_card(), the
new work is not caught. soc_remove_link_components() then frees
DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it
runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after
snd_card_disconnect_sync() (after which no new PCM closes can
schedule further delayed work) and before soc_remove_link_dais()
and soc_remove_link_components() (which tear down the structures the
delayed work accesses).
Fixes: e894efef9ac7 ("ASoC: core: add support to card rebind")
Signed-off-by: Matteo Cotifava <cotifavamatteo@gmail.com>
Link: https://patch.msgid.link/20260309215412.545628-3-cotifavamatteo@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 39d511c21796e..7ecbea296e917 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1938,6 +1938,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
for_each_card_rtds(card, rtd)
if (rtd->initialized)
snd_soc_link_exit(rtd);
+ /* flush delayed work before removing DAIs and DAPM widgets */
+ snd_soc_flush_all_delayed_work(card);
+
/* remove and free each DAI */
soc_remove_link_dais(card);
soc_remove_link_components(card);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 073/491] serial: caif: hold tty->link reference in ldisc_open and ser_release
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 072/491] ASoC: soc-core: flush delayed work before removing DAIs and widgets Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 074/491] can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value Greg Kroah-Hartman
` (422 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Jiayuan Chen,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ Upstream commit 288598d80a068a0e9281de35bcb4ce495f189e2a ]
A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
when caif_serial's TX path calls tty_write_room(). The faulting access
is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and
also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in
my testing.
Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f
Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com
Fixes: e31d5a05948e ("caif: tty's are kref objects so take a reference")
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/caif/caif_serial.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 1b6a696182f72..02aea5a4b8ca8 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -312,6 +312,7 @@ static void ser_release(struct work_struct *work)
dev_close(ser->dev);
unregister_netdevice(ser->dev);
debugfs_deinit(ser);
+ tty_kref_put(tty->link);
tty_kref_put(tty);
}
rtnl_unlock();
@@ -346,6 +347,7 @@ static int ldisc_open(struct tty_struct *tty)
ser = netdev_priv(dev);
ser->tty = tty_kref_get(tty);
+ tty_kref_get(tty->link);
ser->dev = dev;
debugfs_init(ser, tty);
tty->receive_room = N_TTY_BUF_SIZE;
@@ -354,6 +356,7 @@ static int ldisc_open(struct tty_struct *tty)
rtnl_lock();
result = register_netdevice(dev);
if (result) {
+ tty_kref_put(tty->link);
tty_kref_put(tty);
rtnl_unlock();
free_netdev(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 074/491] can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 073/491] serial: caif: hold tty->link reference in ldisc_open and ser_release Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 075/491] netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Greg Kroah-Hartman
` (421 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenyuan Li, Marc Kleine-Budde,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenyuan Li <2063309626@qq.com>
[ Upstream commit 47bba09b14fa21712398febf36cb14fd4fc3bded ]
In hi3110_open(), the return value of hi3110_power_enable() is not checked.
If power enable fails, the device may not function correctly, while the
driver still returns success.
Add a check for the return value and propagate the error accordingly.
Signed-off-by: Wenyuan Li <2063309626@qq.com>
Link: https://patch.msgid.link/tencent_B5E2E7528BB28AA8A2A56E16C49BD58B8B07@qq.com
Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver")
[mkl: adjust subject, commit message and jump label]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/spi/hi311x.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index a7d594a5ad36f..f651a8ba7d53e 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -751,7 +751,9 @@ static int hi3110_open(struct net_device *net)
return ret;
mutex_lock(&priv->hi3110_lock);
- hi3110_power_enable(priv->transceiver, 1);
+ ret = hi3110_power_enable(priv->transceiver, 1);
+ if (ret)
+ goto out_close_candev;
priv->force_quit = 0;
priv->tx_skb = NULL;
@@ -798,6 +800,7 @@ static int hi3110_open(struct net_device *net)
hi3110_hw_sleep(spi);
out_close:
hi3110_power_enable(priv->transceiver, 0);
+ out_close_candev:
close_candev(net);
mutex_unlock(&priv->hi3110_lock);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 075/491] netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 074/491] can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 076/491] netfilter: x_tables: guard option walkers against 1-byte tail reads Greg Kroah-Hartman
` (420 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jenny Guanni Qu, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <qguanni@gmail.com>
[ Upstream commit d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 ]
pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the
to_offset argument on every iteration, including the last one where
i == m->field_count - 1. This reads one element past the end of the
stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]
with NFT_PIPAPO_MAX_FIELDS == 16).
Although pipapo_unmap() returns early when is_last is true without
using the to_offset value, the argument is evaluated at the call site
before the function body executes, making this a genuine out-of-bounds
stack read confirmed by KASAN:
BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]
Read of size 4 at addr ffff8000810e71a4
This frame has 1 object:
[32, 160) 'rulemap'
The buggy address is at offset 164 -- exactly 4 bytes past the end
of the rulemap array.
Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid
the out-of-bounds read.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_set_pipapo.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index a4fdd1587bb3b..07a8369a9f02f 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1539,6 +1539,7 @@ static void pipapo_drop(struct nft_pipapo_match *m,
int i;
nft_pipapo_for_each_field(f, i, m) {
+ bool last = i == m->field_count - 1;
int g;
for (g = 0; g < f->groups; g++) {
@@ -1558,7 +1559,7 @@ static void pipapo_drop(struct nft_pipapo_match *m,
}
pipapo_unmap(f->mt, f->rules, rulemap[i].to, rulemap[i].n,
- rulemap[i + 1].n, i == m->field_count - 1);
+ last ? 0 : rulemap[i + 1].n, last);
if (pipapo_resize(f, f->rules, f->rules - rulemap[i].n)) {
/* We can ignore this, a failure to shrink tables down
* doesn't make tables invalid.
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 076/491] netfilter: x_tables: guard option walkers against 1-byte tail reads
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 075/491] netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 077/491] netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path Greg Kroah-Hartman
` (419 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Dull, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Dull <monderasdor@gmail.com>
[ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ]
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Signed-off-by: David Dull <monderasdor@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_dccp.c | 4 ++--
net/netfilter/xt_tcpudp.c | 6 ++++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index e5a13ecbe67a0..037ab93e25d0a 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,
return true;
}
- if (op[i] < 2)
+ if (op[i] < 2 || i == optlen - 1)
i++;
else
- i += op[i+1]?:1;
+ i += op[i + 1] ? : 1;
}
spin_unlock_bh(&dccp_buflock);
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index 11ec2abf0c727..73f50dc01b19f 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -56,8 +56,10 @@ tcp_find_option(u_int8_t option,
for (i = 0; i < optlen; ) {
if (op[i] == option) return !invert;
- if (op[i] < 2) i++;
- else i += op[i+1]?:1;
+ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i + 1] ? : 1;
}
return invert;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 077/491] netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 076/491] netfilter: x_tables: guard option walkers against 1-byte tail reads Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 078/491] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Greg Kroah-Hartman
` (418 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Dull, Hyunwoo Kim,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit f1ba83755d81c6fc66ac7acd723d238f974091e9 ]
nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue
entry from the queue data structures, taking ownership of the entry.
For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN
attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN
present but NFQA_VLAN_TCI missing), the function returns immediately
without freeing the dequeued entry or its sk_buff.
This leaks the nf_queue_entry, its associated sk_buff, and all held
references (net_device refcounts, struct net refcount). Repeated
triggering exhausts kernel memory.
Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict
on the error path, consistent with other error handling in this file.
Fixes: 8d45ff22f1b4 ("netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR")
Reviewed-by: David Dull <monderasdor@gmail.com>
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_queue.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index dc6af1919deaf..bfe909267c9d9 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1209,8 +1209,10 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
if (entry->state.pf == PF_BRIDGE) {
err = nfqa_parse_bridge(entry, nfqa);
- if (err < 0)
+ if (err < 0) {
+ nfqnl_reinject(entry, NF_DROP);
return err;
+ }
}
if (nfqa[NFQA_PAYLOAD]) {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 078/491] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 077/491] netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 079/491] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Greg Kroah-Hartman
` (417 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ]
nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label
inside the for loop body. When the "last" helper saved in cb->args[1]
is deleted between dump rounds, every entry fails the (cur != last)
check, so cb->args[1] is never cleared. The for loop finishes with
cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back
into the loop body bypassing the bounds check, causing an 8-byte
out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
The 'goto restart' block was meant to re-traverse the current bucket
when "last" is no longer found, but it was placed after the for loop
instead of inside it. Move the block into the for loop body so that
the restart only occurs while cb->args[0] is still within bounds.
BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0
Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131
Call Trace:
nfnl_cthelper_dump_table+0x9f/0x1b0
netlink_dump+0x333/0x880
netlink_recvmsg+0x3e2/0x4b0
sock_recvmsg+0xde/0xf0
__sys_recvfrom+0x150/0x200
__x64_sys_recvfrom+0x76/0x90
do_syscall_64+0xc3/0x6e0
Allocated by task 1:
__kvmalloc_node_noprof+0x21b/0x700
nf_ct_alloc_hashtable+0x65/0xd0
nf_conntrack_helper_init+0x21/0x60
nf_conntrack_init_start+0x18d/0x300
nf_conntrack_standalone_init+0x12/0xc0
Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_cthelper.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 52d5f24118342..8edad41e4db66 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -601,10 +601,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
goto out;
}
}
- }
- if (cb->args[1]) {
- cb->args[1] = 0;
- goto restart;
+ if (cb->args[1]) {
+ cb->args[1] = 0;
+ goto restart;
+ }
}
out:
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 079/491] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 078/491] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 080/491] regulator: pca9450: Make IRQ optional Greg Kroah-Hartman
` (416 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Yuan Tan,
Xin Liu, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Tan <tanyuan98@outlook.com>
[ Upstream commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf ]
IDLETIMER revision 0 rules reuse existing timers by label and always call
mod_timer() on timer->timer.
If the label was created first by revision 1 with XT_IDLETIMER_ALARM,
the object uses alarm timer semantics and timer->timer is never initialized.
Reusing that object from revision 0 causes mod_timer() on an uninitialized
timer_list, triggering debugobjects warnings and possible panic when
panic_on_warn=1.
Fix this by rejecting revision 0 rule insertion when an existing timer with
the same label is of ALARM type.
Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
Co-developed-by: Yifan Wu <yifanwucs@gmail.com>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Co-developed-by: Juefei Pu <tomapufckgml@gmail.com>
Signed-off-by: Juefei Pu <tomapufckgml@gmail.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Xin Liu <dstsmallbird@foxmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_IDLETIMER.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 2f7cf5ecebf4f..d35ff0a2cad83 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -320,6 +320,12 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
info->timer = __idletimer_tg_find_by_label(info->label);
if (info->timer) {
+ if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
+ pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
+ mutex_unlock(&list_mutex);
+ return -EINVAL;
+ }
+
info->timer->refcnt++;
mod_timer(&info->timer->timer,
msecs_to_jiffies(info->timeout * 1000) + jiffies);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 080/491] regulator: pca9450: Make IRQ optional
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 079/491] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 081/491] regulator: pca9450: Correct interrupt type Greg Kroah-Hartman
` (415 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frieder Schrempf, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frieder Schrempf <frieder.schrempf@kontron.de>
[ Upstream commit 83808c54064eef620ad8645dfdcaffe125551532 ]
The IRQ line might not be connected on some boards. Allow the driver
to be probed without it.
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Link: https://patch.msgid.link/20240708084107.38986-5-frieder@fris.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 5d0efaf47ee9 ("regulator: pca9450: Correct interrupt type")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/pca9450-regulator.c | 41 +++++++++++++--------------
1 file changed, 19 insertions(+), 22 deletions(-)
diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c
index b3d206ebb2894..6ec2ad5b9efcc 100644
--- a/drivers/regulator/pca9450-regulator.c
+++ b/drivers/regulator/pca9450-regulator.c
@@ -704,11 +704,6 @@ static int pca9450_i2c_probe(struct i2c_client *i2c,
unsigned int device_id, i;
int ret;
- if (!i2c->irq) {
- dev_err(&i2c->dev, "No IRQ configured?\n");
- return -EINVAL;
- }
-
pca9450 = devm_kzalloc(&i2c->dev, sizeof(struct pca9450), GFP_KERNEL);
if (!pca9450)
return -ENOMEM;
@@ -775,23 +770,25 @@ static int pca9450_i2c_probe(struct i2c_client *i2c,
}
}
- ret = devm_request_threaded_irq(pca9450->dev, pca9450->irq, NULL,
- pca9450_irq_handler,
- (IRQF_TRIGGER_FALLING | IRQF_ONESHOT),
- "pca9450-irq", pca9450);
- if (ret != 0) {
- dev_err(pca9450->dev, "Failed to request IRQ: %d\n",
- pca9450->irq);
- return ret;
- }
- /* Unmask all interrupt except PWRON/WDOG/RSVD */
- ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_INT1_MSK,
- IRQ_VR_FLT1 | IRQ_VR_FLT2 | IRQ_LOWVSYS |
- IRQ_THERM_105 | IRQ_THERM_125,
- IRQ_PWRON | IRQ_WDOGB | IRQ_RSVD);
- if (ret) {
- dev_err(&i2c->dev, "Unmask irq error\n");
- return ret;
+ if (pca9450->irq) {
+ ret = devm_request_threaded_irq(pca9450->dev, pca9450->irq, NULL,
+ pca9450_irq_handler,
+ (IRQF_TRIGGER_FALLING | IRQF_ONESHOT),
+ "pca9450-irq", pca9450);
+ if (ret != 0) {
+ dev_err(pca9450->dev, "Failed to request IRQ: %d\n",
+ pca9450->irq);
+ return ret;
+ }
+ /* Unmask all interrupt except PWRON/WDOG/RSVD */
+ ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_INT1_MSK,
+ IRQ_VR_FLT1 | IRQ_VR_FLT2 | IRQ_LOWVSYS |
+ IRQ_THERM_105 | IRQ_THERM_125,
+ IRQ_PWRON | IRQ_WDOGB | IRQ_RSVD);
+ if (ret) {
+ dev_err(&i2c->dev, "Unmask irq error\n");
+ return ret;
+ }
}
/* Clear PRESET_EN bit in BUCK123_DVS to use DVS registers */
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 081/491] regulator: pca9450: Correct interrupt type
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 080/491] regulator: pca9450: Make IRQ optional Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 082/491] sched: idle: Make skipping governor callbacks more consistent Greg Kroah-Hartman
` (414 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peng Fan, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 5d0efaf47ee90ac60efae790acee3a3ed99ebf80 ]
Kernel warning on i.MX8MP-EVK when doing module test:
irq: type mismatch, failed to map hwirq-3 for gpio@30200000!
Per PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked
interrupt bit status is changed and it is released high once application
processor read INT1 register.
So the interrupt should be configured as IRQF_TRIGGER_LOW, not
IRQF_TRIGGER_FALLING.
Fixes: 0935ff5f1f0a4 ("regulator: pca9450: add pca9450 pmic driver")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20260310-pca9450-irq-v1-1-36adf52c2c55@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/pca9450-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c
index 6ec2ad5b9efcc..6f2f097b677d2 100644
--- a/drivers/regulator/pca9450-regulator.c
+++ b/drivers/regulator/pca9450-regulator.c
@@ -773,7 +773,7 @@ static int pca9450_i2c_probe(struct i2c_client *i2c,
if (pca9450->irq) {
ret = devm_request_threaded_irq(pca9450->dev, pca9450->irq, NULL,
pca9450_irq_handler,
- (IRQF_TRIGGER_FALLING | IRQF_ONESHOT),
+ (IRQF_TRIGGER_LOW | IRQF_ONESHOT),
"pca9450-irq", pca9450);
if (ret != 0) {
dev_err(pca9450->dev, "Failed to request IRQ: %d\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 082/491] sched: idle: Make skipping governor callbacks more consistent
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 081/491] regulator: pca9450: Correct interrupt type Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 083/491] nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set Greg Kroah-Hartman
` (413 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Christian Loehle,
Aboorva Devarajan, Frederic Weisbecker, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit d557640e4ce589a24dca5ca7ce3b9680f471325f ]
If the cpuidle governor .select() callback is skipped because there
is only one idle state in the cpuidle driver, the .reflect() callback
should be skipped as well, at least for consistency (if not for
correctness), so do it.
Fixes: e5c9ffc6ae1b ("cpuidle: Skip governor when only one idle state is available")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Reviewed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://patch.msgid.link/12857700.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle.c | 10 ----------
kernel/sched/idle.c | 11 ++++++++++-
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 87a57cee40fcb..1c1fa6ac9244a 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -319,16 +319,6 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
int cpuidle_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
bool *stop_tick)
{
- /*
- * If there is only a single idle state (or none), there is nothing
- * meaningful for the governor to choose. Skip the governor and
- * always use state 0 with the tick running.
- */
- if (drv->state_count <= 1) {
- *stop_tick = false;
- return 0;
- }
-
return cpuidle_curr_governor->select(drv, dev, stop_tick);
}
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index cdc3e690de714..8c38b4fe9ee72 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -223,7 +223,7 @@ static void cpuidle_idle_call(void)
next_state = cpuidle_find_deepest_state(drv, dev, max_latency_ns);
call_cpuidle(drv, dev, next_state);
- } else {
+ } else if (drv->state_count > 1) {
bool stop_tick = true;
/*
@@ -241,6 +241,15 @@ static void cpuidle_idle_call(void)
* Give the governor an opportunity to reflect on the outcome
*/
cpuidle_reflect(dev, entered_state);
+ } else {
+ tick_nohz_idle_retain_tick();
+
+ /*
+ * If there is only a single idle state (or none), there is
+ * nothing meaningful for the governor to choose. Skip the
+ * governor and always use state 0.
+ */
+ call_cpuidle(drv, dev, 0);
}
exit_idle:
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 083/491] nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 082/491] sched: idle: Make skipping governor callbacks more consistent Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 084/491] i40e: fix src IP mask checks and memcpy argument names in cloud filter Greg Kroah-Hartman
` (412 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Shi, Weidong Zhu, Dave Tian,
Sungwoo Kim, Keith Busch, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <iam@sung-woo.kim>
[ Upstream commit b4e78f1427c7d6859229ae9616df54e1fc05a516 ]
dev->online_queues is a count incremented in nvme_init_queue. Thus,
valid indices are 0 through dev->online_queues − 1.
This patch fixes the loop condition to ensure the index stays within the
valid range. Index 0 is excluded because it is the admin queue.
KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74
CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: nvme-reset-wq nvme_reset_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xce/0x5d0 mm/kasan/report.c:482
kasan_report+0xdc/0x110 mm/kasan/report.c:595
__asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252
process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
kthread+0x41a/0x930 kernel/kthread.c:463
ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Allocated by task 34 on cpu 1 at 4.241550s:
kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57
kasan_save_track+0x1c/0x70 mm/kasan/common.c:78
kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663
kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]
nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534
local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324
pci_call_probe drivers/pci/pci-driver.c:392 [inline]
__pci_device_probe drivers/pci/pci-driver.c:417 [inline]
pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x29b/0xb70 drivers/base/dd.c:661
__driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803
driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833
__driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159
async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129
process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
kthread+0x41a/0x930 kernel/kthread.c:463
ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
The buggy address belongs to the object at ffff88800592a000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 244 bytes to the right of
allocated 1152-byte region [ffff88800592a000, ffff88800592a480)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)
page_type: f5(slab)
raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fixes: 0f0d2c876c96 (nvme: free sq/cq dbbuf pointers when dbbuf set fails)
Acked-by: Chao Shi <cshi008@fiu.edu>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Acked-by: Dave Tian <daveti@purdue.edu>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 7a6827306e740..fbf8961f69efa 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -324,7 +324,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
/* Free memory and continue on */
nvme_dbbuf_dma_free(dev);
- for (i = 1; i <= dev->online_queues; i++)
+ for (i = 1; i < dev->online_queues; i++)
nvme_dbbuf_free(&dev->queues[i]);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 084/491] i40e: fix src IP mask checks and memcpy argument names in cloud filter
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 083/491] nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 085/491] e1000/e1000e: Fix leak in DMA error cleanup Greg Kroah-Hartman
` (411 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Aleksandr Loktionov,
Paul Menzel, Tony Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit e809085f492842ce7a519c9ef72d40f4bca89c13 ]
Fix following issues in the IPv4 and IPv6 cloud filter handling logic in
both the add and delete paths:
- The source-IP mask check incorrectly compares mask.src_ip[0] against
tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely
goes unnoticed because the check is in an "else if" path that only
executes when dst_ip is not set, most cloud filter use cases focus on
destination-IP matching, and the buggy condition can accidentally
evaluate true in some cases.
- memcpy() for the IPv4 source address incorrectly uses
ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although
both arrays are the same size.
- The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE
(tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and
sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size.
- In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing
dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent
explicit, even though both fields are struct in6_addr.
Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 3ddb712b732d5..014734ea71ff3 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3655,10 +3655,10 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)
cfilter.n_proto = ETH_P_IP;
if (mask.dst_ip[0] & tcf.dst_ip[0])
memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip,
- ARRAY_SIZE(tcf.dst_ip));
- else if (mask.src_ip[0] & tcf.dst_ip[0])
+ sizeof(cfilter.ip.v4.dst_ip));
+ else if (mask.src_ip[0] & tcf.src_ip[0])
memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip,
- ARRAY_SIZE(tcf.dst_ip));
+ sizeof(cfilter.ip.v4.src_ip));
break;
case VIRTCHNL_TCP_V6_FLOW:
cfilter.n_proto = ETH_P_IPV6;
@@ -3713,7 +3713,7 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)
/* for ipv6, mask is set for all sixteen bytes (4 words) */
if (cfilter.n_proto == ETH_P_IPV6 && mask.dst_ip[3])
if (memcmp(&cfilter.ip.v6.dst_ip6, &cf->ip.v6.dst_ip6,
- sizeof(cfilter.ip.v6.src_ip6)))
+ sizeof(cfilter.ip.v6.dst_ip6)))
continue;
if (mask.vlan_id)
if (cfilter.vlan_id != cf->vlan_id)
@@ -3799,10 +3799,10 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
cfilter->n_proto = ETH_P_IP;
if (mask.dst_ip[0] & tcf.dst_ip[0])
memcpy(&cfilter->ip.v4.dst_ip, tcf.dst_ip,
- ARRAY_SIZE(tcf.dst_ip));
- else if (mask.src_ip[0] & tcf.dst_ip[0])
+ sizeof(cfilter->ip.v4.dst_ip));
+ else if (mask.src_ip[0] & tcf.src_ip[0])
memcpy(&cfilter->ip.v4.src_ip, tcf.src_ip,
- ARRAY_SIZE(tcf.dst_ip));
+ sizeof(cfilter->ip.v4.src_ip));
break;
case VIRTCHNL_TCP_V6_FLOW:
cfilter->n_proto = ETH_P_IPV6;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 085/491] e1000/e1000e: Fix leak in DMA error cleanup
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 084/491] i40e: fix src IP mask checks and memcpy argument names in cloud filter Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 086/491] ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() Greg Kroah-Hartman
` (410 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Vollrath, Tony Nguyen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Vollrath <tactii@gmail.com>
[ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ]
If an error is encountered while mapping TX buffers, the driver should
unmap any buffers already mapped for that skb.
Because count is incremented after a successful mapping, it will always
match the correct number of unmappings needed when dma_error is reached.
Decrementing count before the while loop in dma_error causes an
off-by-one error. If any mapping was successful before an unsuccessful
mapping, exactly one DMA mapping would leak.
In these commits, a faulty while condition caused an infinite loop in
dma_error:
Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e
driver")
Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")
Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of
unsigned in *_tx_map()") fixed the infinite loop, but introduced the
off-by-one error.
This issue may still exist in the igbvf driver, but I did not address it
in this patch.
Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
Assisted-by: Claude:claude-4.6-opus
Signed-off-by: Matt Vollrath <tactii@gmail.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/e1000/e1000_main.c | 2 --
drivers/net/ethernet/intel/e1000e/netdev.c | 2 --
2 files changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 0b75029029132..d7e7c619a98e2 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -2951,8 +2951,6 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
dma_error:
dev_err(&pdev->dev, "TX DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i == 0)
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index b700663a634d2..902ada6a3b06c 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5633,8 +5633,6 @@ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb,
dma_error:
dev_err(&pdev->dev, "Tx DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i == 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 086/491] ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 085/491] e1000/e1000e: Fix leak in DMA error cleanup Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 087/491] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition Greg Kroah-Hartman
` (409 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Dooks, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <ben.dooks@codethink.co.uk>
[ Upstream commit 393815f57651101f1590632092986d1d5a3a41bd ]
The pointer returned from acpi_os_map_generic_address() is
tagged with __iomem, so make the rv it is returned to also
of void __iomem * type.
Fixes the following sparse warning:
drivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)
drivers/acpi/osl.c:1686:20: expected void *rv
drivers/acpi/osl.c:1686:20: got void [noderef] __iomem *
Fixes: 6915564dc5a8 ("ACPI: OSL: Change the type of acpi_os_map_generic_address() return value")
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
[ rjw: Subject tweak, added Fixes tag ]
Link: https://patch.msgid.link/20260311105835.463030-1-ben.dooks@codethink.co.uk
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/osl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 0418febc5cf20..6ed849172167a 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1755,7 +1755,7 @@ acpi_status __init acpi_os_initialize(void)
* Use acpi_os_map_generic_address to pre-map the reset
* register if it's in system memory.
*/
- void *rv;
+ void __iomem *rv;
rv = acpi_os_map_generic_address(&acpi_gbl_FADT.reset_register);
pr_debug(PREFIX "%s: map reset_reg %s\n", __func__,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 087/491] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 086/491] ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 088/491] ASoC: detect empty DMI strings Greg Kroah-Hartman
` (408 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Ni, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit 53f3a900e9a383d47af7253076e19f510c5708d0 ]
The acp3x_5682_init() function did not check the return value of
clk_get(), which could lead to dereferencing error pointers in
rt5682_clk_enable().
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding proper IS_ERR() checks for both clock acquisitions.
Fixes: 6b8e4e7db3cd ("ASoC: amd: Add machine driver for Raven based platform")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://patch.msgid.link/20260310024246.2153827-1-nichen@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp3x-rt5682-max9836.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/sound/soc/amd/acp3x-rt5682-max9836.c b/sound/soc/amd/acp3x-rt5682-max9836.c
index 1a4e8ca0f99c2..7e2f8d628cbbc 100644
--- a/sound/soc/amd/acp3x-rt5682-max9836.c
+++ b/sound/soc/amd/acp3x-rt5682-max9836.c
@@ -83,8 +83,13 @@ static int acp3x_5682_init(struct snd_soc_pcm_runtime *rtd)
return ret;
}
- rt5682_dai_wclk = clk_get(component->dev, "rt5682-dai-wclk");
- rt5682_dai_bclk = clk_get(component->dev, "rt5682-dai-bclk");
+ rt5682_dai_wclk = devm_clk_get(component->dev, "rt5682-dai-wclk");
+ if (IS_ERR(rt5682_dai_wclk))
+ return PTR_ERR(rt5682_dai_wclk);
+
+ rt5682_dai_bclk = devm_clk_get(component->dev, "rt5682-dai-bclk");
+ if (IS_ERR(rt5682_dai_bclk))
+ return PTR_ERR(rt5682_dai_bclk);
ret = snd_soc_card_jack_new(card, "Headset Jack",
SND_JACK_HEADSET | SND_JACK_LINEOUT |
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 088/491] ASoC: detect empty DMI strings
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 087/491] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 089/491] cgroup: fix race between task migration and iteration Greg Kroah-Hartman
` (407 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Casey Connolly, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Connolly <casey.connolly@linaro.org>
[ Upstream commit a9683730e8b1d632674f81844ed03ddfbe4821c0 ]
Some bootloaders like recent versions of U-Boot may install some DMI
properties with empty values rather than not populate them. This manages
to make its way through the validator and cleanup resulting in a rogue
hyphen being appended to the card longname.
Fixes: 4e01e5dbba96 ("ASoC: improve the DMI long card code in asoc-core")
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Link: https://patch.msgid.link/20260306174707.283071-2-casey.connolly@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 7ecbea296e917..8ceffa6851bd0 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1675,12 +1675,15 @@ static void cleanup_dmi_name(char *name)
/*
* Check if a DMI field is valid, i.e. not containing any string
- * in the black list.
+ * in the black list and not the empty string.
*/
static int is_dmi_valid(const char *field)
{
int i = 0;
+ if (!field[0])
+ return 0;
+
while (dmi_blacklist[i]) {
if (strstr(field, dmi_blacklist[i]))
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 089/491] cgroup: fix race between task migration and iteration
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 088/491] ASoC: detect empty DMI strings Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 090/491] net: usb: lan78xx: fix silent drop of packets with checksum errors Greg Kroah-Hartman
` (406 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qingye Zhao, Michal Koutný,
Tejun Heo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingye Zhao <zhaoqingye@honor.com>
commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream.
When a task is migrated out of a css_set, cgroup_migrate_add_task()
first moves it from cset->tasks to cset->mg_tasks via:
list_move_tail(&task->cg_list, &cset->mg_tasks);
If a css_task_iter currently has it->task_pos pointing to this task,
css_set_move_task() calls css_task_iter_skip() to keep the iterator
valid. However, since the task has already been moved to ->mg_tasks,
the iterator is advanced relative to the mg_tasks list instead of the
original tasks list. As a result, remaining tasks on cset->tasks, as
well as tasks queued on cset->mg_tasks, can be skipped by iteration.
Fix this by calling css_set_skip_task_iters() before unlinking
task->cg_list from cset->tasks. This advances all active iterators to
the next task on cset->tasks, so iteration continues correctly even
when a task is concurrently being migrated.
This race is hard to hit in practice without instrumentation, but it
can be reproduced by artificially slowing down cgroup_procs_show().
For example, on an Android device a temporary
/sys/kernel/cgroup/cgroup_test knob can be added to inject a delay
into cgroup_procs_show(), and then:
1) Spawn three long-running tasks (PIDs 101, 102, 103).
2) Create a test cgroup and move the tasks into it.
3) Enable a large delay via /sys/kernel/cgroup/cgroup_test.
4) In one shell, read cgroup.procs from the test cgroup.
5) Within the delay window, in another shell migrate PID 102 by
writing it to a different cgroup.procs file.
Under this setup, cgroup.procs can intermittently show only PID 101
while skipping PID 103. Once the migration completes, reading the
file again shows all tasks as expected.
Note that this change does not allow removing the existing
css_set_skip_task_iters() call in css_set_move_task(). The new call
in cgroup_migrate_add_task() only handles iterators that are racing
with migration while the task is still on cset->tasks. Iterators may
also start after the task has been moved to cset->mg_tasks. If we
dropped css_set_skip_task_iters() from css_set_move_task(), such
iterators could keep task_pos pointing to a migrating task, causing
css_task_iter_advance() to malfunction on the destination css_set,
up to and including crashes or infinite loops.
The race window between migration and iteration is very small, and
css_task_iter is not on a hot path. In the worst case, when an
iterator is positioned on the first thread of the migrating process,
cgroup_migrate_add_task() may have to skip multiple tasks via
css_set_skip_task_iters(). However, this only happens when migration
and iteration actually race, so the performance impact is negligible
compared to the correctness fix provided here.
Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Qingye Zhao <zhaoqingye@honor.com>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup/cgroup.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2413,6 +2413,7 @@ static void cgroup_migrate_add_task(stru
mgctx->tset.nr_tasks++;
+ css_set_skip_task_iters(cset, task);
list_move_tail(&task->cg_list, &cset->mg_tasks);
if (list_empty(&cset->mg_node))
list_add_tail(&cset->mg_node,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 090/491] net: usb: lan78xx: fix silent drop of packets with checksum errors
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 089/491] cgroup: fix race between task migration and iteration Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 091/491] net: usb: lan78xx: skip LTM configuration for LAN7850 Greg Kroah-Hartman
` (405 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream.
Do not drop packets with checksum errors at the USB driver level;
pass them to the network stack.
Previously, the driver dropped all packets where the 'Receive Error
Detected' (RED) bit was set, regardless of the specific error type. This
caused packets with only IP or TCP/UDP checksum errors to be dropped
before reaching the kernel, preventing the network stack from accounting
for them or performing software fallback.
Add a mask for hard hardware errors to safely drop genuinely corrupt
frames, while allowing checksum-errored frames to pass with their
ip_summed field explicitly set to CHECKSUM_NONE.
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/lan78xx.c | 4 +++-
drivers/net/usb/lan78xx.h | 3 +++
2 files changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3279,6 +3279,7 @@ static void lan78xx_rx_csum_offload(stru
*/
if (!(dev->net->features & NETIF_F_RXCSUM) ||
unlikely(rx_cmd_a & RX_CMD_A_ICSM_) ||
+ unlikely(rx_cmd_a & RX_CMD_A_CSE_MASK_) ||
((rx_cmd_a & RX_CMD_A_FVTG_) &&
!(dev->net->features & NETIF_F_HW_VLAN_CTAG_RX))) {
skb->ip_summed = CHECKSUM_NONE;
@@ -3346,7 +3347,8 @@ static int lan78xx_rx(struct lan78xx_net
size = (rx_cmd_a & RX_CMD_A_LEN_MASK_);
align_count = (4 - ((size + RXW_PADDING) % 4)) % 4;
- if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) {
+ if (unlikely(rx_cmd_a & RX_CMD_A_RED_) &&
+ (rx_cmd_a & RX_CMD_A_RX_HARD_ERRS_MASK_)) {
netif_dbg(dev, rx_err, dev->net,
"Error rx_cmd_a=0x%08x", rx_cmd_a);
} else {
--- a/drivers/net/usb/lan78xx.h
+++ b/drivers/net/usb/lan78xx.h
@@ -74,6 +74,9 @@
#define RX_CMD_A_ICSM_ (0x00004000)
#define RX_CMD_A_LEN_MASK_ (0x00003FFF)
+#define RX_CMD_A_RX_HARD_ERRS_MASK_ \
+ (RX_CMD_A_RX_ERRS_MASK_ & ~RX_CMD_A_CSE_MASK_)
+
/* Rx Command B */
#define RX_CMD_B_CSUM_SHIFT_ (16)
#define RX_CMD_B_CSUM_MASK_ (0xFFFF0000)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 091/491] net: usb: lan78xx: skip LTM configuration for LAN7850
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 090/491] net: usb: lan78xx: fix silent drop of packets with checksum errors Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 092/491] usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Greg Kroah-Hartman
` (404 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream.
Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.
The LAN7850 is a High-Speed (USB 2.0) only device and does not support
SuperSpeed features like LTM. Currently, the driver unconditionally
attempts to configure LTM registers during initialization. On the
LAN7850, these registers do not exist, resulting in writes to invalid
or undocumented memory space.
This issue was identified during a port to the regmap API with strict
register validation enabled. While no functional issues or crashes have
been observed from these invalid writes, bypassing LTM initialization
on the LAN7850 ensures the driver strictly adheres to the hardware's
valid register map.
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/lan78xx.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2463,6 +2463,10 @@ static void lan78xx_init_ltm(struct lan7
u32 buf;
u32 regs[6] = { 0 };
+ /* LAN7850 is USB 2.0 and does not support LTM */
+ if (dev->chipid == ID_REV_CHIP_ID_7850_)
+ return;
+
ret = lan78xx_read_reg(dev, USB_CFG1, &buf);
if (buf & USB_CFG1_LTM_ENABLE_) {
u8 temp[2];
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 092/491] usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 091/491] net: usb: lan78xx: skip LTM configuration for LAN7850 Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 093/491] usb: xhci: Fix memory leak in xhci_disable_slot() Greg Kroah-Hartman
` (403 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Christoffer Sandberg,
Werner Sembach
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <cs@tuxedo.de>
commit 0326ff28d56b4fa202de36ffc8462a354f383a64 upstream.
Similar to other Huawei LTE modules using this quirk, this version with
another vid/pid suffers from spurious wakeups.
Setting the quirk fixes the issue for this device as well.
Cc: stable <stable@kernel.org>
Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://patch.msgid.link/20260306172817.2098898-1-wse@tuxedocomputers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -205,6 +205,10 @@ static const struct usb_device_id usb_qu
/* HP v222w 16GB Mini USB Drive */
{ USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
+ /* Huawei 4G LTE module ME906S */
+ { USB_DEVICE(0x03f0, 0xa31d), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+
/* Creative SB Audigy 2 NX */
{ USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 093/491] usb: xhci: Fix memory leak in xhci_disable_slot()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 092/491] usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 094/491] usb: yurex: fix race in probe Greg Kroah-Hartman
` (402 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zilin Guan, Mathias Nyman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
commit c1c8550e70401159184130a1afc6261db01fc0ce upstream.
xhci_alloc_command() allocates a command structure and, when the
second argument is true, also allocates a completion structure.
Currently, the error handling path in xhci_disable_slot() only frees
the command structure using kfree(), causing the completion structure
to leak.
Use xhci_free_command() instead of kfree(). xhci_free_command() correctly
frees both the command structure and the associated completion structure.
Since the command structure is allocated with zero-initialization,
command->in_ctx is NULL and will not be erroneously freed by
xhci_free_command().
This bug was found using an experimental static analysis tool we are
developing. The tool is based on the LLVM framework and is specifically
designed to detect memory management issues. It is currently under
active development and not yet publicly available, but we plan to
open-source it after our research is published.
The bug was originally detected on v6.13-rc1 using our static analysis
tool, and we have verified that the issue persists in the latest mainline
kernel.
We performed build testing on x86_64 with allyesconfig using GCC=11.4.0.
Since triggering these error paths in xhci_disable_slot() requires specific
hardware conditions or abnormal state, we were unable to construct a test
case to reliably trigger these specific error paths at runtime.
Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend")
CC: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260304223639.3882398-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3982,7 +3982,7 @@ int xhci_disable_slot(struct xhci_hcd *x
if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
(xhci->xhc_state & XHCI_STATE_HALTED)) {
spin_unlock_irqrestore(&xhci->lock, flags);
- kfree(command);
+ xhci_free_command(xhci, command);
return -ENODEV;
}
@@ -3990,7 +3990,7 @@ int xhci_disable_slot(struct xhci_hcd *x
slot_id);
if (ret) {
spin_unlock_irqrestore(&xhci->lock, flags);
- kfree(command);
+ xhci_free_command(xhci, command);
return ret;
}
xhci_ring_cmd_db(xhci);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 094/491] usb: yurex: fix race in probe
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 093/491] usb: xhci: Fix memory leak in xhci_disable_slot() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 095/491] usb: misc: uss720: properly clean up reference in uss720_probe() Greg Kroah-Hartman
` (401 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Oliver Neukum
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 7a875c09899ba0404844abfd8f0d54cdc481c151 upstream.
The bbu member of the descriptor must be set to the value
standing for uninitialized values before the URB whose
completion handler sets bbu is submitted. Otherwise there is
a window during which probing can overwrite already retrieved
data.
Cc: stable <stable@kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260209143720.1507500-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -271,6 +271,7 @@ static int yurex_probe(struct usb_interf
dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
dev, 1);
dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ dev->bbu = -1;
if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
retval = -EIO;
dev_err(&interface->dev, "Could not submitting URB\n");
@@ -279,7 +280,6 @@ static int yurex_probe(struct usb_interf
/* save our data pointer in this interface device */
usb_set_intfdata(interface, dev);
- dev->bbu = -1;
/* we can register the device now, as it is ready */
retval = usb_register_dev(interface, &yurex_class);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 095/491] usb: misc: uss720: properly clean up reference in uss720_probe()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 094/491] usb: yurex: fix race in probe Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 096/491] usb: core: dont power off roothub PHYs if phy_set_mode() fails Greg Kroah-Hartman
` (400 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 45dba8011efac11a2f360383221b541f5ea53ce5 upstream.
If get_1284_register() fails, the usb device reference count is
incorrect and needs to be properly dropped before returning. That will
happen when the kref is dropped in the call to destroy_priv(), so jump
to that error path instead of returning directly.
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Link: https://patch.msgid.link/2026022342-smokiness-stove-d792@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/uss720.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -733,7 +733,7 @@ static int uss720_probe(struct usb_inter
ret = get_1284_register(pp, 0, ®, GFP_KERNEL);
dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
if (ret < 0)
- return ret;
+ goto probe_abort;
ret = usb_find_last_int_in_endpoint(interface, &epd);
if (!ret) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 096/491] usb: core: dont power off roothub PHYs if phy_set_mode() fails
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 095/491] usb: misc: uss720: properly clean up reference in uss720_probe() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 097/491] usb: cdc-acm: Restore CAP_BRK functionnality to CH343 Greg Kroah-Hartman
` (399 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
commit e293015ba76eb96ce4ebed7e3b2cb1a7d319f3e9 upstream.
Remove the error path from the usb_phy_roothub_set_mode() function.
The code is clearly wrong, because phy_set_mode() calls can't be
balanced with phy_power_off() calls.
Additionally, the usb_phy_roothub_set_mode() function is called only
from usb_add_hcd() before it powers on the PHYs, so powering off those
makes no sense anyway.
Presumably, the code is copy-pasted from the phy_power_on() function
without adjusting the error handling.
Cc: stable@vger.kernel.org # v5.1+
Fixes: b97a31348379 ("usb: core: comply to PHY framework")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260218-usb-phy-poweroff-fix-v1-1-66e6831e860e@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/phy.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/drivers/usb/core/phy.c
+++ b/drivers/usb/core/phy.c
@@ -138,16 +138,10 @@ int usb_phy_roothub_set_mode(struct usb_
list_for_each_entry(roothub_entry, head, list) {
err = phy_set_mode(roothub_entry->phy, mode);
if (err)
- goto err_out;
+ return err;
}
return 0;
-
-err_out:
- list_for_each_entry_continue_reverse(roothub_entry, head, list)
- phy_power_off(roothub_entry->phy);
-
- return err;
}
EXPORT_SYMBOL_GPL(usb_phy_roothub_set_mode);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 097/491] usb: cdc-acm: Restore CAP_BRK functionnality to CH343
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 096/491] usb: core: dont power off roothub PHYs if phy_set_mode() fails Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 098/491] USB: usbcore: Introduce usb_bulk_msg_killable() Greg Kroah-Hartman
` (398 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, stable, Oliver Neukum
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream.
The CH343 USB/serial adapter is as buggy as it is popular (very).
One of its quirks is that despite being capable of signalling a
BREAK condition, it doesn't advertise it.
This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm:
return correct error code on unsupported break") applied some
reasonable restrictions, preventing breaks from being emitted on
devices that do not advertise CAP_BRK.
Add a quirk for this particular device, so that breaks can still
be produced on some of my machines attached to my console server.
Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable <stable@kernel.org>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 5 +++++
drivers/usb/class/cdc-acm.h | 1 +
2 files changed, 6 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1379,6 +1379,8 @@ made_compressed_probe:
acm->ctrl_caps = h.usb_cdc_acm_descriptor->bmCapabilities;
if (quirks & NO_CAP_LINE)
acm->ctrl_caps &= ~USB_CDC_CAP_LINE;
+ if (quirks & MISSING_CAP_BRK)
+ acm->ctrl_caps |= USB_CDC_CAP_BRK;
acm->ctrlsize = ctrlsize;
acm->readsize = readsize;
acm->rx_buflimit = num_rx_buf;
@@ -1990,6 +1992,9 @@ static const struct usb_device_id acm_id
.driver_info = IGNORE_DEVICE,
},
+ /* CH343 supports CAP_BRK, but doesn't advertise it */
+ { USB_DEVICE(0x1a86, 0x55d3), .driver_info = MISSING_CAP_BRK, },
+
/* control interfaces without any protocol set */
{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
USB_CDC_PROTO_NONE) },
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -141,3 +141,4 @@ struct acm {
#define CLEAR_HALT_CONDITIONS BIT(5)
#define SEND_ZERO_PACKET BIT(6)
#define DISABLE_ECHO BIT(7)
+#define MISSING_CAP_BRK BIT(8)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 098/491] USB: usbcore: Introduce usb_bulk_msg_killable()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 097/491] usb: cdc-acm: Restore CAP_BRK functionnality to CH343 Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 099/491] USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts Greg Kroah-Hartman
` (397 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Oliver Neukum
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 416909962e7cdf29fd01ac523c953f37708df93d upstream.
The synchronous message API in usbcore (usb_control_msg(),
usb_bulk_msg(), and so on) uses uninterruptible waits. However,
drivers may call these routines in the context of a user thread, which
means it ought to be possible to at least kill them.
For this reason, introduce a new usb_bulk_msg_killable() function
which behaves the same as usb_bulk_msg() except for using
wait_for_completion_killable_timeout() instead of
wait_for_completion_timeout(). The same can be done later for
usb_control_msg() later on, if it turns out to be needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Suggested-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/248628b4-cc83-4e81-a620-3ce4e0376d41@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/message.c | 79 +++++++++++++++++++++++++++++++++++++++------
include/linux/usb.h | 5 +-
2 files changed, 72 insertions(+), 12 deletions(-)
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -41,16 +41,17 @@ static void usb_api_blocking_completion(
/*
- * Starts urb and waits for completion or timeout. Note that this call
- * is NOT interruptible. Many device driver i/o requests should be
- * interruptible and therefore these drivers should implement their
- * own interruptible routines.
+ * Starts urb and waits for completion or timeout.
+ * Whether or not the wait is killable depends on the flag passed in.
+ * For example, compare usb_bulk_msg() and usb_bulk_msg_killable().
*/
-static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length)
+static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length,
+ bool killable)
{
struct api_context ctx;
unsigned long expire;
int retval;
+ long rc;
init_completion(&ctx.done);
urb->context = &ctx;
@@ -60,12 +61,21 @@ static int usb_start_wait_urb(struct urb
goto out;
expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
- if (!wait_for_completion_timeout(&ctx.done, expire)) {
+ if (killable)
+ rc = wait_for_completion_killable_timeout(&ctx.done, expire);
+ else
+ rc = wait_for_completion_timeout(&ctx.done, expire);
+ if (rc <= 0) {
usb_kill_urb(urb);
- retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
+ if (ctx.status != -ENOENT)
+ retval = ctx.status;
+ else if (rc == 0)
+ retval = -ETIMEDOUT;
+ else
+ retval = rc;
dev_dbg(&urb->dev->dev,
- "%s timed out on ep%d%s len=%u/%u\n",
+ "%s timed out or killed on ep%d%s len=%u/%u\n",
current->comm,
usb_endpoint_num(&urb->ep->desc),
usb_urb_dir_in(urb) ? "in" : "out",
@@ -99,7 +109,7 @@ static int usb_internal_control_msg(stru
usb_fill_control_urb(urb, usb_dev, pipe, (unsigned char *)cmd, data,
len, usb_api_blocking_completion, NULL);
- retv = usb_start_wait_urb(urb, timeout, &length);
+ retv = usb_start_wait_urb(urb, timeout, &length, false);
if (retv < 0)
return retv;
else
@@ -388,10 +398,59 @@ int usb_bulk_msg(struct usb_device *usb_
usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
usb_api_blocking_completion, NULL);
- return usb_start_wait_urb(urb, timeout, actual_length);
+ return usb_start_wait_urb(urb, timeout, actual_length, false);
}
EXPORT_SYMBOL_GPL(usb_bulk_msg);
+/**
+ * usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state
+ * @usb_dev: pointer to the usb device to send the message to
+ * @pipe: endpoint "pipe" to send the message to
+ * @data: pointer to the data to send
+ * @len: length in bytes of the data to send
+ * @actual_length: pointer to a location to put the actual length transferred
+ * in bytes
+ * @timeout: time in msecs to wait for the message to complete before
+ * timing out (if 0 the wait is forever)
+ *
+ * Context: task context, might sleep.
+ *
+ * This function is just like usb_blk_msg() except that it waits in a
+ * killable state.
+ *
+ * Return:
+ * If successful, 0. Otherwise a negative error number. The number of actual
+ * bytes transferred will be stored in the @actual_length parameter.
+ *
+ */
+int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+ void *data, int len, int *actual_length, int timeout)
+{
+ struct urb *urb;
+ struct usb_host_endpoint *ep;
+
+ ep = usb_pipe_endpoint(usb_dev, pipe);
+ if (!ep || len < 0)
+ return -EINVAL;
+
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!urb)
+ return -ENOMEM;
+
+ if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+ USB_ENDPOINT_XFER_INT) {
+ pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
+ usb_fill_int_urb(urb, usb_dev, pipe, data, len,
+ usb_api_blocking_completion, NULL,
+ ep->desc.bInterval);
+ } else
+ usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
+ usb_api_blocking_completion, NULL);
+
+ return usb_start_wait_urb(urb, timeout, actual_length, true);
+}
+EXPORT_SYMBOL_GPL(usb_bulk_msg_killable);
+
/*-------------------------------------------------------------------*/
static void sg_clean(struct usb_sg_request *io)
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1804,8 +1804,9 @@ extern int usb_control_msg(struct usb_de
extern int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
void *data, int len, int *actual_length, int timeout);
extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
- void *data, int len, int *actual_length,
- int timeout);
+ void *data, int len, int *actual_length, int timeout);
+extern int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+ void *data, int len, int *actual_length, int timeout);
/* wrappers around usb_control_msg() for the most common standard requests */
int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 099/491] USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 098/491] USB: usbcore: Introduce usb_bulk_msg_killable() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 100/491] USB: core: Limit the length of unkillable synchronous timeouts Greg Kroah-Hartman
` (396 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+25ba18e2c5040447585d,
Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream.
The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.
Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t
Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/usbtmc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -696,7 +696,7 @@ static int usbtmc488_ioctl_trigger(struc
buffer[1] = data->bTag;
buffer[2] = ~data->bTag;
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_sndbulkpipe(data->usb_dev,
data->bulk_out),
buffer, USBTMC_HEADER_SIZE,
@@ -1316,7 +1316,7 @@ static int send_request_dev_dep_msg_in(s
buffer[11] = 0; /* Reserved */
/* Send bulk URB */
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_sndbulkpipe(data->usb_dev,
data->bulk_out),
buffer, USBTMC_HEADER_SIZE,
@@ -1388,7 +1388,7 @@ static ssize_t usbtmc_read(struct file *
actual = 0;
/* Send bulk URB */
- retval = usb_bulk_msg(data->usb_dev,
+ retval = usb_bulk_msg_killable(data->usb_dev,
usb_rcvbulkpipe(data->usb_dev,
data->bulk_in),
buffer, bufsize, &actual,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 100/491] USB: core: Limit the length of unkillable synchronous timeouts
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 099/491] USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 101/491] usb: class: cdc-wdm: fix reordering issue in read code path Greg Kroah-Hartman
` (395 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream.
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in
usbcore allow unlimited timeout durations. And since they use
uninterruptible waits, this leaves open the possibility of hanging a
task for an indefinitely long time, with no way to kill it short of
unplugging the target device.
To prevent this sort of problem, enforce a maximum limit on the length
of these unkillable timeouts. The limit chosen here, somewhat
arbitrarily, is 60 seconds. On many systems (although not all) this
is short enough to avoid triggering the kernel's hung-task detector.
In addition, clear up the ambiguity of negative timeout values by
treating them the same as 0, i.e., using the maximum allowed timeout.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/message.c | 24 ++++++++++++------------
include/linux/usb.h | 3 +++
2 files changed, 15 insertions(+), 12 deletions(-)
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -44,6 +44,8 @@ static void usb_api_blocking_completion(
* Starts urb and waits for completion or timeout.
* Whether or not the wait is killable depends on the flag passed in.
* For example, compare usb_bulk_msg() and usb_bulk_msg_killable().
+ *
+ * For non-killable waits, we enforce a maximum limit on the timeout value.
*/
static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length,
bool killable)
@@ -60,7 +62,9 @@ static int usb_start_wait_urb(struct urb
if (unlikely(retval))
goto out;
- expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
+ if (!killable && (timeout <= 0 || timeout > USB_MAX_SYNCHRONOUS_TIMEOUT))
+ timeout = USB_MAX_SYNCHRONOUS_TIMEOUT;
+ expire = (timeout > 0) ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
if (killable)
rc = wait_for_completion_killable_timeout(&ctx.done, expire);
else
@@ -126,8 +130,7 @@ static int usb_internal_control_msg(stru
* @index: USB message index value
* @data: pointer to the data to send
* @size: length in bytes of the data to send
- * @timeout: time in msecs to wait for the message to complete before timing
- * out (if 0 the wait is forever)
+ * @timeout: time in msecs to wait for the message to complete before timing out
*
* Context: !in_interrupt ()
*
@@ -182,8 +185,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg);
* @index: USB message index value
* @driver_data: pointer to the data to send
* @size: length in bytes of the data to send
- * @timeout: time in msecs to wait for the message to complete before timing
- * out (if 0 the wait is forever)
+ * @timeout: time in msecs to wait for the message to complete before timing out
* @memflags: the flags for memory allocation for buffers
*
* Context: !in_interrupt ()
@@ -245,8 +247,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_send);
* @index: USB message index value
* @driver_data: pointer to the data to be filled in by the message
* @size: length in bytes of the data to be received
- * @timeout: time in msecs to wait for the message to complete before timing
- * out (if 0 the wait is forever)
+ * @timeout: time in msecs to wait for the message to complete before timing out
* @memflags: the flags for memory allocation for buffers
*
* Context: !in_interrupt ()
@@ -317,8 +318,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_recv);
* @len: length in bytes of the data to send
* @actual_length: pointer to a location to put the actual length transferred
* in bytes
- * @timeout: time in msecs to wait for the message to complete before
- * timing out (if 0 the wait is forever)
+ * @timeout: time in msecs to wait for the message to complete before timing out
*
* Context: !in_interrupt ()
*
@@ -411,12 +411,12 @@ EXPORT_SYMBOL_GPL(usb_bulk_msg);
* @actual_length: pointer to a location to put the actual length transferred
* in bytes
* @timeout: time in msecs to wait for the message to complete before
- * timing out (if 0 the wait is forever)
+ * timing out (if <= 0, the wait is as long as possible)
*
* Context: task context, might sleep.
*
- * This function is just like usb_blk_msg() except that it waits in a
- * killable state.
+ * This function is just like usb_blk_msg(), except that it waits in a
+ * killable state and there is no limit on the timeout length.
*
* Return:
* If successful, 0. Otherwise a negative error number. The number of actual
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1798,6 +1798,9 @@ void usb_buffer_unmap_sg(const struct us
* SYNCHRONOUS CALL SUPPORT *
*-------------------------------------------------------------------*/
+/* Maximum value allowed for timeout in synchronous routines below */
+#define USB_MAX_SYNCHRONOUS_TIMEOUT 60000 /* ms */
+
extern int usb_control_msg(struct usb_device *dev, unsigned int pipe,
__u8 request, __u8 requesttype, __u16 value, __u16 index,
void *data, __u16 size, int timeout);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 101/491] usb: class: cdc-wdm: fix reordering issue in read code path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 100/491] USB: core: Limit the length of unkillable synchronous timeouts Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 102/491] usb: renesas_usbhs: fix use-after-free in ISR during device removal Greg Kroah-Hartman
` (394 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Oliver Neukum, Gui-Dong Han
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 8df672bfe3ec2268c2636584202755898e547173 upstream.
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the
desc->length update can be reordered before the memmove. If this
happens, wdm_read() can see the new length and call copy_to_user() on
uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
Fixes: afba937e540c9 ("USB: CDC WDM driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Closes: https://lore.kernel.org/linux-usb/CALbr=LbrUZn_cfp7CfR-7Z5wDTHF96qeuM=3fO2m-q4cDrnC4A@mail.gmail.com/
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://patch.msgid.link/20260304130116.1721682-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-wdm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -212,7 +212,8 @@ static void wdm_in_callback(struct urb *
/* we may already be in overflow */
if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
memmove(desc->ubuf + desc->length, desc->inbuf, length);
- desc->length += length;
+ smp_wmb(); /* against wdm_read() */
+ WRITE_ONCE(desc->length, desc->length + length);
}
}
skip_error:
@@ -519,6 +520,7 @@ static ssize_t wdm_read
return -ERESTARTSYS;
cntr = READ_ONCE(desc->length);
+ smp_rmb(); /* against wdm_in_callback() */
if (cntr == 0) {
desc->read = 0;
retry:
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 102/491] usb: renesas_usbhs: fix use-after-free in ISR during device removal
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 101/491] usb: class: cdc-wdm: fix reordering issue in read code path Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 103/491] usb: mdc800: handle signal and read racing Greg Kroah-Hartman
` (393 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alan Stern, Fan Wu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 3cbc242b88c607f55da3d0d0d336b49bf1e20412 upstream.
In usbhs_remove(), the driver frees resources (including the pipe array)
while the interrupt handler (usbhs_interrupt) is still registered. If an
interrupt fires after usbhs_pipe_remove() but before the driver is fully
unbound, the ISR may access freed memory, causing a use-after-free.
Fix this by calling devm_free_irq() before freeing resources. This ensures
the interrupt handler is both disabled and synchronized (waits for any
running ISR to complete) before usbhs_pipe_remove() is called.
Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
Cc: stable <stable@kernel.org>
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260303073344.34577-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/common.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -804,6 +804,15 @@ static int usbhs_remove(struct platform_
usbhs_platform_call(priv, hardware_exit, pdev);
reset_control_assert(priv->rsts);
+
+ /*
+ * Explicitly free the IRQ to ensure the interrupt handler is
+ * disabled and synchronized before freeing resources.
+ * devm_free_irq() calls free_irq() which waits for any running
+ * ISR to complete, preventing UAF.
+ */
+ devm_free_irq(&pdev->dev, priv->irq, priv);
+
usbhs_mod_remove(priv);
usbhs_fifo_remove(priv);
usbhs_pipe_remove(priv);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 103/491] usb: mdc800: handle signal and read racing
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 102/491] usb: renesas_usbhs: fix use-after-free in ISR during device removal Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 104/491] usb: image: mdc800: kill download URB on timeout Greg Kroah-Hartman
` (392 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 2d6d260e9a3576256fe9ef6d1f7930c9ec348723 upstream.
If a signal arrives after a read has partially completed,
we need to return the number of bytes read. -EINTR is correct
only if that number is zero.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209142048.1503791-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/image/mdc800.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/image/mdc800.c
+++ b/drivers/usb/image/mdc800.c
@@ -708,7 +708,7 @@ static ssize_t mdc800_device_read (struc
if (signal_pending (current))
{
mutex_unlock(&mdc800->io_lock);
- return -EINTR;
+ return len == left ? -EINTR : len-left;
}
sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 104/491] usb: image: mdc800: kill download URB on timeout
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 103/491] usb: mdc800: handle signal and read racing Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 105/491] mm/tracing: rss_stat: ensure curr is false from kthread context Greg Kroah-Hartman
` (391 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ziyi Guo, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/image/mdc800.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/image/mdc800.c
+++ b/drivers/usb/image/mdc800.c
@@ -731,9 +731,11 @@ static ssize_t mdc800_device_read (struc
mutex_unlock(&mdc800->io_lock);
return len-left;
}
- wait_event_timeout(mdc800->download_wait,
+ retval = wait_event_timeout(mdc800->download_wait,
mdc800->downloaded,
msecs_to_jiffies(TO_DOWNLOAD_GET_READY));
+ if (!retval)
+ usb_kill_urb(mdc800->download_urb);
mdc800->downloaded = 0;
if (mdc800->download_urb->status != 0)
{
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 105/491] mm/tracing: rss_stat: ensure curr is false from kthread context
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 104/491] usb: image: mdc800: kill download URB on timeout Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 106/491] mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() Greg Kroah-Hartman
` (390 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh Singh, Zi Yan, SeongJae Park,
Pedro Falcato, David Hildenbrand (Arm), Joel Fernandes,
Lorenzo Stoakes, Minchan Kim, Steven Rostedt, Suren Baghdasaryan,
Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh Singh <kaleshsingh@google.com>
commit 079c24d5690262e83ee476e2a548e416f3237511 upstream.
The rss_stat trace event allows userspace tools, like Perfetto [1], to
inspect per-process RSS metric changes over time.
The curr field was introduced to rss_stat in commit e4dcad204d3a
("rss_stat: add support to detect RSS updates of external mm"). Its
intent is to indicate whether the RSS update is for the mm_struct of the
current execution context; and is set to false when operating on a remote
mm_struct (e.g., via kswapd or a direct reclaimer).
However, an issue arises when a kernel thread temporarily adopts a user
process's mm_struct. Kernel threads do not have their own mm_struct and
normally have current->mm set to NULL. To operate on user memory, they
can "borrow" a memory context using kthread_use_mm(), which sets
current->mm to the user process's mm.
This can be observed, for example, in the USB Function Filesystem (FFS)
driver. The ffs_user_copy_worker() handles AIO completions and uses
kthread_use_mm() to copy data to a user-space buffer. If a page fault
occurs during this copy, the fault handler executes in the kthread's
context.
At this point, current is the kthread, but current->mm points to the user
process's mm. Since the rss_stat event (from the page fault) is for that
same mm, the condition current->mm == mm becomes true, causing curr to be
incorrectly set to true when the trace event is emitted.
This is misleading because it suggests the mm belongs to the kthread,
confusing userspace tools that track per-process RSS changes and
corrupting their mm_id-to-process association.
Fix this by ensuring curr is always false when the trace event is emitted
from a kthread context by checking for the PF_KTHREAD flag.
Link: https://lkml.kernel.org/r/20260219233708.1971199-1-kaleshsingh@google.com
Link: https://perfetto.dev/ [1]
Fixes: e4dcad204d3a ("rss_stat: add support to detect RSS updates of external mm")
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Acked-by: SeongJae Park <sj@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: "David Hildenbrand (Arm)" <david@kernel.org>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org> [5.10+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/kmem.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -352,7 +352,13 @@ TRACE_EVENT(rss_stat,
TP_fast_assign(
__entry->mm_id = mm_ptr_to_hash(mm);
- __entry->curr = !!(current->mm == mm);
+ /*
+ * curr is true if the mm matches the current task's mm_struct.
+ * Since kthreads (PF_KTHREAD) have no mm_struct of their own
+ * but can borrow one via kthread_use_mm(), we must filter them
+ * out to avoid incorrectly attributing the RSS update to them.
+ */
+ __entry->curr = current->mm == mm && !(current->flags & PF_KTHREAD);
__entry->member = member;
__entry->size = (count << PAGE_SHIFT);
),
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 106/491] mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 105/491] mm/tracing: rss_stat: ensure curr is false from kthread context Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 107/491] tipc: fix divide-by-zero in tipc_sk_filter_connect() Greg Kroah-Hartman
` (389 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
commit af12e64ae0661546e8b4f5d30d55c5f53a11efe7 upstream.
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In of_get_dml_pipe_index(), it does not release the reference.
Fixes: 9cb15142d0e3 ("mmc: mmci: Add qcom dml support to the driver.")
Signed-off-by: Felix Gu <gu_0233@qq.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/mmci_qcom_dml.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mmc/host/mmci_qcom_dml.c
+++ b/drivers/mmc/host/mmci_qcom_dml.c
@@ -109,6 +109,7 @@ static int of_get_dml_pipe_index(struct
&dma_spec))
return -ENODEV;
+ of_node_put(dma_spec.np);
if (dma_spec.args_count)
return dma_spec.args[0];
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 107/491] tipc: fix divide-by-zero in tipc_sk_filter_connect()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 106/491] mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 108/491] libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() Greg Kroah-Hartman
` (388 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mehul Rao, Tung Nguyen,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehul Rao <mehulrao@gmail.com>
commit 6c5a9baa15de240e747263aba435a0951da8d8d2 upstream.
A user can set conn_timeout to any value via
setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a
SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in
tipc_sk_filter_connect() executes:
delay %= (tsk->conn_timeout / 4);
If conn_timeout is in the range [0, 3], the integer division yields 0,
and the modulo operation triggers a divide-by-zero exception, causing a
kernel oops/panic.
Fix this by clamping conn_timeout to a minimum of 4 at the point of use
in tipc_sk_filter_connect().
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+
RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)
Call Trace:
tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)
__release_sock (include/net/sock.h:1185 net/core/sock.c:3213)
release_sock (net/core/sock.c:3797)
tipc_connect (net/tipc/socket.c:2570)
__sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket")
Cc: stable@vger.kernel.org
Signed-off-by: Mehul Rao <mehulrao@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/socket.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2233,6 +2233,8 @@ static bool tipc_sk_filter_connect(struc
if (skb_queue_empty(&sk->sk_write_queue))
break;
get_random_bytes(&delay, 2);
+ if (tsk->conn_timeout < 4)
+ tsk->conn_timeout = 4;
delay %= (tsk->conn_timeout / 4);
delay = msecs_to_jiffies(delay + 100);
sk_reset_timer(sk, &sk->sk_timer, jiffies + delay);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 108/491] libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 107/491] tipc: fix divide-by-zero in tipc_sk_filter_connect() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 109/491] ceph: fix i_nlink underrun during async unlink Greg Kroah-Hartman
` (387 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raphael Zimmer, Viacheslav Dubeyko,
Ilya Dryomov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
commit b282c43ed156ae15ea76748fc15cd5c39dc9ab72 upstream.
This patch fixes an out-of-bounds access in ceph_handle_auth_reply()
that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In
ceph_handle_auth_reply(), the value of the payload_len field of such a
message is stored in a variable of type int. A value greater than
INT_MAX leads to an integer overflow and is interpreted as a negative
value. This leads to decrementing the pointer address by this value and
subsequently accessing it because ceph_decode_need() only checks that
the memory access does not exceed the end address of the allocation.
This patch fixes the issue by changing the data type of payload_len to
u32. Additionally, the data type of result_msg_len is changed to u32,
as it is also a variable holding a non-negative length.
Also, an additional layer of sanity checks is introduced, ensuring that
directly after reading it from the message, payload_len and
result_msg_len are not greater than the overall segment length.
BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]
Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262
CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: ceph-msgr ceph_con_workfn [libceph]
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0
print_report+0xd1/0x620
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? kasan_complete_mode_report_info+0x72/0x210
kasan_report+0xe7/0x130
? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
__asan_report_load_n_noabort+0xf/0x20
ceph_handle_auth_reply+0x642/0x7a0 [libceph]
mon_dispatch+0x973/0x23d0 [libceph]
? apparmor_socket_recvmsg+0x6b/0xa0
? __pfx_mon_dispatch+0x10/0x10 [libceph]
? __kasan_check_write+0x14/0x30i
? mutex_unlock+0x7f/0xd0
? __pfx_mutex_unlock+0x10/0x10
? __pfx_do_recvmsg+0x10/0x10 [libceph]
ceph_con_process_message+0x1f1/0x650 [libceph]
process_message+0x1e/0x450 [libceph]
ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]
? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]
? save_fpregs_to_fpstate+0xb0/0x230
? raw_spin_rq_unlock+0x17/0xa0
? finish_task_switch.isra.0+0x13b/0x760
? __switch_to+0x385/0xda0
? __kasan_check_write+0x14/0x30
? mutex_lock+0x8d/0xe0
? __pfx_mutex_lock+0x10/0x10
ceph_con_workfn+0x248/0x10c0 [libceph]
process_one_work+0x629/0xf80
? __kasan_check_write+0x14/0x30
worker_thread+0x87f/0x1570
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx_try_to_wake_up+0x10/0x10
? kasan_print_address_stack_frame+0x1f7/0x280
? __pfx_worker_thread+0x10/0x10
kthread+0x396/0x830
? __pfx__raw_spin_lock_irq+0x10/0x10
? __pfx_kthread+0x10/0x10
? __kasan_check_write+0x14/0x30
? recalc_sigpending+0x180/0x210
? __pfx_kthread+0x10/0x10
ret_from_fork+0x3f7/0x610
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x385/0xda0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
[ idryomov: replace if statements with ceph_decode_need() for
payload_len and result_msg_len ]
Cc: stable@vger.kernel.org
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/auth.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/ceph/auth.c
+++ b/net/ceph/auth.c
@@ -185,9 +185,9 @@ int ceph_handle_auth_reply(struct ceph_a
s32 result;
u64 global_id;
void *payload, *payload_end;
- int payload_len;
+ u32 payload_len;
char *result_msg;
- int result_msg_len;
+ u32 result_msg_len;
int ret = -EINVAL;
mutex_lock(&ac->mutex);
@@ -197,10 +197,12 @@ int ceph_handle_auth_reply(struct ceph_a
result = ceph_decode_32(&p);
global_id = ceph_decode_64(&p);
payload_len = ceph_decode_32(&p);
+ ceph_decode_need(&p, end, payload_len, bad);
payload = p;
p += payload_len;
ceph_decode_need(&p, end, sizeof(u32), bad);
result_msg_len = ceph_decode_32(&p);
+ ceph_decode_need(&p, end, result_msg_len, bad);
result_msg = p;
p += result_msg_len;
if (p != end)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 109/491] ceph: fix i_nlink underrun during async unlink
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 108/491] libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 110/491] time: add kernel-doc in time.c Greg Kroah-Hartman
` (386 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, Viacheslav Dubeyko,
Ilya Dryomov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit ce0123cbb4a40a2f1bbb815f292b26e96088639f upstream.
During async unlink, we drop the `i_nlink` counter before we receive
the completion (that will eventually update the `i_nlink`) because "we
assume that the unlink will succeed". That is not a bad idea, but it
races against deletions by other clients (or against the completion of
our own unlink) and can lead to an underrun which emits a WARNING like
this one:
WARNING: CPU: 85 PID: 25093 at fs/inode.c:407 drop_nlink+0x50/0x68
Modules linked in:
CPU: 85 UID: 3221252029 PID: 25093 Comm: php-cgi8.1 Not tainted 6.14.11-cm4all1-ampere #655
Hardware name: Supermicro ARS-110M-NR/R12SPD-A, BIOS 1.1b 10/17/2023
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drop_nlink+0x50/0x68
lr : ceph_unlink+0x6c4/0x720
sp : ffff80012173bc90
x29: ffff80012173bc90 x28: ffff086d0a45aaf8 x27: ffff0871d0eb5680
x26: ffff087f2a64a718 x25: 0000020000000180 x24: 0000000061c88647
x23: 0000000000000002 x22: ffff07ff9236d800 x21: 0000000000001203
x20: ffff07ff9237b000 x19: ffff088b8296afc0 x18: 00000000f3c93365
x17: 0000000000070000 x16: ffff08faffcbdfe8 x15: ffff08faffcbdfec
x14: 0000000000000000 x13: 45445f65645f3037 x12: 34385f6369706f74
x11: 0000a2653104bb20 x10: ffffd85f26d73290 x9 : ffffd85f25664f94
x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000002
x5 : 0000000000000081 x4 : 0000000000000481 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff08727d3f91e8
Call trace:
drop_nlink+0x50/0x68 (P)
vfs_unlink+0xb0/0x2e8
do_unlinkat+0x204/0x288
__arm64_sys_unlinkat+0x3c/0x80
invoke_syscall.constprop.0+0x54/0xe8
do_el0_svc+0xa4/0xc8
el0_svc+0x18/0x58
el0t_64_sync_handler+0x104/0x130
el0t_64_sync+0x154/0x158
In ceph_unlink(), a call to ceph_mdsc_submit_request() submits the
CEPH_MDS_OP_UNLINK to the MDS, but does not wait for completion.
Meanwhile, between this call and the following drop_nlink() call, a
worker thread may process a CEPH_CAP_OP_IMPORT, CEPH_CAP_OP_GRANT or
just a CEPH_MSG_CLIENT_REPLY (the latter of which could be our own
completion). These will lead to a set_nlink() call, updating the
`i_nlink` counter to the value received from the MDS. If that new
`i_nlink` value happens to be zero, it is illegal to decrement it
further. But that is exactly what ceph_unlink() will do then.
The WARNING can be reproduced this way:
1. Force async unlink; only the async code path is affected. Having
no real clue about Ceph internals, I was unable to find out why the
MDS wouldn't give me the "Fxr" capabilities, so I patched
get_caps_for_async_unlink() to always succeed.
(Note that the WARNING dump above was found on an unpatched kernel,
without this kludge - this is not a theoretical bug.)
2. Add a sleep call after ceph_mdsc_submit_request() so the unlink
completion gets handled by a worker thread before drop_nlink() is
called. This guarantees that the `i_nlink` is already zero before
drop_nlink() runs.
The solution is to skip the counter decrement when it is already zero,
but doing so without a lock is still racy (TOCTOU). Since
ceph_fill_inode() and handle_cap_grant() both hold the
`ceph_inode_info.i_ceph_lock` spinlock while set_nlink() runs, this
seems like the proper lock to protect the `i_nlink` updates.
I found prior art in NFS and SMB (using `inode.i_lock`) and AFS (using
`afs_vnode.cb_lock`). All three have the zero check as well.
Cc: stable@vger.kernel.org
Fixes: 2ccb45462aea ("ceph: perform asynchronous unlink if we have sufficient caps")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/dir.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1129,6 +1129,7 @@ static int ceph_unlink(struct inode *dir
struct ceph_fs_client *fsc = ceph_sb_to_client(dir->i_sb);
struct ceph_mds_client *mdsc = fsc->mdsc;
struct inode *inode = d_inode(dentry);
+ struct ceph_inode_info *ci = ceph_inode(inode);
struct ceph_mds_request *req;
bool try_async = ceph_test_mount_opt(fsc, ASYNC_DIROPS);
int err = -EROFS;
@@ -1173,7 +1174,19 @@ retry:
* We have enough caps, so we assume that the unlink
* will succeed. Fix up the target inode and dcache.
*/
- drop_nlink(inode);
+
+ /*
+ * Protect the i_nlink update with i_ceph_lock
+ * to precent racing against ceph_fill_inode()
+ * handling our completion on a worker thread
+ * and don't decrement if i_nlink has already
+ * been updated to zero by this completion.
+ */
+ spin_lock(&ci->i_ceph_lock);
+ if (inode->i_nlink > 0)
+ drop_nlink(inode);
+ spin_unlock(&ci->i_ceph_lock);
+
d_delete(dentry);
} else if (err == -EJUKEBOX) {
try_async = false;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 110/491] time: add kernel-doc in time.c
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 109/491] ceph: fix i_nlink underrun during async unlink Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 111/491] time/jiffies: Mark jiffies_64_to_clock_t() notrace Greg Kroah-Hartman
` (385 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, John Stultz,
Thomas Gleixner, Stephen Boyd, Jonathan Corbet, linux-doc,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 67b3f564cb1e769ef8e45835129a4866152fcfdb ]
Add kernel-doc for all APIs that do not already have it.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: John Stultz <jstultz@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: linux-doc@vger.kernel.org
Acked-by: John Stultz <jstultz@google.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/20230704052405.5089-3-rdunlap@infradead.org
Stable-dep-of: 755a648e78f1 ("time/jiffies: Mark jiffies_64_to_clock_t() notrace")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/time.c | 169 ++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 158 insertions(+), 11 deletions(-)
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 483f8a3e24d0c..6f81aead1856d 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -365,11 +365,14 @@ SYSCALL_DEFINE1(adjtimex_time32, struct old_timex32 __user *, utp)
}
#endif
-/*
- * Convert jiffies to milliseconds and back.
+/**
+ * jiffies_to_msecs - Convert jiffies to milliseconds
+ * @j: jiffies value
*
* Avoid unnecessary multiplications/divisions in the
- * two most common HZ cases:
+ * two most common HZ cases.
+ *
+ * Return: milliseconds value
*/
unsigned int jiffies_to_msecs(const unsigned long j)
{
@@ -388,6 +391,12 @@ unsigned int jiffies_to_msecs(const unsigned long j)
}
EXPORT_SYMBOL(jiffies_to_msecs);
+/**
+ * jiffies_to_usecs - Convert jiffies to microseconds
+ * @j: jiffies value
+ *
+ * Return: microseconds value
+ */
unsigned int jiffies_to_usecs(const unsigned long j)
{
/*
@@ -408,8 +417,15 @@ unsigned int jiffies_to_usecs(const unsigned long j)
}
EXPORT_SYMBOL(jiffies_to_usecs);
-/*
+/**
* mktime64 - Converts date to seconds.
+ * @year0: year to convert
+ * @mon0: month to convert
+ * @day: day to convert
+ * @hour: hour to convert
+ * @min: minute to convert
+ * @sec: second to convert
+ *
* Converts Gregorian date to seconds since 1970-01-01 00:00:00.
* Assumes input in normal date format, i.e. 1980-12-31 23:59:59
* => year=1980, mon=12, day=31, hour=23, min=59, sec=59.
@@ -427,6 +443,8 @@ EXPORT_SYMBOL(jiffies_to_usecs);
*
* An encoding of midnight at the end of the day as 24:00:00 - ie. midnight
* tomorrow - (allowable under ISO 8601) is supported.
+ *
+ * Return: seconds since the epoch time for the given input date
*/
time64_t mktime64(const unsigned int year0, const unsigned int mon0,
const unsigned int day, const unsigned int hour,
@@ -471,8 +489,7 @@ EXPORT_SYMBOL(ns_to_kernel_old_timeval);
* Set seconds and nanoseconds field of a timespec variable and
* normalize to the timespec storage format
*
- * Note: The tv_nsec part is always in the range of
- * 0 <= tv_nsec < NSEC_PER_SEC
+ * Note: The tv_nsec part is always in the range of 0 <= tv_nsec < NSEC_PER_SEC.
* For negative values only the tv_sec field is negative !
*/
void set_normalized_timespec64(struct timespec64 *ts, time64_t sec, s64 nsec)
@@ -501,7 +518,7 @@ EXPORT_SYMBOL(set_normalized_timespec64);
* ns_to_timespec64 - Convert nanoseconds to timespec64
* @nsec: the nanoseconds value to be converted
*
- * Returns the timespec64 representation of the nsec parameter.
+ * Return: the timespec64 representation of the nsec parameter.
*/
struct timespec64 ns_to_timespec64(const s64 nsec)
{
@@ -548,6 +565,8 @@ EXPORT_SYMBOL(ns_to_timespec64);
* runtime.
* the _msecs_to_jiffies helpers are the HZ dependent conversion
* routines found in include/linux/jiffies.h
+ *
+ * Return: jiffies value
*/
unsigned long __msecs_to_jiffies(const unsigned int m)
{
@@ -560,6 +579,12 @@ unsigned long __msecs_to_jiffies(const unsigned int m)
}
EXPORT_SYMBOL(__msecs_to_jiffies);
+/**
+ * __usecs_to_jiffies: - convert microseconds to jiffies
+ * @u: time in milliseconds
+ *
+ * Return: jiffies value
+ */
unsigned long __usecs_to_jiffies(const unsigned int u)
{
if (u > jiffies_to_usecs(MAX_JIFFY_OFFSET))
@@ -568,7 +593,10 @@ unsigned long __usecs_to_jiffies(const unsigned int u)
}
EXPORT_SYMBOL(__usecs_to_jiffies);
-/*
+/**
+ * timespec64_to_jiffies - convert a timespec64 value to jiffies
+ * @value: pointer to &struct timespec64
+ *
* The TICK_NSEC - 1 rounds up the value to the next resolution. Note
* that a remainder subtract here would not do the right thing as the
* resolution values don't fall on second boundries. I.e. the line:
@@ -582,8 +610,9 @@ EXPORT_SYMBOL(__usecs_to_jiffies);
*
* The >> (NSEC_JIFFIE_SC - SEC_JIFFIE_SC) converts the scaled nsec
* value to a scaled second value.
+ *
+ * Return: jiffies value
*/
-
unsigned long
timespec64_to_jiffies(const struct timespec64 *value)
{
@@ -601,6 +630,11 @@ timespec64_to_jiffies(const struct timespec64 *value)
}
EXPORT_SYMBOL(timespec64_to_jiffies);
+/**
+ * jiffies_to_timespec64 - convert jiffies value to &struct timespec64
+ * @jiffies: jiffies value
+ * @value: pointer to &struct timespec64
+ */
void
jiffies_to_timespec64(const unsigned long jiffies, struct timespec64 *value)
{
@@ -618,6 +652,13 @@ EXPORT_SYMBOL(jiffies_to_timespec64);
/*
* Convert jiffies/jiffies_64 to clock_t and back.
*/
+
+/**
+ * jiffies_to_clock_t - Convert jiffies to clock_t
+ * @x: jiffies value
+ *
+ * Return: jiffies converted to clock_t (CLOCKS_PER_SEC)
+ */
clock_t jiffies_to_clock_t(unsigned long x)
{
#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
@@ -632,6 +673,12 @@ clock_t jiffies_to_clock_t(unsigned long x)
}
EXPORT_SYMBOL(jiffies_to_clock_t);
+/**
+ * clock_t_to_jiffies - Convert clock_t to jiffies
+ * @x: clock_t value
+ *
+ * Return: clock_t value converted to jiffies
+ */
unsigned long clock_t_to_jiffies(unsigned long x)
{
#if (HZ % USER_HZ)==0
@@ -649,6 +696,12 @@ unsigned long clock_t_to_jiffies(unsigned long x)
}
EXPORT_SYMBOL(clock_t_to_jiffies);
+/**
+ * jiffies_64_to_clock_t - Convert jiffies_64 to clock_t
+ * @x: jiffies_64 value
+ *
+ * Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC)
+ */
u64 jiffies_64_to_clock_t(u64 x)
{
#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
@@ -671,6 +724,12 @@ u64 jiffies_64_to_clock_t(u64 x)
}
EXPORT_SYMBOL(jiffies_64_to_clock_t);
+/**
+ * nsec_to_clock_t - Convert nsec value to clock_t
+ * @x: nsec value
+ *
+ * Return: nsec value converted to 64-bit "clock_t" (CLOCKS_PER_SEC)
+ */
u64 nsec_to_clock_t(u64 x)
{
#if (NSEC_PER_SEC % USER_HZ) == 0
@@ -687,6 +746,12 @@ u64 nsec_to_clock_t(u64 x)
#endif
}
+/**
+ * jiffies64_to_nsecs - Convert jiffies64 to nanoseconds
+ * @j: jiffies64 value
+ *
+ * Return: nanoseconds value
+ */
u64 jiffies64_to_nsecs(u64 j)
{
#if !(NSEC_PER_SEC % HZ)
@@ -697,6 +762,12 @@ u64 jiffies64_to_nsecs(u64 j)
}
EXPORT_SYMBOL(jiffies64_to_nsecs);
+/**
+ * jiffies64_to_msecs - Convert jiffies64 to milliseconds
+ * @j: jiffies64 value
+ *
+ * Return: milliseconds value
+ */
u64 jiffies64_to_msecs(const u64 j)
{
#if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
@@ -719,6 +790,8 @@ EXPORT_SYMBOL(jiffies64_to_msecs);
* note:
* NSEC_PER_SEC = 10^9 = (5^9 * 2^9) = (1953125 * 512)
* ULLONG_MAX ns = 18446744073.709551615 secs = about 584 years
+ *
+ * Return: nsecs converted to jiffies64 value
*/
u64 nsecs_to_jiffies64(u64 n)
{
@@ -750,6 +823,8 @@ EXPORT_SYMBOL(nsecs_to_jiffies64);
* note:
* NSEC_PER_SEC = 10^9 = (5^9 * 2^9) = (1953125 * 512)
* ULLONG_MAX ns = 18446744073.709551615 secs = about 584 years
+ *
+ * Return: nsecs converted to jiffies value
*/
unsigned long nsecs_to_jiffies(u64 n)
{
@@ -757,10 +832,16 @@ unsigned long nsecs_to_jiffies(u64 n)
}
EXPORT_SYMBOL_GPL(nsecs_to_jiffies);
-/*
- * Add two timespec64 values and do a safety check for overflow.
+/**
+ * timespec64_add_safe - Add two timespec64 values and do a safety check
+ * for overflow.
+ * @lhs: first (left) timespec64 to add
+ * @rhs: second (right) timespec64 to add
+ *
* It's assumed that both values are valid (>= 0).
* And, each timespec64 is in normalized form.
+ *
+ * Return: sum of @lhs + @rhs
*/
struct timespec64 timespec64_add_safe(const struct timespec64 lhs,
const struct timespec64 rhs)
@@ -778,6 +859,15 @@ struct timespec64 timespec64_add_safe(const struct timespec64 lhs,
return res;
}
+/**
+ * get_timespec64 - get user's time value into kernel space
+ * @ts: destination &struct timespec64
+ * @uts: user's time value as &struct __kernel_timespec
+ *
+ * Handles compat or 32-bit modes.
+ *
+ * Return: %0 on success or negative errno on error
+ */
int get_timespec64(struct timespec64 *ts,
const struct __kernel_timespec __user *uts)
{
@@ -801,6 +891,14 @@ int get_timespec64(struct timespec64 *ts,
}
EXPORT_SYMBOL_GPL(get_timespec64);
+/**
+ * put_timespec64 - convert timespec64 value to __kernel_timespec format and
+ * copy the latter to userspace
+ * @ts: input &struct timespec64
+ * @uts: user's &struct __kernel_timespec
+ *
+ * Return: %0 on success or negative errno on error
+ */
int put_timespec64(const struct timespec64 *ts,
struct __kernel_timespec __user *uts)
{
@@ -839,6 +937,15 @@ static int __put_old_timespec32(const struct timespec64 *ts64,
return copy_to_user(cts, &ts, sizeof(ts)) ? -EFAULT : 0;
}
+/**
+ * get_old_timespec32 - get user's old-format time value into kernel space
+ * @ts: destination &struct timespec64
+ * @uts: user's old-format time value (&struct old_timespec32)
+ *
+ * Handles X86_X32_ABI compatibility conversion.
+ *
+ * Return: %0 on success or negative errno on error
+ */
int get_old_timespec32(struct timespec64 *ts, const void __user *uts)
{
if (COMPAT_USE_64BIT_TIME)
@@ -848,6 +955,16 @@ int get_old_timespec32(struct timespec64 *ts, const void __user *uts)
}
EXPORT_SYMBOL_GPL(get_old_timespec32);
+/**
+ * put_old_timespec32 - convert timespec64 value to &struct old_timespec32 and
+ * copy the latter to userspace
+ * @ts: input &struct timespec64
+ * @uts: user's &struct old_timespec32
+ *
+ * Handles X86_X32_ABI compatibility conversion.
+ *
+ * Return: %0 on success or negative errno on error
+ */
int put_old_timespec32(const struct timespec64 *ts, void __user *uts)
{
if (COMPAT_USE_64BIT_TIME)
@@ -857,6 +974,13 @@ int put_old_timespec32(const struct timespec64 *ts, void __user *uts)
}
EXPORT_SYMBOL_GPL(put_old_timespec32);
+/**
+ * get_itimerspec64 - get user's &struct __kernel_itimerspec into kernel space
+ * @it: destination &struct itimerspec64
+ * @uit: user's &struct __kernel_itimerspec
+ *
+ * Return: %0 on success or negative errno on error
+ */
int get_itimerspec64(struct itimerspec64 *it,
const struct __kernel_itimerspec __user *uit)
{
@@ -872,6 +996,14 @@ int get_itimerspec64(struct itimerspec64 *it,
}
EXPORT_SYMBOL_GPL(get_itimerspec64);
+/**
+ * put_itimerspec64 - convert &struct itimerspec64 to __kernel_itimerspec format
+ * and copy the latter to userspace
+ * @it: input &struct itimerspec64
+ * @uit: user's &struct __kernel_itimerspec
+ *
+ * Return: %0 on success or negative errno on error
+ */
int put_itimerspec64(const struct itimerspec64 *it,
struct __kernel_itimerspec __user *uit)
{
@@ -887,6 +1019,13 @@ int put_itimerspec64(const struct itimerspec64 *it,
}
EXPORT_SYMBOL_GPL(put_itimerspec64);
+/**
+ * get_old_itimerspec32 - get user's &struct old_itimerspec32 into kernel space
+ * @its: destination &struct itimerspec64
+ * @uits: user's &struct old_itimerspec32
+ *
+ * Return: %0 on success or negative errno on error
+ */
int get_old_itimerspec32(struct itimerspec64 *its,
const struct old_itimerspec32 __user *uits)
{
@@ -898,6 +1037,14 @@ int get_old_itimerspec32(struct itimerspec64 *its,
}
EXPORT_SYMBOL_GPL(get_old_itimerspec32);
+/**
+ * put_old_itimerspec32 - convert &struct itimerspec64 to &struct
+ * old_itimerspec32 and copy the latter to userspace
+ * @its: input &struct itimerspec64
+ * @uits: user's &struct old_itimerspec32
+ *
+ * Return: %0 on success or negative errno on error
+ */
int put_old_itimerspec32(const struct itimerspec64 *its,
struct old_itimerspec32 __user *uits)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 111/491] time/jiffies: Mark jiffies_64_to_clock_t() notrace
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 110/491] time: add kernel-doc in time.c Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 112/491] irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports Greg Kroah-Hartman
` (384 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt (Google),
Thomas Gleixner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
[ Upstream commit 755a648e78f12574482d4698d877375793867fa1 ]
The trace_clock_jiffies() function that handles the "uptime" clock for
tracing calls jiffies_64_to_clock_t(). This causes the function tracer to
constantly recurse when the tracing clock is set to "uptime". Mark it
notrace to prevent unnecessary recursion when using the "uptime" clock.
Fixes: 58d4e21e50ff3 ("tracing: Fix wraparound problems in "uptime" trace clock")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260306212403.72270bb2@robin
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/time.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 6f81aead1856d..37c381607f372 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -702,7 +702,7 @@ EXPORT_SYMBOL(clock_t_to_jiffies);
*
* Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC)
*/
-u64 jiffies_64_to_clock_t(u64 x)
+notrace u64 jiffies_64_to_clock_t(u64 x)
{
#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
# if HZ < USER_HZ
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 112/491] irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 111/491] time/jiffies: Mark jiffies_64_to_clock_t() notrace Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 113/491] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie Greg Kroah-Hartman
` (383 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Thomas Gleixner,
Robin Murphy, Zenghui Yu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit ce9e40a9a5e5cff0b1b0d2fa582b3d71a8ce68e8 upstream.
The ITS driver blindly assumes that EventIDs are in abundant supply, to the
point where it never checks how many the hardware actually supports.
It turns out that some pretty esoteric integrations make it so that only a
few bits are available, all the way down to a single bit.
Enforce the advertised limitation at the point of allocating the device
structure, and hope that the endpoint driver can deal with such limitation.
Fixes: 84a6a2e7fc18d ("irqchip: GICv3: ITS: device allocation and configuration")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260206154816.3582887-1-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-gic-v3-its.c | 4 ++++
include/linux/irqchip/arm-gic-v3.h | 1 +
2 files changed, 5 insertions(+)
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3382,6 +3382,7 @@ static struct its_device *its_create_dev
int lpi_base;
int nr_lpis;
int nr_ites;
+ int id_bits;
int sz;
if (!its_alloc_device_table(its, dev_id))
@@ -3394,7 +3395,10 @@ static struct its_device *its_create_dev
/*
* Even if the device wants a single LPI, the ITT must be
* sized as a power of two (and you need at least one bit...).
+ * Also honor the ITS's own EID limit.
*/
+ id_bits = FIELD_GET(GITS_TYPER_IDBITS, its->typer) + 1;
+ nvecs = min_t(unsigned int, nvecs, BIT(id_bits));
nr_ites = max(2, nvecs);
sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -392,6 +392,7 @@
#define GITS_TYPER_VLPIS (1UL << 1)
#define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4
#define GITS_TYPER_ITT_ENTRY_SIZE GENMASK_ULL(7, 4)
+#define GITS_TYPER_IDBITS GENMASK_ULL(12, 8)
#define GITS_TYPER_IDBITS_SHIFT 8
#define GITS_TYPER_DEVBITS_SHIFT 13
#define GITS_TYPER_DEVBITS GENMASK_ULL(17, 13)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 113/491] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 112/491] irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 114/491] staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Greg Kroah-Hartman
` (382 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Dan Carpenter
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luka Gejak <luka.gejak@linux.dev>
commit a75281626fc8fa6dc6c9cc314ee423e8bc45203b upstream.
The current code checks 'i + 5 < in_len' at the end of the if statement.
However, it accesses 'in_ie[i + 5]' before that check, which can lead
to an out-of-bounds read. Move the length check to the beginning of the
conditional to ensure the index is within bounds before accessing the
array.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20260224132647.11642-2-luka.gejak@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -2257,7 +2257,10 @@ int rtw_restruct_wmm_ie(struct adapter *
while (i < in_len) {
ielength = initial_out_len;
- if (in_ie[i] == 0xDD && in_ie[i+2] == 0x00 && in_ie[i+3] == 0x50 && in_ie[i+4] == 0xF2 && in_ie[i+5] == 0x02 && i+5 < in_len) { /* WMM element ID and OUI */
+ if (i + 5 < in_len &&
+ in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
+ in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
+ in_ie[i + 5] == 0x02) {
for (j = i; j < i + 9; j++) {
out_ie[ielength] = in_ie[j];
ielength++;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 114/491] staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 113/491] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie Greg Kroah-Hartman
@ 2026-04-13 15:55 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 115/491] media: dvb-net: fix OOB access in ULE extension header tables Greg Kroah-Hartman
` (381 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Navaneeth K
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f0109b9d3e1e455429279d602f6276e34689750a upstream.
Just like in commit 154828bf9559 ("staging: rtl8723bs: fix out-of-bounds
read in rtw_get_ie() parser"), we don't trust the data in the frame so
we should check the length better before acting on it
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Tested-by: Navaneeth K <knavaneeth786@gmail.com>
Reviewed-by: Navaneeth K <knavaneeth786@gmail.com>
Link: https://patch.msgid.link/2026022336-arrange-footwork-6e54@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -194,21 +194,25 @@ u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len
cnt = 0;
- while (cnt < in_len) {
+ while (cnt + 2 <= in_len) {
+ u8 ie_len = in_ie[cnt + 1];
+
+ if (cnt + 2 + ie_len > in_len)
+ break;
+
if (eid == in_ie[cnt]
- && (!oui || !memcmp(&in_ie[cnt+2], oui, oui_len))) {
+ && (!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) {
target_ie = &in_ie[cnt];
if (ie)
- memcpy(ie, &in_ie[cnt], in_ie[cnt+1]+2);
+ memcpy(ie, &in_ie[cnt], ie_len + 2);
if (ielen)
- *ielen = in_ie[cnt+1]+2;
+ *ielen = ie_len + 2;
break;
- } else {
- cnt += in_ie[cnt+1]+2; /* goto next */
}
+ cnt += ie_len + 2; /* goto next */
}
return target_ie;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 115/491] media: dvb-net: fix OOB access in ULE extension header tables
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-04-13 15:55 ` [PATCH 5.10 114/491] staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 116/491] batman-adv: Avoid double-rtnl_lock ELP metric worker Greg Kroah-Hartman
` (380 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ariel Silver, Mauro Carvalho Chehab
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariel Silver <arielsilver77@gmail.com>
commit 24d87712727a5017ad142d63940589a36cd25647 upstream.
The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables
in handle_one_ule_extension() are declared with 255 elements (valid
indices 0-254), but the index htype is derived from network-controlled
data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When
htype equals 255, an out-of-bounds read occurs on the function pointer
table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table
is accessed. Out-of-range values now cause the SNDU to be discarded.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-core/dvb_net.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -228,6 +228,9 @@ static int handle_one_ule_extension( str
unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8;
unsigned char htype = p->ule_sndu_type & 0x00FF;
+ if (htype >= ARRAY_SIZE(ule_mandatory_ext_handlers))
+ return -1;
+
/* Discriminate mandatory and optional extension headers. */
if (hlen == 0) {
/* Mandatory extension header */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 116/491] batman-adv: Avoid double-rtnl_lock ELP metric worker
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 115/491] media: dvb-net: fix OOB access in ULE extension header tables Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 117/491] parisc: Increase initial mapping to 64 MB with KALLSYMS Greg Kroah-Hartman
` (379 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Schmidbauer,
Sven Eckelmann, Sören Skaarup, Simon Wunderlich
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit cfc83a3c71517b59c1047db57da31e26a9dc2f33 upstream.
batadv_v_elp_get_throughput() might be called when the RTNL lock is already
held. This could be problematic when the work queue item is cancelled via
cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,
an rtnl_lock() would cause a deadlock.
To avoid this, rtnl_trylock() was used in this function to skip the
retrieval of the ethtool information in case the RTNL lock was already
held.
But for cfg80211 interfaces, batadv_get_real_netdev() was called - which
also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must
also be used instead and the lockless version __batadv_get_real_netdev()
has to be called.
Cc: stable@vger.kernel.org
Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker")
Reported-by: Christian Schmidbauer <github@grische.xyz>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Tested-by: Sören Skaarup <freifunk_nordm4nn@gmx.de>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_v_elp.c | 10 +++++++++-
net/batman-adv/hard-interface.c | 8 ++++----
net/batman-adv/hard-interface.h | 1 +
3 files changed, 14 insertions(+), 5 deletions(-)
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -113,7 +113,15 @@ static bool batadv_v_elp_get_throughput(
/* unsupported WiFi driver version */
goto default_throughput;
- real_netdev = batadv_get_real_netdev(hard_iface->net_dev);
+ /* only use rtnl_trylock because the elp worker will be cancelled while
+ * the rntl_lock is held. the cancel_delayed_work_sync() would otherwise
+ * wait forever when the elp work_item was started and it is then also
+ * trying to rtnl_lock
+ */
+ if (!rtnl_trylock())
+ return false;
+ real_netdev = __batadv_get_real_netdev(hard_iface->net_dev);
+ rtnl_unlock();
if (!real_netdev)
goto default_throughput;
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -204,7 +204,7 @@ static bool batadv_is_valid_iface(const
}
/**
- * batadv_get_real_netdevice() - check if the given netdev struct is a virtual
+ * __batadv_get_real_netdev() - check if the given netdev struct is a virtual
* interface on top of another 'real' interface
* @netdev: the device to check
*
@@ -214,7 +214,7 @@ static bool batadv_is_valid_iface(const
* Return: the 'real' net device or the original net device and NULL in case
* of an error.
*/
-static struct net_device *batadv_get_real_netdevice(struct net_device *netdev)
+struct net_device *__batadv_get_real_netdev(struct net_device *netdev)
{
struct batadv_hard_iface *hard_iface = NULL;
struct net_device *real_netdev = NULL;
@@ -268,7 +268,7 @@ struct net_device *batadv_get_real_netde
struct net_device *real_netdev;
rtnl_lock();
- real_netdev = batadv_get_real_netdevice(net_device);
+ real_netdev = __batadv_get_real_netdev(net_device);
rtnl_unlock();
return real_netdev;
@@ -335,7 +335,7 @@ static u32 batadv_wifi_flags_evaluate(st
if (batadv_is_cfg80211_netdev(net_device))
wifi_flags |= BATADV_HARDIF_WIFI_CFG80211_DIRECT;
- real_netdev = batadv_get_real_netdevice(net_device);
+ real_netdev = __batadv_get_real_netdev(net_device);
if (!real_netdev)
return wifi_flags;
--- a/net/batman-adv/hard-interface.h
+++ b/net/batman-adv/hard-interface.h
@@ -91,6 +91,7 @@ enum batadv_hard_if_cleanup {
extern struct notifier_block batadv_hard_if_notifier;
+struct net_device *__batadv_get_real_netdev(struct net_device *net_device);
struct net_device *batadv_get_real_netdev(struct net_device *net_device);
bool batadv_is_cfg80211_hardif(struct batadv_hard_iface *hard_iface);
bool batadv_is_wifi_hardif(struct batadv_hard_iface *hard_iface);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 117/491] parisc: Increase initial mapping to 64 MB with KALLSYMS
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 116/491] batman-adv: Avoid double-rtnl_lock ELP metric worker Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 118/491] nouveau/dpcd: return EBUSY for aux xfer if the device is asleep Greg Kroah-Hartman
` (378 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 8e732934fb81282be41602550e7e07baf265e972 upstream.
The 32MB initial kernel mapping can become too small when CONFIG_KALLSYMS
is used. Increase the mapping to 64 MB in this case.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v6.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -109,7 +109,7 @@ extern void __update_cache(pte_t pte);
printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, (unsigned long)pgd_val(e))
/* This is the size of the initially mapped kernel memory */
-#if defined(CONFIG_64BIT)
+#if defined(CONFIG_64BIT) || defined(CONFIG_KALLSYMS)
#define KERNEL_INITIAL_ORDER 26 /* 1<<26 = 64MB */
#else
#define KERNEL_INITIAL_ORDER 25 /* 1<<25 = 32MB */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 118/491] nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 117/491] parisc: Increase initial mapping to 64 MB with KALLSYMS Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 119/491] parisc: Fix initial page table creation for boot Greg Kroah-Hartman
` (377 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lyude Paul, Dave Airlie,
Danilo Krummrich
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <airlied@redhat.com>
commit 8f3c6f08ababad2e3bdd239728cf66a9949446b4 upstream.
If we have runtime suspended, and userspace wants to use /dev/drm_dp_*
then just tell it the device is busy instead of crashing in the GSP
code.
WARNING: CPU: 2 PID: 565741 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164 r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
CPU: 2 UID: 0 PID: 565741 Comm: fwupd Not tainted 6.18.10-200.fc43.x86_64 #1 PREEMPT(lazy)
Hardware name: LENOVO 20QTS0PQ00/20QTS0PQ00, BIOS N2OET65W (1.52 ) 08/05/2024
RIP: 0010:r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
This is a simple fix to get backported. We should probably engineer a
proper power domain solution to wake up devices and keep them awake
while fw updates are happening.
Cc: stable@vger.kernel.org
Fixes: 8894f4919bc4 ("drm/nouveau: register a drm_dp_aux channel for each dp connector")
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260224031750.791621-1-airlied@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1176,6 +1176,9 @@ nouveau_connector_aux_xfer(struct drm_dp
u8 size = msg->size;
int ret;
+ if (pm_runtime_suspended(nv_connector->base.dev->dev))
+ return -EBUSY;
+
nv_encoder = find_encoder(&nv_connector->base, DCB_OUTPUT_DP);
if (!nv_encoder || !(aux = nv_encoder->aux))
return -ENODEV;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 119/491] parisc: Fix initial page table creation for boot
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 118/491] nouveau/dpcd: return EBUSY for aux xfer if the device is asleep Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 120/491] net: ncsi: fix skb leak in error paths Greg Kroah-Hartman
` (376 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 8475d8fe21ec9c7eb2faca555fbc5b68cf0d2597 upstream.
The KERNEL_INITIAL_ORDER value defines the initial size (usually 32 or
64 MB) of the page table during bootup. Up until now the whole area was
initialized with PTE entries, but there was no check if we filled too
many entries. Change the code to fill up with so many entries that the
"_end" symbol can be reached by the kernel, but not more entries than
actually fit into the initial PTE tables.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v6.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/head.S | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -55,6 +55,7 @@ ENTRY(parisc_kernel_start)
.import __bss_start,data
.import __bss_stop,data
+ .import __end,data
load32 PA(__bss_start),%r3
load32 PA(__bss_stop),%r4
@@ -148,7 +149,11 @@ $cpu_ok:
* everything ... it will get remapped correctly later */
ldo 0+_PAGE_KERNEL_RWX(%r0),%r3 /* Hardwired 0 phys addr start */
load32 (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
- load32 PA(pg0),%r1
+ load32 PA(_end),%r1
+ SHRREG %r1,PAGE_SHIFT,%r1 /* %r1 is PFN count for _end symbol */
+ cmpb,<<,n %r11,%r1,1f
+ copy %r1,%r11 /* %r1 PFN count smaller than %r11 */
+1: load32 PA(pg0),%r1
$pgt_fill_loop:
STREGM %r3,ASM_PTE_ENTRY_SIZE(%r1)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 120/491] net: ncsi: fix skb leak in error paths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 119/491] parisc: Fix initial page table creation for boot Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 121/491] net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Greg Kroah-Hartman
` (375 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jian Zhang, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <zhangjian.3032@bytedance.com>
commit 5c3398a54266541610c8d0a7082e654e9ff3e259 upstream.
Early return paths in NCSI RX and AEN handlers fail to release
the received skb, resulting in a memory leak.
Specifically, ncsi_aen_handler() returns on invalid AEN packets
without consuming the skb. Similarly, ncsi_rcv_rsp() exits early
when failing to resolve the NCSI device, response handler, or
request, leaving the skb unfreed.
CC: stable@vger.kernel.org
Fixes: 7a82ecf4cfb8 ("net/ncsi: NCSI AEN packet handler")
Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
Link: https://patch.msgid.link/20260305060656.3357250-1-zhangjian.3032@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ncsi/ncsi-aen.c | 3 ++-
net/ncsi/ncsi-rsp.c | 16 ++++++++++++----
2 files changed, 14 insertions(+), 5 deletions(-)
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -224,7 +224,8 @@ int ncsi_aen_handler(struct ncsi_dev_pri
if (!nah) {
netdev_warn(ndp->ndev.dev, "Invalid AEN (0x%x) received\n",
h->type);
- return -ENOENT;
+ ret = -ENOENT;
+ goto out;
}
ret = ncsi_validate_aen_pkt(h, nah->payload);
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -1146,8 +1146,10 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
/* Find the NCSI device */
nd = ncsi_find_dev(orig_dev);
ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL;
- if (!ndp)
- return -ENODEV;
+ if (!ndp) {
+ ret = -ENODEV;
+ goto err_free_skb;
+ }
/* Check if it is AEN packet */
hdr = (struct ncsi_pkt_hdr *)skb_network_header(skb);
@@ -1169,7 +1171,8 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
if (!nrh) {
netdev_err(nd->dev, "Received unrecognized packet (0x%x)\n",
hdr->type);
- return -ENOENT;
+ ret = -ENOENT;
+ goto err_free_skb;
}
/* Associate with the request */
@@ -1177,7 +1180,8 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
nr = &ndp->requests[hdr->id];
if (!nr->used) {
spin_unlock_irqrestore(&ndp->lock, flags);
- return -ENODEV;
+ ret = -ENODEV;
+ goto err_free_skb;
}
nr->rsp = skb;
@@ -1231,4 +1235,8 @@ out_netlink:
out:
ncsi_free_request(nr);
return ret;
+
+err_free_skb:
+ kfree_skb(skb);
+ return ret;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 121/491] net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 120/491] net: ncsi: fix skb leak in error paths Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 122/491] drm/amdgpu: Fix use-after-free race in VM acquire Greg Kroah-Hartman
` (374 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c upstream.
Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe
should not see interrupt delivery in the usual case. However, hardware may
still present stale or latched interrupt status left by firmware or the
bootloader.
If probe later unwinds after devm_request_irq() has installed the handler,
such a stale interrupt can still reach arc_emac_intr() during teardown and
race with release of the associated net_device.
Avoid that window by putting the device into a known quiescent state before
requesting the IRQ: disable all EMAC interrupt sources and clear any
pending EMAC interrupt status bits. This keeps the change hardware-focused
and minimal, while preventing spurious IRQ delivery from leftover state.
Fixes: e4f2379db6c6 ("ethernet/arc/arc_emac - Add new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260309132409.584966-1-fanwu01@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/arc/emac_main.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -935,6 +935,17 @@ int arc_emac_probe(struct net_device *nd
/* Set poll rate so that it polls every 1 ms */
arc_reg_set(priv, R_POLLRATE, clock_frequency / 1000000);
+ /*
+ * Put the device into a known quiescent state before requesting
+ * the IRQ. Clear only EMAC interrupt status bits here; leave the
+ * MDIO completion bit alone and avoid writing TXPL_MASK, which is
+ * used to force TX polling rather than acknowledge interrupts.
+ */
+ arc_reg_set(priv, R_ENABLE, 0);
+ arc_reg_set(priv, R_STATUS, RXINT_MASK | TXINT_MASK | ERR_MASK |
+ TXCH_MASK | MSER_MASK | RXCR_MASK |
+ RXFR_MASK | RXFL_MASK);
+
ndev->irq = irq;
dev_info(dev, "IRQ is %d\n", ndev->irq);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 122/491] drm/amdgpu: Fix use-after-free race in VM acquire
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 121/491] net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 123/491] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Greg Kroah-Hartman
` (373 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harish Kasiviswanathan, Alysa Liu,
Alex Deucher
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alysa Liu <Alysa.Liu@amd.com>
commit 2c1030f2e84885cc58bffef6af67d5b9d2e7098f upstream.
Replace non-atomic vm->process_info assignment with cmpxchg()
to prevent race when parent/child processes sharing a drm_file
both try to acquire the same VM after fork().
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -932,7 +932,10 @@ static int init_kfd_vm(struct amdgpu_vm
*ef = dma_fence_get(&info->eviction_fence->base);
}
- vm->process_info = *process_info;
+ if (cmpxchg(&vm->process_info, NULL, *process_info) != NULL) {
+ ret = -EINVAL;
+ goto already_acquired;
+ }
/* Validate page directory and attach eviction fence */
ret = amdgpu_bo_reserve(vm->root.base.bo, true);
@@ -969,6 +972,7 @@ validate_pd_fail:
amdgpu_bo_unreserve(vm->root.base.bo);
reserve_pd_fail:
vm->process_info = NULL;
+already_acquired:
if (info) {
/* Two fence references: one in info and one in *ef */
dma_fence_put(&info->eviction_fence->base);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 123/491] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 122/491] drm/amdgpu: Fix use-after-free race in VM acquire Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 124/491] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error Greg Kroah-Hartman
` (372 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Calvin Owens, Steven Rostedt (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <calvin@wbinvd.org>
commit d008ba8be8984760e36d7dcd4adbd5a41a645708 upstream.
Some of the sizing logic through tracer_alloc_buffers() uses int
internally, causing unexpected behavior if the user passes a value that
does not fit in an int (on my x86 machine, the result is uselessly tiny
buffers).
Fix by plumbing the parameter's real type (unsigned long) through to the
ring buffer allocation functions, which already use unsigned long.
It has always been possible to create larger ring buffers via the sysfs
interface: this only affects the cmdline parameter.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.1772852067.git.calvin@wbinvd.org
Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8771,7 +8771,7 @@ static void
init_tracer_tracefs(struct trace_array *tr, struct dentry *d_tracer);
static int
-allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
+allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, unsigned long size)
{
enum ring_buffer_flags rb_flags;
@@ -8797,7 +8797,7 @@ allocate_trace_buffer(struct trace_array
return 0;
}
-static int allocate_trace_buffers(struct trace_array *tr, int size)
+static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
{
int ret;
@@ -9728,7 +9728,7 @@ out:
__init static int tracer_alloc_buffers(void)
{
- int ring_buf_size;
+ unsigned long ring_buf_size;
int ret = -ENOMEM;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 124/491] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 123/491] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 125/491] x86/apic: Disable x2apic on resume if the kernel expects so Greg Kroah-Hartman
` (371 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Law, Steven Rostedt (Google),
Masami Hiramatsu (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Law <objecting@objecting.org>
commit 39ebc8d7f561e1b64eca87353ef9b18e2825e591 upstream.
__xbc_open_brace() pushes entries with post-increment
(open_brace[brace_index++]), so brace_index always points one past
the last valid entry. xbc_verify_tree() reads open_brace[brace_index]
to report which brace is unclosed, but this is one past the last
pushed entry and contains stale/zero data, causing the error message
to reference the wrong node.
Use open_brace[brace_index - 1] to correctly identify the unclosed
brace. brace_index is known to be > 0 here since we are inside the
if (brace_index) guard.
Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/
Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/bootconfig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -685,7 +685,7 @@ static int __init xbc_verify_tree(void)
/* Brace closing */
if (brace_index) {
- n = &xbc_nodes[open_brace[brace_index]];
+ n = &xbc_nodes[open_brace[brace_index - 1]];
return xbc_parse_error("Brace is not closed",
xbc_node_get_data(n));
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 125/491] x86/apic: Disable x2apic on resume if the kernel expects so
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 124/491] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 126/491] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() Greg Kroah-Hartman
` (370 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rahul Bukte, Shashank Balaji,
Borislav Petkov (AMD), Thomas Gleixner, Sohil Mehta
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shashank Balaji <shashank.mahadasyam@sony.com>
commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 upstream.
When resuming from s2ram, firmware may re-enable x2apic mode, which may have
been disabled by the kernel during boot either because it doesn't support IRQ
remapping or for other reasons. This causes the kernel to continue using the
xapic interface, while the hardware is in x2apic mode, which causes hangs.
This happens on defconfig + bare metal + s2ram.
Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be
disabled, i.e. when x2apic_mode = 0.
The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the
pre-sleep configuration or initial boot configuration for each CPU, including
MSR state:
When executing from the power-on reset vector as a result of waking from an
S2 or S3 sleep state, the platform firmware performs only the hardware
initialization required to restore the system to either the state the
platform was in prior to the initial operating system boot, or to the
pre-sleep configuration state. In multiprocessor systems, non-boot
processors should be placed in the same state as prior to the initial
operating system boot.
(further ahead)
If this is an S2 or S3 wake, then the platform runtime firmware restores
minimum context of the system before jumping to the waking vector. This
includes:
CPU configuration. Platform runtime firmware restores the pre-sleep
configuration or initial boot configuration of each CPU (MSR, MTRR,
firmware update, SMBase, and so on). Interrupts must be disabled (for
IA-32 processors, disabled by CLI instruction).
(and other things)
So at least as per the spec, re-enablement of x2apic by the firmware is
allowed if "x2apic on" is a part of the initial boot configuration.
[1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization
[ bp: Massage. ]
Fixes: 6e1cb38a2aef ("x64, x2apic/intr-remap: add x2apic support, including enabling interrupt-remapping")
Co-developed-by: Rahul Bukte <rahul.bukte@sony.com>
Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260306-x2apic-fix-v2-1-bee99c12efa3@sony.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/apic.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1901,6 +1901,7 @@ early_initcall(validate_x2apic);
static inline void try_to_enable_x2apic(int remap_mode) { }
static inline void __x2apic_enable(void) { }
+static inline void __x2apic_disable(void) { }
#endif /* !CONFIG_X86_X2APIC */
void __init enable_IR_x2apic(void)
@@ -2664,6 +2665,11 @@ static void lapic_resume(void)
if (x2apic_mode) {
__x2apic_enable();
} else {
+ if (x2apic_enabled()) {
+ pr_warn_once("x2apic: re-enabled by firmware during resume. Disabling\n");
+ __x2apic_disable();
+ }
+
/*
* Make sure the APICBASE points to the right address
*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 126/491] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 125/491] x86/apic: Disable x2apic on resume if the kernel expects so Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 127/491] lib/bootconfig: check bounds before writing in __xbc_open_brace() Greg Kroah-Hartman
` (369 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josh Law, Masami Hiramatsu (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Law <objecting@objecting.org>
commit 1120a36bb1e9b9e22de75ecb4ef0b998f73a97f1 upstream.
snprintf() returns the number of characters that would have been
written excluding the NUL terminator. Output is truncated when the
return value is >= the buffer size, not just > the buffer size.
When ret == size, the current code takes the non-truncated path,
advancing buf by ret and reducing size to 0. This is wrong because
the output was actually truncated (the last character was replaced by
NUL). Fix by using >= so the truncation path is taken correctly.
Link: https://lore.kernel.org/all/20260312191143.28719-4-objecting@objecting.org/
Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/bootconfig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -250,7 +250,7 @@ int __init xbc_node_compose_key_after(st
depth ? "." : "");
if (ret < 0)
return ret;
- if (ret > size) {
+ if (ret >= size) {
size = 0;
} else {
size -= ret;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 127/491] lib/bootconfig: check bounds before writing in __xbc_open_brace()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 126/491] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 128/491] btrfs: abort transaction on failure to update root in the received subvol ioctl Greg Kroah-Hartman
` (368 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josh Law, Masami Hiramatsu (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Law <objecting@objecting.org>
commit 560f763baa0f2c9a44da4294c06af071405ac46f upstream.
The bounds check for brace_index happens after the array write.
While the current call pattern prevents an actual out-of-bounds
access (the previous call would have returned an error), the
write-before-check pattern is fragile and would become a real
out-of-bounds write if the error return were ever not propagated.
Move the bounds check before the array write so the function is
self-contained and safe regardless of caller behavior.
Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/
Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/bootconfig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/bootconfig.c
+++ b/lib/bootconfig.c
@@ -436,9 +436,9 @@ static char *skip_spaces_until_newline(c
static int __init __xbc_open_brace(char *p)
{
/* Push the last key as open brace */
- open_brace[brace_index++] = xbc_node_index(last_parent);
if (brace_index >= XBC_DEPTH_MAX)
return xbc_parse_error("Exceed max depth of braces", p);
+ open_brace[brace_index++] = xbc_node_index(last_parent);
return 0;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 128/491] btrfs: abort transaction on failure to update root in the received subvol ioctl
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 127/491] lib/bootconfig: check bounds before writing in __xbc_open_brace() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 129/491] iio: dac: ds4424: reject -128 RAW value Greg Kroah-Hartman
` (367 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anand Jain, Filipe Manana,
David Sterba
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit 0f475ee0ebce5c9492b260027cd95270191675fa upstream.
If we failed to update the root we don't abort the transaction, which is
wrong since we already used the transaction to remove an item from the
uuid tree.
Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree")
CC: stable@vger.kernel.org # 3.12+
Reviewed-by: Anand Jain <asj@kernel.org>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4524,7 +4524,8 @@ static long _btrfs_ioctl_set_received_su
ret = btrfs_update_root(trans, fs_info->tree_root,
&root->root_key, &root->root_item);
- if (ret < 0) {
+ if (unlikely(ret < 0)) {
+ btrfs_abort_transaction(trans, ret);
btrfs_end_transaction(trans);
goto out;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 129/491] iio: dac: ds4424: reject -128 RAW value
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 128/491] btrfs: abort transaction on failure to update root in the received subvol ioctl Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 130/491] iio: potentiometer: mcp4131: fix double application of wiper shift Greg Kroah-Hartman
` (366 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Andy Shevchenko,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit 5187e03b817c26c1c3bcb2645a612ea935c4be89 upstream.
The DS442x DAC uses sign-magnitude encoding, so -128 cannot be represented
in hardware (7-bit magnitude).
Previously, passing -128 resulted in a truncated value that programmed
0mA (magnitude 0) instead of the expected maximum negative current,
effectively failing silently.
Reject -128 to avoid producing the wrong current.
Fixes: d632a2bd8ffc ("iio: dac: ds4422/ds4424 dac driver")
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ds4424.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/dac/ds4424.c
+++ b/drivers/iio/dac/ds4424.c
@@ -141,7 +141,7 @@ static int ds4424_write_raw(struct iio_d
switch (mask) {
case IIO_CHAN_INFO_RAW:
- if (val < S8_MIN || val > S8_MAX)
+ if (val <= S8_MIN || val > S8_MAX)
return -EINVAL;
if (val > 0) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 130/491] iio: potentiometer: mcp4131: fix double application of wiper shift
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 129/491] iio: dac: ds4424: reject -128 RAW value Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 131/491] iio: chemical: bme680: Fix measurement wait duration calculation Greg Kroah-Hartman
` (365 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stable, Jonathan Cameron,
Lukas Schmid
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Schmid <lukas.schmid@netcube.li>
commit 85e4614524dca6c0a43874f475a17de2b9725648 upstream.
The MCP4131 wiper address is shifted twice when preparing the SPI
command in mcp4131_write_raw().
The address is already shifted when assigned to the local variable
"address", but is then shifted again when written to data->buf[0].
This results in an incorrect command being sent to the device and
breaks wiper writes to the second channel.
Remove the second shift and use the pre-shifted address directly
when composing the SPI transfer.
Fixes: 22d199a53910 ("iio: potentiometer: add driver for Microchip MCP413X/414X/415X/416X/423X/424X/425X/426X")
Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>#
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/potentiometer/mcp4131.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/potentiometer/mcp4131.c
+++ b/drivers/iio/potentiometer/mcp4131.c
@@ -222,7 +222,7 @@ static int mcp4131_write_raw(struct iio_
mutex_lock(&data->lock);
- data->buf[0] = address << MCP4131_WIPER_SHIFT;
+ data->buf[0] = address;
data->buf[0] |= MCP4131_WRITE | (val >> 8);
data->buf[1] = val & 0xFF; /* 8 bits here */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 131/491] iio: chemical: bme680: Fix measurement wait duration calculation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 130/491] iio: potentiometer: mcp4131: fix double application of wiper shift Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 132/491] iio: gyro: mpu3050-core: fix pm_runtime error handling Greg Kroah-Hartman
` (364 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Spencer, Vasileios Amoiridis,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Spencer <spencercw@gmail.com>
commit f55b9510cd9437da3a0efa08b089caeb47595ff1 upstream.
This function refers to the Bosch BME680 API as the source of the
calculation, but one of the constants does not match the Bosch
implementation. This appears to be a simple transposition of two digits,
resulting in a wait time that is too short. This can cause the following
'device measurement cycle incomplete' check to occasionally fail, returning
EBUSY to user space.
Adjust the constant to match the Bosch implementation and resolve the EBUSY
errors.
Fixes: 4241665e6ea0 ("iio: chemical: bme680: Fix sensor data read operation")
Link: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L521
Signed-off-by: Chris Spencer <spencercw@gmail.com>
Acked-by: Vasileios Amoiridis <vassilisamir@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/bme680_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/chemical/bme680_core.c
+++ b/drivers/iio/chemical/bme680_core.c
@@ -548,7 +548,7 @@ static int bme680_wait_for_eoc(struct bm
* + heater duration
*/
int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +
- data->oversampling_humid) * 1936) + (477 * 4) +
+ data->oversampling_humid) * 1963) + (477 * 4) +
(477 * 5) + 1000 + (data->heater_dur * 1000);
usleep_range(wait_eoc_us, wait_eoc_us + 100);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 132/491] iio: gyro: mpu3050-core: fix pm_runtime error handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 131/491] iio: chemical: bme680: Fix measurement wait duration calculation Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 133/491] iio: gyro: mpu3050-i2c: " Greg Kroah-Hartman
` (363 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Antoniu Miclaus,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
commit acc3949aab3e8094641a9c7c2768de1958c88378 upstream.
The return value of pm_runtime_get_sync() is not checked, allowing
the driver to access hardware that may fail to resume. The device
usage count is also unconditionally incremented. Use
pm_runtime_resume_and_get() which propagates errors and avoids
incrementing the usage count on failure.
In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()
failure since postdisable does not run when preenable fails.
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -320,7 +320,9 @@ static int mpu3050_read_raw(struct iio_d
}
case IIO_CHAN_INFO_RAW:
/* Resume device */
- pm_runtime_get_sync(mpu3050->dev);
+ ret = pm_runtime_resume_and_get(mpu3050->dev);
+ if (ret)
+ return ret;
mutex_lock(&mpu3050->lock);
ret = mpu3050_set_8khz_samplerate(mpu3050);
@@ -651,14 +653,20 @@ out_trigger_unlock:
static int mpu3050_buffer_preenable(struct iio_dev *indio_dev)
{
struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+ int ret;
- pm_runtime_get_sync(mpu3050->dev);
+ ret = pm_runtime_resume_and_get(mpu3050->dev);
+ if (ret)
+ return ret;
/* Unless we have OUR trigger active, run at full speed */
- if (!mpu3050->hw_irq_trigger)
- return mpu3050_set_8khz_samplerate(mpu3050);
+ if (!mpu3050->hw_irq_trigger) {
+ ret = mpu3050_set_8khz_samplerate(mpu3050);
+ if (ret)
+ pm_runtime_put_autosuspend(mpu3050->dev);
+ }
- return 0;
+ return ret;
}
static int mpu3050_buffer_postdisable(struct iio_dev *indio_dev)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 133/491] iio: gyro: mpu3050-i2c: fix pm_runtime error handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 132/491] iio: gyro: mpu3050-core: fix pm_runtime error handling Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 134/491] iio: imu: inv_icm42600: fix odr switch to the same value Greg Kroah-Hartman
` (362 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoniu Miclaus, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
commit 91f950b4cbb1aa9ea4eb3999f1463e8044b717fb upstream.
The return value of pm_runtime_get_sync() is not checked, and the
function always returns success. This allows I2C mux operations to
proceed even when the device fails to resume.
Use pm_runtime_resume_and_get() and propagate its return value to
properly handle resume failures.
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-i2c.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/gyro/mpu3050-i2c.c
+++ b/drivers/iio/gyro/mpu3050-i2c.c
@@ -19,8 +19,7 @@ static int mpu3050_i2c_bypass_select(str
struct mpu3050 *mpu3050 = i2c_mux_priv(mux);
/* Just power up the device, that is all that is needed */
- pm_runtime_get_sync(mpu3050->dev);
- return 0;
+ return pm_runtime_resume_and_get(mpu3050->dev);
}
static int mpu3050_i2c_bypass_deselect(struct i2c_mux_core *mux, u32 chan_id)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 134/491] iio: imu: inv_icm42600: fix odr switch to the same value
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 133/491] iio: gyro: mpu3050-i2c: " Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 135/491] bpf: Forget ranges when refining tnum after JSET Greg Kroah-Hartman
` (361 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit c9f3a593137d862d424130343e77d4b5260a4f5a upstream.
ODR switch is done in 2 steps when FIFO is on : change the ODR register
value and acknowledge change when reading the FIFO ODR change flag.
When we are switching to the same odr value, we end up waiting for a
FIFO ODR flag that is never happening.
Fix the issue by doing nothing and exiting properly when we are
switching to the same ODR value.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 ++
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 ++
2 files changed, 4 insertions(+)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -322,6 +322,8 @@ static int inv_icm42600_accel_write_odr(
return -EINVAL;
conf.odr = inv_icm42600_accel_odr_conv[idx / 2];
+ if (conf.odr == st->conf.accel.odr)
+ return 0;
pm_runtime_get_sync(dev);
mutex_lock(&st->lock);
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -334,6 +334,8 @@ static int inv_icm42600_gyro_write_odr(s
return -EINVAL;
conf.odr = inv_icm42600_gyro_odr_conv[idx / 2];
+ if (conf.odr == st->conf.gyro.odr)
+ return 0;
pm_runtime_get_sync(dev);
mutex_lock(&st->lock);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 135/491] bpf: Forget ranges when refining tnum after JSET
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 134/491] iio: imu: inv_icm42600: fix odr switch to the same value Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 136/491] l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Greg Kroah-Hartman
` (360 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c711ce17dd78e5d4fdcf,
Eduard Zingerman, Yonghong Song, Paul Chaignon,
Alexei Starovoitov, Shung-Hsi Yu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <paul.chaignon@gmail.com>
commit 6279846b9b2532e1b04559ef8bd0dec049f29383 upstream.
Syzbot reported a kernel warning due to a range invariant violation on
the following BPF program.
0: call bpf_get_netns_cookie
1: if r0 == 0 goto <exit>
2: if r0 & Oxffffffff goto <exit>
The issue is on the path where we fall through both jumps.
That path is unreachable at runtime: after insn 1, we know r0 != 0, but
with the sign extension on the jset, we would only fallthrough insn 2
if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to
figure this out, so the verifier walks all branches. The verifier then
refines the register bounds using the second condition and we end
up with inconsistent bounds on this unreachable path:
1: if r0 == 0 goto <exit>
r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)
2: if r0 & 0xffffffff goto <exit>
r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)
r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0)
Improving the range refinement for JSET to cover all cases is tricky. We
also don't expect many users to rely on JSET given LLVM doesn't generate
those instructions. So instead of improving the range refinement for
JSETs, Eduard suggested we forget the ranges whenever we're narrowing
tnums after a JSET. This patch implements that approach.
Reported-by: syzbot+c711ce17dd78e5d4fdcf@syzkaller.appspotmail.com
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/r/9d4fd6432a095d281f815770608fdcd16028ce0b.1752171365.git.paul.chaignon@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ shung-hsi.yu: no detection or kernel warning for invariant violation before
6.8, but the same umin=1,umax=0 state can occur when jset is preceed by r0 < 1.
Changes were made to adapt to older range refinement logic before commit
67420501e868 ("bpf: generalize reg_set_min_max() to handle non-const register
comparisons"). ]
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7823,6 +7823,10 @@ static void reg_set_min_max(struct bpf_r
}
break;
case BPF_JSET:
+ /* Forget the ranges before narrowing tnums, to avoid invariant
+ * violations if we're on a dead branch.
+ */
+ __mark_reg_unbounded(false_reg);
if (is_jmp32) {
false_32off = tnum_and(false_32off, tnum_const(~val32));
if (is_power_of_2(val32))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 136/491] l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 135/491] bpf: Forget ranges when refining tnum after JSET Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 137/491] io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Greg Kroah-Hartman
` (359 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, James Chapman,
Guillaume Nault, Jakub Kicinski, Qingfang Deng
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 9b8c88f875c04d4cb9111bd5dd9291c7e9691bf5 upstream.
pppol2tp_session_get_sock() is using RCU, it must be ready
for sk_refcnt being zero.
Commit ee40fb2e1eb5 ("l2tp: protect sock pointer of
struct pppol2tp_session with RCU") was correct because it
had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit.
pppol2tp_recv() can use pppol2tp_session_get_sock() as well.
Fixes: c5cbaef992d6 ("l2tp: refactor ppp socket/session relationship")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Link: https://patch.msgid.link/20250826134435.1683435-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ppp.c | 25 ++++++++-----------------
1 file changed, 8 insertions(+), 17 deletions(-)
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -130,22 +130,12 @@ static const struct ppp_channel_ops pppo
static const struct proto_ops pppol2tp_ops;
-/* Retrieves the pppol2tp socket associated to a session.
- * A reference is held on the returned socket, so this function must be paired
- * with sock_put().
- */
+/* Retrieves the pppol2tp socket associated to a session. */
static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
{
struct pppol2tp_session *ps = l2tp_session_priv(session);
- struct sock *sk;
- rcu_read_lock();
- sk = rcu_dereference(ps->sk);
- if (sk)
- sock_hold(sk);
- rcu_read_unlock();
-
- return sk;
+ return rcu_dereference(ps->sk);
}
/* Helpers to obtain tunnel/session contexts from sockets.
@@ -212,14 +202,13 @@ end:
static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
{
- struct pppol2tp_session *ps = l2tp_session_priv(session);
- struct sock *sk = NULL;
+ struct sock *sk;
/* If the socket is bound, send it in to PPP's input queue. Otherwise
* queue it on the session socket.
*/
rcu_read_lock();
- sk = rcu_dereference(ps->sk);
+ sk = pppol2tp_session_get_sock(session);
if (!sk)
goto no_sock;
@@ -529,13 +518,14 @@ static void pppol2tp_show(struct seq_fil
struct l2tp_session *session = arg;
struct sock *sk;
+ rcu_read_lock();
sk = pppol2tp_session_get_sock(session);
if (sk) {
struct pppox_sock *po = pppox_sk(sk);
seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
- sock_put(sk);
}
+ rcu_read_unlock();
}
static void pppol2tp_session_init(struct l2tp_session *session)
@@ -1541,6 +1531,7 @@ static void pppol2tp_seq_session_show(st
port = ntohs(inet->inet_sport);
}
+ rcu_read_lock();
sk = pppol2tp_session_get_sock(session);
if (sk) {
state = sk->sk_state;
@@ -1576,8 +1567,8 @@ static void pppol2tp_seq_session_show(st
struct pppox_sock *po = pppox_sk(sk);
seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
- sock_put(sk);
}
+ rcu_read_unlock();
}
static int pppol2tp_seq_show(struct seq_file *m, void *v)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 137/491] io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 136/491] l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 138/491] sunrpc: fix cache_request leak in cache_release Greg Kroah-Hartman
` (358 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4eb282331cab6d5b6588,
Jens Axboe, Jianqiang kang
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit 10dc959398175736e495f71c771f8641e1ca1907 upstream.
Currently this is checked before running the pending work. Normally this
is quite fine, as work items either end up blocking (which will create a
new worker for other items), or they complete fairly quickly. But syzbot
reports an issue where io-wq takes seemingly forever to exit, and with a
bit of debugging, this turns out to be because it queues a bunch of big
(2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't
support ->read_iter(), loop_rw_iter() ends up handling them. Each read
returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of
these pending, processing the whole chain can take a long time. Easily
longer than the syzbot uninterruptible sleep timeout of 140 seconds.
This then triggers a complaint off the io-wq exit path:
INFO: task syz.4.135:6326 blocked for more than 143 seconds.
Not tainted syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.135 state:D stack:26824 pid:6326 tgid:6324 ppid:5957 task_flags:0x400548 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
io_wq_exit_workers io_uring/io-wq.c:1328 [inline]
io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356
io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203
io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651
io_uring_files_cancel include/linux/io_uring.h:19 [inline]
do_exit+0x2ce/0x2bd0 kernel/exit.c:911
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa02738f749
RSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098
RBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98
There's really nothing wrong here, outside of processing these reads
will take a LONG time. However, we can speed up the exit by checking the
IO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will
exit the ring after queueing up all of these reads. Then once the first
item is processed, io-wq will simply cancel the rest. That should avoid
syzbot running into this complaint again.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/68a2decc.050a0220.e29e5.0099.GAE@google.com/
Reported-by: syzbot+4eb282331cab6d5b6588@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ Minor conflict resolved. ]
Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -554,9 +554,9 @@ static void io_worker_handle_work(struct
struct io_wqe_acct *acct = io_wqe_get_acct(worker);
struct io_wqe *wqe = worker->wqe;
struct io_wq *wq = wqe->wq;
- bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
do {
+ bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
struct io_wq_work *work;
get_next:
/*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 138/491] sunrpc: fix cache_request leak in cache_release
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 137/491] io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 139/491] nvdimm/bus: Fix potential use after free in asynchronous initialization Greg Kroah-Hartman
` (357 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, stable, Jeff Layton,
Chuck Lever
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 17ad31b3a43b72aec3a3d83605891e1397d0d065 upstream.
When a reader's file descriptor is closed while in the middle of reading
a cache_request (rp->offset != 0), cache_release() decrements the
request's readers count but never checks whether it should free the
request.
In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the
cache_request is removed from the queue and freed along with its buffer
and cache_head reference. cache_release() lacks this cleanup.
The only other path that frees requests with readers == 0 is
cache_dequeue(), but it runs only when CACHE_PENDING transitions from
set to clear. If that transition already happened while readers was
still non-zero, cache_dequeue() will have skipped the request, and no
subsequent call will clean it up.
Add the same cleanup logic from cache_read() to cache_release(): after
decrementing readers, check if it reached 0 with CACHE_PENDING clear,
and if so, dequeue and free the cache_request.
Reported-by: NeilBrown <neilb@ownmail.net>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/cache.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1056,14 +1056,25 @@ static int cache_release(struct inode *i
struct cache_reader *rp = filp->private_data;
if (rp) {
+ struct cache_request *rq = NULL;
+
spin_lock(&queue_lock);
if (rp->offset) {
struct cache_queue *cq;
- for (cq= &rp->q; &cq->list != &cd->queue;
- cq = list_entry(cq->list.next, struct cache_queue, list))
+ for (cq = &rp->q; &cq->list != &cd->queue;
+ cq = list_entry(cq->list.next,
+ struct cache_queue, list))
if (!cq->reader) {
- container_of(cq, struct cache_request, q)
- ->readers--;
+ struct cache_request *cr =
+ container_of(cq,
+ struct cache_request, q);
+ cr->readers--;
+ if (cr->readers == 0 &&
+ !test_bit(CACHE_PENDING,
+ &cr->item->flags)) {
+ list_del(&cr->q.list);
+ rq = cr;
+ }
break;
}
rp->offset = 0;
@@ -1071,9 +1082,14 @@ static int cache_release(struct inode *i
list_del(&rp->q.list);
spin_unlock(&queue_lock);
+ if (rq) {
+ cache_put(rq->item, cd);
+ kfree(rq->buf);
+ kfree(rq);
+ }
+
filp->private_data = NULL;
kfree(rp);
-
}
if (filp->f_mode & FMODE_WRITE) {
atomic_dec(&cd->writers);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 139/491] nvdimm/bus: Fix potential use after free in asynchronous initialization
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 138/491] sunrpc: fix cache_request leak in cache_release Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 140/491] NFC: nxp-nci: allow GPIOs to sleep Greg Kroah-Hartman
` (356 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dingisoul, Dave Jiang, Ira Weiny
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ira Weiny <ira.weiny@intel.com>
commit a8aec14230322ed8f1e8042b6d656c1631d41163 upstream.
Dingisoul with KASAN reports a use after free if device_add() fails in
nd_async_device_register().
Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while
scheduling async init") correctly added a reference on the parent device
to be held until asynchronous initialization was complete. However, if
device_add() results in an allocation failure the ref count of the
device drops to 0 prior to the parent pointer being accessed. Thus
resulting in use after free.
The bug bot AI correctly identified the fix. Save a reference to the
parent pointer to be used to drop the parent reference regardless of the
outcome of device_add().
Reported-by: Dingisoul <dingiso.kernel@gmail.com>
Closes: http://lore.kernel.org/8855544b-be9e-4153-aa55-0bc328b13733@gmail.com
Fixes: b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init")
Cc: stable@vger.kernel.org
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260306-fix-uaf-async-init-v1-1-a28fd7526723@intel.com
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/bus.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -502,14 +502,15 @@ EXPORT_SYMBOL_GPL(nd_synchronize);
static void nd_async_device_register(void *d, async_cookie_t cookie)
{
struct device *dev = d;
+ struct device *parent = dev->parent;
if (device_add(dev) != 0) {
dev_err(dev, "%s: failed\n", __func__);
put_device(dev);
}
put_device(dev);
- if (dev->parent)
- put_device(dev->parent);
+ if (parent)
+ put_device(parent);
}
static void nd_async_device_unregister(void *d, async_cookie_t cookie)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 140/491] NFC: nxp-nci: allow GPIOs to sleep
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 139/491] nvdimm/bus: Fix potential use after free in asynchronous initialization Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 141/491] net: macb: fix use-after-free access to PTP clock Greg Kroah-Hartman
` (355 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Ray, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Ray <ian.ray@gehealthcare.com>
commit 55dc632ab2ac2889b15995a9eef56c753d48ebc7 upstream.
Allow the firmware and enable GPIOs to sleep.
This fixes a `WARN_ON' and allows the driver to operate GPIOs which are
connected to I2C GPIO expanders.
-- >8 --
kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98
-- >8 --
Fixes: 43201767b44c ("NFC: nxp-nci: Convert to use GPIO descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
Link: https://patch.msgid.link/20260317085337.146545-1-ian.ray@gehealthcare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/nxp-nci/i2c.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/nfc/nxp-nci/i2c.c
+++ b/drivers/nfc/nxp-nci/i2c.c
@@ -47,8 +47,8 @@ static int nxp_nci_i2c_set_mode(void *ph
{
struct nxp_nci_i2c_phy *phy = (struct nxp_nci_i2c_phy *) phy_id;
- gpiod_set_value(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);
- gpiod_set_value(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);
+ gpiod_set_value_cansleep(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);
+ gpiod_set_value_cansleep(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);
usleep_range(10000, 15000);
if (mode == NXP_NCI_MODE_COLD)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 141/491] net: macb: fix use-after-free access to PTP clock
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 140/491] NFC: nxp-nci: allow GPIOs to sleep Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 142/491] Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Greg Kroah-Hartman
` (354 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit 8da13e6d63c1a97f7302d342c89c4a56a55c7015 upstream.
PTP clock is registered on every opening of the interface and destroyed on
every closing. However it may be accessed via get_ts_info ethtool call
which is possible while the interface is just present in the kernel.
BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426
Read of size 4 at addr ffff8880194345cc by task syz.0.6/948
CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x17f/0x496 mm/kasan/report.c:420
kasan_report+0xd9/0x180 mm/kasan/report.c:524
ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426
gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349
macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371
__ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558
ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline]
__dev_ethtool net/ethtool/ioctl.c:3017 [inline]
dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095
dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510
sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
sock_ioctl+0x577/0x6d0 net/socket.c:1320
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
</TASK>
Allocated by task 457:
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235
gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375
macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920
__dev_open+0x2ce/0x500 net/core/dev.c:1501
__dev_change_flags+0x56a/0x740 net/core/dev.c:8651
dev_change_flags+0x92/0x170 net/core/dev.c:8722
do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833
__rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608
rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655
rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150
netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg+0x14b/0x180 net/socket.c:730
__sys_sendto+0x320/0x3b0 net/socket.c:2152
__do_sys_sendto net/socket.c:2164 [inline]
__se_sys_sendto net/socket.c:2160 [inline]
__x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 938:
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook mm/slub.c:1755 [inline]
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xbc/0x320 mm/slub.c:3700
device_release+0xa0/0x240 drivers/base/core.c:2507
kobject_cleanup lib/kobject.c:681 [inline]
kobject_release lib/kobject.c:712 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1cd/0x350 lib/kobject.c:729
put_device+0x1b/0x30 drivers/base/core.c:3805
ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391
gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404
macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966
__dev_close_many+0x1b9/0x310 net/core/dev.c:1585
__dev_close net/core/dev.c:1597 [inline]
__dev_change_flags+0x2bb/0x740 net/core/dev.c:8649
dev_change_flags+0x92/0x170 net/core/dev.c:8722
dev_ifsioc+0x151/0xe00 net/core/dev_ioctl.c:326
dev_ioctl+0x33e/0x1070 net/core/dev_ioctl.c:572
sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
sock_ioctl+0x577/0x6d0 net/socket.c:1320
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Set the PTP clock pointer to NULL after unregistering.
Fixes: c2594d804d5c ("macb: Common code to enable ptp support for MACB/GEM")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20260316103826.74506-1-pchelkin@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cadence/macb_ptp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/cadence/macb_ptp.c
+++ b/drivers/net/ethernet/cadence/macb_ptp.c
@@ -395,8 +395,10 @@ void gem_ptp_remove(struct net_device *n
{
struct macb *bp = netdev_priv(ndev);
- if (bp->ptp_clock)
+ if (bp->ptp_clock) {
ptp_clock_unregister(bp->ptp_clock);
+ bp->ptp_clock = NULL;
+ }
gem_ptp_clear_timer(bp);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 142/491] Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 141/491] net: macb: fix use-after-free access to PTP clock Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 143/491] Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Greg Kroah-Hartman
` (353 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Johannes Möller,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Johannes Möller <research@johannes-moeller.dev>
commit 15145675690cab2de1056e7ed68e59cbd0452529 upstream.
l2cap_ecred_reconf_rsp() casts the incoming data to struct
l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
with result at offset 0).
This causes two problems:
- The sizeof(*rsp) length check requires 8 bytes instead of the
correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
with -EPROTO.
- rsp->result reads from offset 6 instead of offset 0, returning
wrong data when the packet is large enough to pass the check.
Fix by using the correct type. Also pass the already byte-swapped
result variable to BT_DBG instead of the raw __le16 field.
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Cc: stable@vger.kernel.org
Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6407,7 +6407,7 @@ static inline int l2cap_ecred_reconf_rsp
u8 *data)
{
struct l2cap_chan *chan, *tmp;
- struct l2cap_ecred_conn_rsp *rsp = (void *) data;
+ struct l2cap_ecred_reconf_rsp *rsp = (void *)data;
u16 result;
if (cmd_len < sizeof(*rsp))
@@ -6415,7 +6415,7 @@ static inline int l2cap_ecred_reconf_rsp
result = __le16_to_cpu(rsp->result);
- BT_DBG("result 0x%4.4x", rsp->result);
+ BT_DBG("result 0x%4.4x", result);
if (!result)
return 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 143/491] Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 142/491] Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 144/491] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption Greg Kroah-Hartman
` (352 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Johannes Möller,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Johannes Möller <research@johannes-moeller.dev>
commit dd815e6e3918dc75a49aaabac36e4f024d675101 upstream.
l2cap_information_rsp() checks that cmd_len covers the fixed
l2cap_info_rsp header (type + result, 4 bytes) but then reads
rsp->data without verifying that the payload is present:
- L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads
4 bytes past the header (needs cmd_len >= 8).
- L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header
(needs cmd_len >= 5).
A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an
out-of-bounds read of adjacent skb data.
Guard each data access with the required payload length check. If the
payload is too short, skip the read and let the state machine complete
with safe defaults (feat_mask and remote_fixed_chan remain zero from
kzalloc), so the info timer cleanup and l2cap_conn_start() still run
and the connection is not stalled.
Fixes: 4e8402a3f884 ("[Bluetooth] Retrieve L2CAP features mask on connection setup")
Cc: stable@vger.kernel.org
Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4847,7 +4847,8 @@ static inline int l2cap_information_rsp(
switch (type) {
case L2CAP_IT_FEAT_MASK:
- conn->feat_mask = get_unaligned_le32(rsp->data);
+ if (cmd_len >= sizeof(*rsp) + sizeof(u32))
+ conn->feat_mask = get_unaligned_le32(rsp->data);
if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
struct l2cap_info_req req;
@@ -4866,7 +4867,8 @@ static inline int l2cap_information_rsp(
break;
case L2CAP_IT_FIXED_CHAN:
- conn->remote_fixed_chan = rsp->data[0];
+ if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0]))
+ conn->remote_fixed_chan = rsp->data[0];
conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
conn->info_ident = 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 144/491] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 143/491] Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 145/491] mmc: sdhci: fix timing selection for 1-bit bus width Greg Kroah-Hartman
` (351 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Matthew Schwartz,
Ben Chuang, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <matthew.schwartz@linux.dev>
commit 2b76e0cc7803e5ab561c875edaba7f6bbd87fbb0 upstream.
The GL9750 SD host controller has intermittent data corruption during
DMA write operations. The GM_BURST register's R_OSRC_Lmt field
(bits 17:16), which limits outstanding DMA read requests from system
memory, is not being cleared during initialization. The Windows driver
sets R_OSRC_Lmt to zero, limiting requests to the smallest unit.
Clear R_OSRC_Lmt to match the Windows driver behavior. This eliminates
write corruption verified with f3write/f3read tests while maintaining
DMA performance.
Cc: stable@vger.kernel.org
Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support")
Closes: https://lore.kernel.org/linux-mmc/33d12807-5c72-41ce-8679-57aa11831fad@linux.dev/
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Reviewed-by: Ben Chuang <ben.chuang@genesyslogic.com.tw>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-pci-gli.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/mmc/host/sdhci-pci-gli.c
+++ b/drivers/mmc/host/sdhci-pci-gli.c
@@ -59,6 +59,9 @@
#define GLI_9750_MISC_RX_INV_VALUE GLI_9750_MISC_RX_INV_OFF
#define GLI_9750_MISC_TX1_DLY_VALUE 0x5
+#define SDHCI_GLI_9750_GM_BURST_SIZE 0x510
+#define SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT GENMASK(17, 16)
+
#define SDHCI_GLI_9750_TUNING_CONTROL 0x540
#define SDHCI_GLI_9750_TUNING_CONTROL_EN BIT(4)
#define GLI_9750_TUNING_CONTROL_EN_ON 0x1
@@ -152,10 +155,16 @@ static void gli_set_9750(struct sdhci_ho
u32 misc_value;
u32 parameter_value;
u32 control_value;
+ u32 burst_value;
u16 ctrl2;
gl9750_wt_on(host);
+ /* clear R_OSRC_Lmt to avoid DMA write corruption */
+ burst_value = sdhci_readl(host, SDHCI_GLI_9750_GM_BURST_SIZE);
+ burst_value &= ~SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT;
+ sdhci_writel(host, burst_value, SDHCI_GLI_9750_GM_BURST_SIZE);
+
driving_value = sdhci_readl(host, SDHCI_GLI_9750_DRIVING);
pll_value = sdhci_readl(host, SDHCI_GLI_9750_PLL);
sw_ctrl_value = sdhci_readl(host, SDHCI_GLI_9750_SW_CTRL);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 145/491] mmc: sdhci: fix timing selection for 1-bit bus width
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 144/491] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 146/491] mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Greg Kroah-Hartman
` (350 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luke Wang, Adrian Hunter,
Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Wang <ziniu.wang_1@nxp.com>
commit 5e3486e64094c28a526543f1e8aa0d5964b7f02d upstream.
When 1-bit bus width is used with HS200/HS400 capabilities set,
mmc_select_hs200() returns 0 without actually switching. This
causes mmc_select_timing() to skip mmc_select_hs(), leaving eMMC
in legacy mode (26MHz) instead of High Speed SDR (52MHz).
Per JEDEC eMMC spec section 5.3.2, 1-bit mode supports High Speed
SDR. Drop incompatible HS200/HS400/UHS/DDR caps early so timing
selection falls through to mmc_select_hs() correctly.
Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure")
Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -4444,8 +4444,15 @@ int sdhci_setup_host(struct sdhci_host *
* their platform code before calling sdhci_add_host(), and we
* won't assume 8-bit width for hosts without that CAP.
*/
- if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
+ if (host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA) {
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
+ if (host->quirks2 & SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400)
+ host->caps1 &= ~SDHCI_SUPPORT_HS400;
+ mmc->caps2 &= ~(MMC_CAP2_HS200 | MMC_CAP2_HS400 | MMC_CAP2_HS400_ES);
+ mmc->caps &= ~(MMC_CAP_DDR | MMC_CAP_UHS);
+ } else {
mmc->caps |= MMC_CAP_4_BIT_DATA;
+ }
if (host->quirks2 & SDHCI_QUIRK2_HOST_NO_CMD23)
mmc->caps &= ~MMC_CAP_CMD23;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 146/491] mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 145/491] mmc: sdhci: fix timing selection for 1-bit bus width Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 147/491] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry Greg Kroah-Hartman
` (349 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Ni, Alok Tiwari, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
commit 0410e1a4c545c769c59c6eda897ad5d574d0c865 upstream.
Fix wrong variable used for error checking after dma_alloc_coherent()
call. The function checks cdns_ctrl->dma_cdma_desc instead of
cdns_ctrl->cdma_desc, which could lead to incorrect error handling.
Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem")
Cc: stable@vger.kernel.org
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/cadence-nand-controller.c
+++ b/drivers/mtd/nand/raw/cadence-nand-controller.c
@@ -2840,7 +2840,7 @@ static int cadence_nand_init(struct cdns
sizeof(*cdns_ctrl->cdma_desc),
&cdns_ctrl->dma_cdma_desc,
GFP_KERNEL);
- if (!cdns_ctrl->dma_cdma_desc)
+ if (!cdns_ctrl->cdma_desc)
return -ENOMEM;
cdns_ctrl->buf_size = SZ_16K;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 147/491] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 146/491] mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 148/491] serial: 8250_pci: add support for the AX99100 Greg Kroah-Hartman
` (348 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanghui Feng, Shuai Xue,
Samiullah Khawaja, Lu Baolu, Joerg Roedel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
commit fe89277c9ceb0d6af0aa665bcf24a41d8b1b79cd upstream.
During the qi_check_fault process after an IOMMU ITE event, requests at
odd-numbered positions in the queue are set to QI_ABORT, only satisfying
single-request submissions. However, qi_submit_sync now supports multiple
simultaneous submissions, and can't guarantee that the wait_desc will be
at an odd-numbered position. Therefore, if an item times out, IOMMU can't
re-initiate the request, resulting in an infinite polling wait.
This modifies the process by setting the status of all requests already
fetched by IOMMU and recorded as QI_IN_USE status (including wait_desc
requests) to QI_ABORT, thus enabling multiple requests to be resubmitted.
Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
Cc: stable@vger.kernel.org
Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Tested-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Link: https://lore.kernel.org/r/20260306101516.3885775-1-guanghuifeng@linux.alibaba.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel/dmar.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iommu/intel/dmar.c
+++ b/drivers/iommu/intel/dmar.c
@@ -1243,7 +1243,6 @@ static int qi_check_fault(struct intel_i
if (fault & DMA_FSTS_ITE) {
head = readl(iommu->reg + DMAR_IQH_REG);
head = ((head >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
- head |= 1;
tail = readl(iommu->reg + DMAR_IQT_REG);
tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
@@ -1252,7 +1251,7 @@ static int qi_check_fault(struct intel_i
do {
if (qi->desc_status[head] == QI_IN_USE)
qi->desc_status[head] = QI_ABORT;
- head = (head - 2 + QI_LENGTH) % QI_LENGTH;
+ head = (head - 1 + QI_LENGTH) % QI_LENGTH;
} while (head != tail);
if (qi->desc_status[wait_index] == QI_ABORT)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 148/491] serial: 8250_pci: add support for the AX99100
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 147/491] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 149/491] serial: 8250: Fix TX deadlock when using DMA Greg Kroah-Hartman
` (347 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Roukala , stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
commit 9c0072bc33d349c83d223e64be30794e11938a6b upstream.
This is found in popular brands such as StarTech.com or Delock, and has
been a source of frustration to quite a few people, if I can trust
Amazon comments complaining about Linux support via the official
out-of-the-tree driver.
Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260309-8250_pci_ax99100-v1-1-3328bdfd8e94@mupuf.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_pci.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -57,6 +57,8 @@ struct serial_private {
};
#define PCI_DEVICE_ID_HPE_PCI_SERIAL 0x37e
+#define PCIE_VENDOR_ID_ASIX 0x125B
+#define PCIE_DEVICE_ID_AX99100 0x9100
static const struct pci_device_id pci_use_msi[] = {
{ PCI_DEVICE_SUB(PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9900,
@@ -69,6 +71,8 @@ static const struct pci_device_id pci_us
0xA000, 0x1000) },
{ PCI_DEVICE_SUB(PCI_VENDOR_ID_HP_3PAR, PCI_DEVICE_ID_HPE_PCI_SERIAL,
PCI_ANY_ID, PCI_ANY_ID) },
+ { PCI_DEVICE_SUB(PCIE_VENDOR_ID_ASIX, PCIE_DEVICE_ID_AX99100,
+ 0xA000, 0x1000) },
{ }
};
@@ -853,6 +857,7 @@ static int pci_netmos_init(struct pci_de
case PCI_DEVICE_ID_NETMOS_9912:
case PCI_DEVICE_ID_NETMOS_9922:
case PCI_DEVICE_ID_NETMOS_9900:
+ case PCIE_DEVICE_ID_AX99100:
num_serial = pci_netmos_9900_numports(dev);
break;
@@ -2480,6 +2485,14 @@ static struct pci_serial_quirk pci_seria
.init = pci_netmos_init,
.setup = pci_netmos_9900_setup,
},
+ {
+ .vendor = PCIE_VENDOR_ID_ASIX,
+ .device = PCI_ANY_ID,
+ .subvendor = PCI_ANY_ID,
+ .subdevice = PCI_ANY_ID,
+ .init = pci_netmos_init,
+ .setup = pci_netmos_9900_setup,
+ },
/*
* EndRun Technologies
*/
@@ -5825,6 +5838,10 @@ static const struct pci_device_id serial
0xA000, 0x3002,
0, 0, pbn_NETMOS9900_2s_115200 },
+ { PCIE_VENDOR_ID_ASIX, PCIE_DEVICE_ID_AX99100,
+ 0xA000, 0x1000,
+ 0, 0, pbn_b0_1_115200 },
+
/*
* Best Connectivity and Rosewill PCI Multi I/O cards
*/
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 149/491] serial: 8250: Fix TX deadlock when using DMA
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 148/491] serial: 8250_pci: add support for the AX99100 Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 150/491] serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Greg Kroah-Hartman
` (346 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Raul E Rangel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raul E Rangel <rrangel@chromium.org>
commit a424a34b8faddf97b5af41689087e7a230f79ba7 upstream.
`dmaengine_terminate_async` does not guarantee that the
`__dma_tx_complete` callback will run. The callback is currently the
only place where `dma->tx_running` gets cleared. If the transaction is
canceled and the callback never runs, then `dma->tx_running` will never
get cleared and we will never schedule new TX DMA transactions again.
This change makes it so we clear `dma->tx_running` after we terminate
the DMA transaction. This is "safe" because `serial8250_tx_dma_flush`
is holding the UART port lock. The first thing the callback does is also
grab the UART port lock, so access to `dma->tx_running` is serialized.
Fixes: 9e512eaaf8f4 ("serial: 8250: Fix fifo underflow on flush")
Cc: stable <stable@kernel.org>
Signed-off-by: Raul E Rangel <rrangel@google.com>
Link: https://patch.msgid.link/20260209135815.1.I16366ecb0f62f3c96fe3dd5763fcf6f3c2b4d8cd@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dma.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -148,7 +148,22 @@ void serial8250_tx_dma_flush(struct uart
*/
dma->tx_size = 0;
+ /*
+ * We can't use `dmaengine_terminate_sync` because `uart_flush_buffer` is
+ * holding the uart port spinlock.
+ */
dmaengine_terminate_async(dma->txchan);
+
+ /*
+ * The callback might or might not run. If it doesn't run, we need to ensure
+ * that `tx_running` is cleared so that we can schedule new transactions.
+ * If it does run, then the zombie callback will clear `tx_running` again
+ * and perform a no-op since `tx_size` was cleared above.
+ *
+ * In either case, we ASSUME the DMA transaction will terminate before we
+ * issue a new `serial8250_tx_dma`.
+ */
+ dma->tx_running = 0;
}
int serial8250_rx_dma(struct uart_8250_port *p)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 150/491] serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 149/491] serial: 8250: Fix TX deadlock when using DMA Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 151/491] drm/radeon: apply state adjust rules to some additional HAINAN vairants Greg Kroah-Hartman
` (345 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Bandal, Shankar,
Murthy, Shanth, Andy Shevchenko, Ilpo Järvinen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
commit e0a368ae79531ff92105a2692f10d83052055856 upstream.
When DW UART is !uart_16550_compatible, it can indicate BUSY at any
point (when under constant Rx pressure) unless a complex sequence of
steps is performed. Any LCR write can run a foul with the condition
that prevents writing LCR while the UART is BUSY, which triggers
BUSY_DETECT interrupt that seems unmaskable using IER bits.
Normal flow is that dw8250_handle_irq() handles BUSY_DETECT condition
by reading USR register. This BUSY feature, however, breaks the
assumptions made in serial8250_do_shutdown(), which runs
synchronize_irq() after clearing IER and assumes no interrupts can
occur after that point but then proceeds to update LCR, which on DW
UART can trigger an interrupt.
If serial8250_do_shutdown() releases the interrupt handler before the
handler has run and processed the BUSY_DETECT condition by read the USR
register, the IRQ is not deasserted resulting in interrupt storm that
triggers "irq x: nobody cared" warning leading to disabling the IRQ.
Add late synchronize_irq() into serial8250_do_shutdown() to ensure
BUSY_DETECT from DW UART is handled before port's interrupt handler is
released. Alternative would be to add DW UART specific shutdown
function but it would mostly duplicate the generic code and the extra
synchronize_irq() seems pretty harmless in serial8250_do_shutdown().
Fixes: 7d4008ebb1c9 ("tty: add a DesignWare 8250 driver")
Cc: stable <stable@kernel.org>
Reported-by: Bandal, Shankar <shankar.bandal@intel.com>
Tested-by: Bandal, Shankar <shankar.bandal@intel.com>
Tested-by: Murthy, Shanth <shanth.murthy@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260203171049.4353-7-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_port.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2485,6 +2485,12 @@ void serial8250_do_shutdown(struct uart_
* the IRQ chain.
*/
serial_port_in(port, UART_RX);
+ /*
+ * LCR writes on DW UART can trigger late (unmaskable) IRQs.
+ * Handle them before releasing the handler.
+ */
+ synchronize_irq(port->irq);
+
serial8250_rpm_put(up);
up->ops->release_irq(up);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 151/491] drm/radeon: apply state adjust rules to some additional HAINAN vairants
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 150/491] serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 152/491] net: Handle napi_schedule() calls from non-interrupt Greg Kroah-Hartman
` (344 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 86650ee2241ff84207eaa298ab318533f3c21a38 upstream.
They need a similar workaround.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 87327658c848f56eac166cb382b57b83bf06c5ac)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/si_dpm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2962,9 +2962,11 @@ static void si_apply_state_adjust_rules(
if (rdev->family == CHIP_HAINAN) {
if ((rdev->pdev->revision == 0x81) ||
(rdev->pdev->revision == 0xC3) ||
+ (rdev->pdev->device == 0x6660) ||
(rdev->pdev->device == 0x6664) ||
(rdev->pdev->device == 0x6665) ||
- (rdev->pdev->device == 0x6667)) {
+ (rdev->pdev->device == 0x6667) ||
+ (rdev->pdev->device == 0x666F)) {
max_sclk = 75000;
}
if ((rdev->pdev->revision == 0xC3) ||
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 152/491] net: Handle napi_schedule() calls from non-interrupt
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 151/491] drm/radeon: apply state adjust rules to some additional HAINAN vairants Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration Greg Kroah-Hartman
` (343 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Jakub Kicinski,
Francois Romieu, Breno Leitao, Frederic Weisbecker, Eric Dumazet,
Jan Kiszka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
commit 77e45145e3039a0fb212556ab3f8c87f54771757 upstream.
napi_schedule() is expected to be called either:
* From an interrupt, where raised softirqs are handled on IRQ exit
* From a softirq disabled section, where raised softirqs are handled on
the next call to local_bh_enable().
* From a softirq handler, where raised softirqs are handled on the next
round in do_softirq(), or further deferred to a dedicated kthread.
Other bare tasks context may end up ignoring the raised NET_RX vector
until the next random softirq handling opportunity, which may not
happen before a while if the CPU goes idle afterwards with the tick
stopped.
Such "misuses" have been detected on several places thanks to messages
of the kind:
"NOHZ tick-stop error: local softirq work is pending, handler #08!!!"
For example:
__raise_softirq_irqoff
__napi_schedule
rtl8152_runtime_resume.isra.0
rtl8152_resume
usb_resume_interface.isra.0
usb_resume_both
__rpm_callback
rpm_callback
rpm_resume
__pm_runtime_resume
usb_autoresume_device
usb_remote_wakeup
hub_event
process_one_work
worker_thread
kthread
ret_from_fork
ret_from_fork_asm
And also:
* drivers/net/usb/r8152.c::rtl_work_func_t
* drivers/net/netdevsim/netdev.c::nsim_start_xmit
There is a long history of issues of this kind:
019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()")
330068589389 ("idpf: disable local BH when scheduling napi for marker packets")
e3d5d70cb483 ("net: lan78xx: fix "softirq work is pending" error")
e55c27ed9ccf ("mt76: mt7615: add missing bh-disable around rx napi schedule")
c0182aa98570 ("mt76: mt7915: add missing bh-disable around tx napi enable/schedule")
970be1dff26d ("mt76: disable BH around napi_schedule() calls")
019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()")
30bfec4fec59 ("can: rx-offload: can_rx_offload_threaded_irq_finish(): add new function to be called from threaded interrupt")
e63052a5dd3c ("mlx5e: add add missing BH locking around napi_schdule()")
83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule")
bd4ce941c8d5 ("mlx4: Invoke softirqs after napi_reschedule")
8cf699ec849f ("mlx4: do not call napi_schedule() without care")
ec13ee80145c ("virtio_net: invoke softirqs after __napi_schedule")
This shows that relying on the caller to arrange a proper context for
the softirqs to be handled while calling napi_schedule() is very fragile
and error prone. Also fixing them can also prove challenging if the
caller may be called from different kinds of contexts.
Therefore fix this from napi_schedule() itself with waking up ksoftirqd
when softirqs are raised from task contexts.
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reported-by: Jakub Kicinski <kuba@kernel.org>
Reported-by: Francois Romieu <romieu@fr.zoreil.com>
Closes: https://lore.kernel.org/lkml/354a2690-9bbf-4ccb-8769-fa94707a9340@molgen.mpg.de/
Cc: Breno Leitao <leitao@debian.org>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250223221708.27130-1-frederic@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4318,7 +4318,7 @@ static inline void ____napi_schedule(str
struct napi_struct *napi)
{
list_add_tail(&napi->poll_list, &sd->poll_list);
- __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+ raise_softirq_irqoff(NET_RX_SOFTIRQ);
}
#ifdef CONFIG_RPS
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 152/491] net: Handle napi_schedule() calls from non-interrupt Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-15 10:22 ` Ben Hutchings
2026-04-13 15:56 ` [PATCH 5.10 154/491] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() Greg Kroah-Hartman
` (342 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ankit Garg, Jordan Rhee,
Joshua Washington, Harshitha Ramamurthy, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Garg <nktgrg@google.com>
commit 3d970eda003441f66551a91fda16478ac0711617 upstream.
Currently, interrupts are automatically enabled immediately upon
request. This allows interrupt to fire before the associated NAPI
context is fully initialized and cause failures like below:
[ 0.946369] Call Trace:
[ 0.946369] <IRQ>
[ 0.946369] __napi_poll+0x2a/0x1e0
[ 0.946369] net_rx_action+0x2f9/0x3f0
[ 0.946369] handle_softirqs+0xd6/0x2c0
[ 0.946369] ? handle_edge_irq+0xc1/0x1b0
[ 0.946369] __irq_exit_rcu+0xc3/0xe0
[ 0.946369] common_interrupt+0x81/0xa0
[ 0.946369] </IRQ>
[ 0.946369] <TASK>
[ 0.946369] asm_common_interrupt+0x22/0x40
[ 0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10
Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto
enablement and explicitly enable the interrupt in NAPI initialization
path (and disable it during NAPI teardown).
This ensures that interrupt lifecycle is strictly coupled with
readiness of NAPI context.
Cc: stable@vger.kernel.org
Fixes: 1dfc2e46117e ("gve: Refactor napi add and remove functions")
Signed-off-by: Ankit Garg <nktgrg@google.com>
Reviewed-by: Jordan Rhee <jordanrhee@google.com>
Reviewed-by: Joshua Washington <joshwash@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/20251219102945.2193617-1-hramamurthy@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ modified to re-introduce the irq member to struct gve_notify_block,
which was introuduced in commit 9a5e0776d11f ("gve: Avoid rescheduling
napi if on wrong cpu"). ]
Signed-off-by: Joshua Washington <joshwash@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/google/gve/gve.h | 1 +
drivers/net/ethernet/google/gve/gve_main.c | 5 ++++-
2 files changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -165,6 +165,7 @@ struct gve_notify_block {
struct gve_priv *priv;
struct gve_tx_ring *tx; /* tx rings on this block */
struct gve_rx_ring *rx; /* rx rings on this block */
+ u32 irq;
} ____cacheline_aligned;
/* Tracks allowed and current queue settings */
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -277,8 +277,9 @@ static int gve_alloc_notify_blocks(struc
snprintf(block->name, sizeof(block->name), "%s-ntfy-block.%d",
name, i);
block->priv = priv;
+ block->irq = priv->msix_vectors[msix_idx].vector;
err = request_irq(priv->msix_vectors[msix_idx].vector,
- gve_intr, 0, block->name, block);
+ gve_intr, IRQF_NO_AUTOEN, block->name, block);
if (err) {
dev_err(&priv->pdev->dev,
"Failed to receive msix vector %d\n", i);
@@ -413,6 +414,7 @@ static void gve_add_napi(struct gve_priv
netif_napi_add(priv->dev, &block->napi, gve_napi_poll,
NAPI_POLL_WEIGHT);
+ enable_irq(block->irq);
}
static void gve_remove_napi(struct gve_priv *priv, int ntfy_idx)
@@ -420,6 +422,7 @@ static void gve_remove_napi(struct gve_p
struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx];
netif_napi_del(&block->napi);
+ disable_irq(block->irq);
}
static int gve_register_qpls(struct gve_priv *priv)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 154/491] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 155/491] drm/exynos: vidi: fix to avoid directly dereferencing user pointer Greg Kroah-Hartman
` (341 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeongjun Park, Inki Dae
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
commit d3968a0d85b211e197f2f4f06268a7031079e0d0 upstream.
vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.
This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.
To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.
Cc: <stable@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 +
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 14 +++++++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -201,6 +201,7 @@ struct exynos_drm_private {
struct device *g2d_dev;
struct device *dma_dev;
+ struct device *vidi_dev;
void *mapping;
/* for atomic commit */
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -223,9 +223,14 @@ ATTRIBUTE_GROUPS(vidi);
int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
struct drm_file *file_priv)
{
- struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);
+ struct exynos_drm_private *priv = drm_dev->dev_private;
+ struct device *dev = priv ? priv->vidi_dev : NULL;
+ struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;
struct drm_exynos_vidi_connection *vidi = data;
+ if (!ctx)
+ return -ENODEV;
+
if (!vidi) {
DRM_DEV_DEBUG_KMS(ctx->dev,
"user data for vidi is null.\n");
@@ -385,6 +390,7 @@ static int vidi_bind(struct device *dev,
{
struct vidi_context *ctx = dev_get_drvdata(dev);
struct drm_device *drm_dev = data;
+ struct exynos_drm_private *priv = drm_dev->dev_private;
struct drm_encoder *encoder = &ctx->encoder;
struct exynos_drm_plane *exynos_plane;
struct exynos_drm_plane_config plane_config = { 0 };
@@ -392,6 +398,8 @@ static int vidi_bind(struct device *dev,
int ret;
ctx->drm_dev = drm_dev;
+ if (priv)
+ priv->vidi_dev = dev;
plane_config.pixel_formats = formats;
plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@@ -437,8 +445,12 @@ static int vidi_bind(struct device *dev,
static void vidi_unbind(struct device *dev, struct device *master, void *data)
{
struct vidi_context *ctx = dev_get_drvdata(dev);
+ struct drm_device *drm_dev = data;
+ struct exynos_drm_private *priv = drm_dev->dev_private;
del_timer_sync(&ctx->timer);
+ if (priv)
+ priv->vidi_dev = NULL;
}
static const struct component_ops vidi_component_ops = {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 155/491] drm/exynos: vidi: fix to avoid directly dereferencing user pointer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 154/491] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 156/491] drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Greg Kroah-Hartman
` (340 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeongjun Park, Inki Dae
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
commit d4c98c077c7fb2dfdece7d605e694b5ea2665085 upstream.
In vidi_connection_ioctl(), vidi->edid(user pointer) is directly
dereferenced in the kernel.
This allows arbitrary kernel memory access from the user space, so instead
of directly accessing the user pointer in the kernel, we should modify it
to copy edid to kernel memory using copy_from_user() and use it.
Cc: <stable@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -251,19 +251,26 @@ int vidi_connection_ioctl(struct drm_dev
if (vidi->connection) {
struct edid *raw_edid;
+ struct edid edid_buf;
+ void *edid_userptr = u64_to_user_ptr(vidi->edid);
- raw_edid = (struct edid *)(unsigned long)vidi->edid;
- if (!drm_edid_is_valid(raw_edid)) {
+ if (copy_from_user(&edid_buf, edid_userptr, sizeof(struct edid)))
+ return -EFAULT;
+
+ if (!drm_edid_is_valid(&edid_buf)) {
DRM_DEV_DEBUG_KMS(ctx->dev,
"edid data is invalid.\n");
return -EINVAL;
}
- ctx->raw_edid = drm_edid_duplicate(raw_edid);
- if (!ctx->raw_edid) {
+
+ raw_edid = drm_edid_duplicate(&edid_buf);
+
+ if (!raw_edid) {
DRM_DEV_DEBUG_KMS(ctx->dev,
"failed to allocate raw_edid.\n");
return -ENOMEM;
}
+ ctx->raw_edid = raw_edid;
} else {
/*
* with connection = 0, free raw_edid
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 156/491] drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 155/491] drm/exynos: vidi: fix to avoid directly dereferencing user pointer Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 157/491] ext4: dont set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O Greg Kroah-Hartman
` (339 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeongjun Park, Inki Dae
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
commit 52b330799e2d6f825ae2bb74662ec1b10eb954bb upstream.
Exynos Virtual Display driver performs memory alloc/free operations
without lock protection, which easily causes concurrency problem.
For example, use-after-free can occur in race scenario like this:
```
CPU0 CPU1 CPU2
---- ---- ----
vidi_connection_ioctl()
if (vidi->connection) // true
drm_edid = drm_edid_alloc(); // alloc drm_edid
...
ctx->raw_edid = drm_edid;
...
drm_mode_getconnector()
drm_helper_probe_single_connector_modes()
vidi_get_modes()
if (ctx->raw_edid) // true
drm_edid_dup(ctx->raw_edid);
if (!drm_edid) // false
...
vidi_connection_ioctl()
if (vidi->connection) // false
drm_edid_free(ctx->raw_edid); // free drm_edid
...
drm_edid_alloc(drm_edid->edid)
kmemdup(edid); // UAF!!
...
```
To prevent these vulns, at least in vidi_context, member variables related
to memory alloc/free should be protected with ctx->lock.
Cc: <stable@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 43 +++++++++++++++++++++++++------
1 file changed, 35 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -185,15 +185,17 @@ static ssize_t vidi_store_connection(str
const char *buf, size_t len)
{
struct vidi_context *ctx = dev_get_drvdata(dev);
- int ret;
+ int ret, new_connected;
- ret = kstrtoint(buf, 0, &ctx->connected);
+ ret = kstrtoint(buf, 0, &new_connected);
if (ret)
return ret;
- if (ctx->connected > 1)
+ if (new_connected > 1)
return -EINVAL;
+ mutex_lock(&ctx->lock);
+
/* use fake edid data for test. */
if (!ctx->raw_edid)
ctx->raw_edid = (struct edid *)fake_edid_info;
@@ -201,14 +203,21 @@ static ssize_t vidi_store_connection(str
/* if raw_edid isn't same as fake data then it can't be tested. */
if (ctx->raw_edid != (struct edid *)fake_edid_info) {
DRM_DEV_DEBUG_KMS(dev, "edid data is not fake data.\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto fail;
}
+ ctx->connected = new_connected;
+ mutex_unlock(&ctx->lock);
+
DRM_DEV_DEBUG_KMS(dev, "requested connection.\n");
drm_helper_hpd_irq_event(ctx->drm_dev);
return len;
+fail:
+ mutex_unlock(&ctx->lock);
+ return ret;
}
static DEVICE_ATTR(connection, 0644, vidi_show_connection,
@@ -243,11 +252,14 @@ int vidi_connection_ioctl(struct drm_dev
return -EINVAL;
}
+ mutex_lock(&ctx->lock);
if (ctx->connected == vidi->connection) {
+ mutex_unlock(&ctx->lock);
DRM_DEV_DEBUG_KMS(ctx->dev,
"same connection request.\n");
return -EINVAL;
}
+ mutex_unlock(&ctx->lock);
if (vidi->connection) {
struct edid *raw_edid;
@@ -270,20 +282,27 @@ int vidi_connection_ioctl(struct drm_dev
"failed to allocate raw_edid.\n");
return -ENOMEM;
}
+ mutex_lock(&ctx->lock);
ctx->raw_edid = raw_edid;
+ mutex_unlock(&ctx->lock);
} else {
/*
* with connection = 0, free raw_edid
* only if raw edid data isn't same as fake data.
*/
+ mutex_lock(&ctx->lock);
if (ctx->raw_edid && ctx->raw_edid !=
(struct edid *)fake_edid_info) {
kfree(ctx->raw_edid);
ctx->raw_edid = NULL;
}
+ mutex_unlock(&ctx->lock);
}
+ mutex_lock(&ctx->lock);
ctx->connected = vidi->connection;
+ mutex_unlock(&ctx->lock);
+
drm_helper_hpd_irq_event(ctx->drm_dev);
return 0;
@@ -298,7 +317,7 @@ static enum drm_connector_status vidi_de
* connection request would come from user side
* to do hotplug through specific ioctl.
*/
- return ctx->connected ? connector_status_connected :
+ return READ_ONCE(ctx->connected) ? connector_status_connected :
connector_status_disconnected;
}
@@ -320,22 +339,24 @@ static int vidi_get_modes(struct drm_con
struct vidi_context *ctx = ctx_from_connector(connector);
struct edid *edid;
int edid_len;
- int count;
+ int count = 0;
/*
* the edid data comes from user side and it would be set
* to ctx->raw_edid through specific ioctl.
*/
+
+ mutex_lock(&ctx->lock);
if (!ctx->raw_edid) {
DRM_DEV_DEBUG_KMS(ctx->dev, "raw_edid is null.\n");
- return 0;
+ goto fail;
}
edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
edid = kmemdup(ctx->raw_edid, edid_len, GFP_KERNEL);
if (!edid) {
DRM_DEV_DEBUG_KMS(ctx->dev, "failed to allocate edid\n");
- return 0;
+ goto fail;
}
drm_connector_update_edid_property(connector, edid);
@@ -344,6 +365,8 @@ static int vidi_get_modes(struct drm_con
kfree(edid);
+fail:
+ mutex_unlock(&ctx->lock);
return count;
}
@@ -489,11 +512,15 @@ static int vidi_remove(struct platform_d
{
struct vidi_context *ctx = platform_get_drvdata(pdev);
+ mutex_lock(&ctx->lock);
+
if (ctx->raw_edid != (struct edid *)fake_edid_info) {
kfree(ctx->raw_edid);
ctx->raw_edid = NULL;
}
+ mutex_unlock(&ctx->lock);
+
component_del(&pdev->dev, &vidi_component_ops);
return 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 157/491] ext4: dont set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 156/491] drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 158/491] ext4: drop extent cache when splitting extent fails Greg Kroah-Hartman
` (338 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Ojaswin Mujoo, Baokun Li,
stable, Theodore Tso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit feaf2a80e78f89ee8a3464126077ba8683b62791 ]
When allocating blocks during within-EOF DIO and writeback with
dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an
existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was
set when calling ext4_split_convert_extents(), which may potentially
result in stale data issues.
Assume we have an unwritten extent, and then DIO writes the second half.
[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUUUUUU] extent status tree
|<- ->| ----> dio write this range
First, ext4_iomap_alloc() call ext4_map_blocks() with
EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and
EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and
call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the
above flags set.
Then, ext4_split_convert_extents() calls ext4_split_extent() with
EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2
flags set, and it calls ext4_split_extent_at() to split the second half
with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT
and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at()
failed to insert extent since a temporary lack -ENOSPC. It zeroes out
the first half but convert the entire on-disk extent to written since
the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten
in the extent status tree.
[0000000000SSSSSS] data S: stale data, 0: zeroed
[WWWWWWWWWWWWWWWW] on-disk extent W: written extent
[WWWWWWWWWWUUUUUU] extent status tree
Finally, if the DIO failed to write data to the disk, the stale data in
the second half will be exposed once the cached extent entry is gone.
Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting
an unwritten extent before submitting I/O, and make
ext4_split_convert_extents() to zero out the entire extent range
to zero for this case, and also mark the extent in the extent status
tree for consistency.
Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Cc: stable@kernel.org
Message-ID: <20251129103247.686136-4-yi.zhang@huaweicloud.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[ different function signatures ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3705,11 +3705,15 @@ static int ext4_split_convert_extents(ha
/* Convert to unwritten */
if (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN) {
split_flag |= EXT4_EXT_DATA_VALID1;
- /* Convert to initialized */
- } else if (flags & EXT4_GET_BLOCKS_CONVERT) {
+ /* Split the existing unwritten extent */
+ } else if (flags & (EXT4_GET_BLOCKS_UNWRIT_EXT |
+ EXT4_GET_BLOCKS_CONVERT)) {
split_flag |= ee_block + ee_len <= eof_block ?
EXT4_EXT_MAY_ZEROOUT : 0;
- split_flag |= (EXT4_EXT_MARK_UNWRIT2 | EXT4_EXT_DATA_VALID2);
+ split_flag |= EXT4_EXT_MARK_UNWRIT2;
+ /* Convert to initialized */
+ if (flags & EXT4_GET_BLOCKS_CONVERT)
+ split_flag |= EXT4_EXT_DATA_VALID2;
}
flags |= EXT4_GET_BLOCKS_PRE_IO;
return ext4_split_extent(handle, inode, ppath, map, split_flag, flags);
@@ -3874,7 +3878,7 @@ ext4_ext_handle_unwritten_extents(handle
/* get_block() before submitting IO, split the extent */
if (flags & EXT4_GET_BLOCKS_PRE_IO) {
ret = ext4_split_convert_extents(handle, inode, map, ppath,
- flags | EXT4_GET_BLOCKS_CONVERT);
+ flags);
if (ret < 0) {
err = ret;
goto out2;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 158/491] ext4: drop extent cache when splitting extent fails
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 157/491] ext4: dont set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 159/491] ext4: fix dirtyclusters double decrement on fs shutdown Greg Kroah-Hartman
` (337 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Baokun Li, stable,
Ojaswin Mujoo, Theodore Tso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 ]
When the split extent fails, we might leave some extents still being
processed and return an error directly, which will result in stale
extent entries remaining in the extent status tree. So drop all of the
remaining potentially stale extents if the splitting fails.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Cc: stable@kernel.org
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Message-ID: <20251129103247.686136-8-yi.zhang@huaweicloud.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[ bring error handling pattern closer to upstream ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3231,7 +3231,9 @@ static int ext4_split_extent_at(handle_t
ext4_ext_mark_unwritten(ex2);
err = ext4_ext_insert_extent(handle, inode, ppath, &newex, flags);
- if (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM)
+ if (err && err != -ENOSPC && err != -EDQUOT && err != -ENOMEM)
+ goto out_err;
+ if (!err)
goto out;
/*
@@ -3247,7 +3249,8 @@ static int ext4_split_extent_at(handle_t
if (IS_ERR(path)) {
EXT4_ERROR_INODE(inode, "Failed split extent on %u, err %ld",
split, PTR_ERR(path));
- return PTR_ERR(path);
+ err = PTR_ERR(path);
+ goto out_err;
}
depth = ext_depth(inode);
ex = path[depth].p_ext;
@@ -3303,6 +3306,9 @@ fix_extent_len:
*/
ext4_ext_dirty(handle, inode, path + path->p_depth);
return err;
+out_err:
+ /* Remove all remaining potentially stale extents. */
+ ext4_es_remove_extent(inode, ee_block, ee_len);
out:
ext4_ext_show_leaf(inode, *ppath);
return err;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 159/491] ext4: fix dirtyclusters double decrement on fs shutdown
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 158/491] ext4: drop extent cache when splitting extent fails Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 160/491] ata: libata: remove pointless VPRINTK() calls Greg Kroah-Hartman
` (336 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Foster, Baokun Li,
Theodore Tso, stable, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <bfoster@redhat.com>
[ Upstream commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 ]
fstests test generic/388 occasionally reproduces a warning in
ext4_put_super() associated with the dirty clusters count:
WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]
Tracing the failure shows that the warning fires due to an
s_dirtyclusters_counter value of -1. IOW, this appears to be a
spurious decrement as opposed to some sort of leak. Further tracing
of the dirty cluster count deltas and an LLM scan of the resulting
output identified the cause as a double decrement in the error path
between ext4_mb_mark_diskspace_used() and the caller
ext4_mb_new_blocks().
First, note that generic/388 is a shutdown vs. fsstress test and so
produces a random set of operations and shutdown injections. In the
problematic case, the shutdown triggers an error return from the
ext4_handle_dirty_metadata() call(s) made from
ext4_mb_mark_context(). The changed value is non-zero at this point,
so ext4_mb_mark_diskspace_used() does not exit after the error
bubbles up from ext4_mb_mark_context(). Instead, the former
decrements both cluster counters and returns the error up to
ext4_mb_new_blocks(). The latter falls into the !ar->len out path
which decrements the dirty clusters counter a second time, creating
the inconsistency.
To avoid this problem and simplify ownership of the cluster
reservation in this codepath, lift the counter reduction to a single
place in the caller. This makes it more clear that
ext4_mb_new_blocks() is responsible for acquiring cluster
reservation (via ext4_claim_free_clusters()) in the !delalloc case
as well as releasing it, regardless of whether it ends up consumed
or returned due to failure.
Fixes: 0087d9fb3f29 ("ext4: Fix s_dirty_blocks_counter if block allocation failed with nodelalloc")
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Link: https://patch.msgid.link/20260113171905.118284-1-bfoster@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
[ Drop mballoc-test changes ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 21 +++++----------------
1 file changed, 5 insertions(+), 16 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3308,8 +3308,7 @@ void ext4_exit_mballoc(void)
* Returns 0 if success or error code
*/
static noinline_for_stack int
-ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- handle_t *handle, unsigned int reserv_clstrs)
+ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, handle_t *handle)
{
struct buffer_head *bitmap_bh = NULL;
struct ext4_group_desc *gdp;
@@ -3396,13 +3395,6 @@ ext4_mb_mark_diskspace_used(struct ext4_
ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
percpu_counter_sub(&sbi->s_freeclusters_counter, ac->ac_b_ex.fe_len);
- /*
- * Now reduce the dirty block count also. Should not go negative
- */
- if (!(ac->ac_flags & EXT4_MB_DELALLOC_RESERVED))
- /* release all the reserved blocks if non delalloc */
- percpu_counter_sub(&sbi->s_dirtyclusters_counter,
- reserv_clstrs);
if (sbi->s_log_groups_per_flex) {
ext4_group_t flex_group = ext4_flex_group(sbi,
@@ -5271,7 +5263,7 @@ repeat:
ext4_mb_pa_free(ac);
}
if (likely(ac->ac_status == AC_STATUS_FOUND)) {
- *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs);
+ *errp = ext4_mb_mark_diskspace_used(ac, handle);
if (*errp) {
ext4_discard_allocated_blocks(ac);
goto errout;
@@ -5303,12 +5295,9 @@ out:
kmem_cache_free(ext4_ac_cachep, ac);
if (inquota && ar->len < inquota)
dquot_free_block(ar->inode, EXT4_C2B(sbi, inquota - ar->len));
- if (!ar->len) {
- if ((ar->flags & EXT4_MB_DELALLOC_RESERVED) == 0)
- /* release all the reserved blocks if non delalloc */
- percpu_counter_sub(&sbi->s_dirtyclusters_counter,
- reserv_clstrs);
- }
+ /* release any reserved blocks */
+ if (reserv_clstrs)
+ percpu_counter_sub(&sbi->s_dirtyclusters_counter, reserv_clstrs);
trace_ext4_allocate_blocks(ar, (unsigned long long)block);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 160/491] ata: libata: remove pointless VPRINTK() calls
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 159/491] ext4: fix dirtyclusters double decrement on fs shutdown Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 161/491] ata: libata-scsi: refactor ata_scsi_translate() Greg Kroah-Hartman
` (335 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Damien Le Moal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <hare@suse.de>
[ Upstream commit e1553351d747cbcd62db01d579dff916edcc782c ]
Most of the information is already covered by tracepoints
(if not downright pointless), so remove the VPRINTK() calls.
And while we're at it, remove ata_scsi_dump_cdb(), too,
as this information can be retrieved from scsi tracing.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Stable-dep-of: bb3a8154b1a1 ("ata: libata-scsi: refactor ata_scsi_translate()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 3 ---
drivers/ata/libata-sata.c | 2 --
drivers/ata/libata-scsi.c | 42 ------------------------------------------
drivers/ata/libata-sff.c | 4 ----
drivers/ata/libata.h | 1 -
5 files changed, 52 deletions(-)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4461,8 +4461,6 @@ static void ata_sg_clean(struct ata_queu
WARN_ON_ONCE(sg == NULL);
- VPRINTK("unmapping %u sg elements\n", qc->n_elem);
-
if (qc->n_elem)
dma_unmap_sg(ap->dev, sg, qc->orig_n_elem, dir);
@@ -4494,7 +4492,6 @@ static int ata_sg_setup(struct ata_queue
if (n_elem < 1)
return -1;
- VPRINTK("%d sg elements mapped\n", n_elem);
qc->orig_n_elem = qc->n_elem;
qc->n_elem = n_elem;
qc->flags |= ATA_QCFLAG_DMAMAP;
--- a/drivers/ata/libata-sata.c
+++ b/drivers/ata/libata-sata.c
@@ -1258,8 +1258,6 @@ int ata_sas_queuecmd(struct scsi_cmnd *c
{
int rc = 0;
- ata_scsi_dump_cdb(ap, cmd);
-
if (likely(ata_dev_enabled(ap->link.device)))
rc = __ata_scsi_queuecmd(cmd, ap->link.device);
else {
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1296,8 +1296,6 @@ static void scsi_6_lba_len(const u8 *cdb
u64 lba = 0;
u32 len;
- VPRINTK("six-byte command\n");
-
lba |= ((u64)(cdb[1] & 0x1f)) << 16;
lba |= ((u64)cdb[2]) << 8;
lba |= ((u64)cdb[3]);
@@ -1323,8 +1321,6 @@ static void scsi_10_lba_len(const u8 *cd
u64 lba = 0;
u32 len = 0;
- VPRINTK("ten-byte command\n");
-
lba |= ((u64)cdb[2]) << 24;
lba |= ((u64)cdb[3]) << 16;
lba |= ((u64)cdb[4]) << 8;
@@ -1352,8 +1348,6 @@ static void scsi_16_lba_len(const u8 *cd
u64 lba = 0;
u32 len = 0;
- VPRINTK("sixteen-byte command\n");
-
lba |= ((u64)cdb[2]) << 56;
lba |= ((u64)cdb[3]) << 48;
lba |= ((u64)cdb[4]) << 40;
@@ -1707,8 +1701,6 @@ static int ata_scsi_translate(struct ata
struct ata_queued_cmd *qc;
int rc;
- VPRINTK("ENTER\n");
-
qc = ata_scsi_qc_new(dev, cmd);
if (!qc)
goto err_mem;
@@ -1739,7 +1731,6 @@ static int ata_scsi_translate(struct ata
/* select device, send command to hardware */
ata_qc_issue(qc);
- VPRINTK("EXIT\n");
return 0;
early_finish:
@@ -1897,8 +1888,6 @@ static unsigned int ata_scsiop_inq_std(s
2
};
- VPRINTK("ENTER\n");
-
/* set scsi removable (RMB) bit per ata bit, or if the
* AHCI port says it's external (Hotplug-capable, eSATA).
*/
@@ -2309,8 +2298,6 @@ static unsigned int ata_scsiop_mode_sens
u8 dpofua, bp = 0xff;
u16 fp;
- VPRINTK("ENTER\n");
-
six_byte = (scsicmd[0] == MODE_SENSE);
ebd = !(scsicmd[1] & 0x8); /* dbd bit inverted == edb */
/*
@@ -2428,8 +2415,6 @@ static unsigned int ata_scsiop_read_cap(
log2_per_phys = ata_id_log2_per_physical_sector(dev->id);
lowest_aligned = ata_id_logical_sector_offset(dev->id, log2_per_phys);
- VPRINTK("ENTER\n");
-
if (args->cmd->cmnd[0] == READ_CAPACITY) {
if (last_lba >= 0xffffffffULL)
last_lba = 0xffffffff;
@@ -2496,7 +2481,6 @@ static unsigned int ata_scsiop_read_cap(
*/
static unsigned int ata_scsiop_report_luns(struct ata_scsi_args *args, u8 *rbuf)
{
- VPRINTK("ENTER\n");
rbuf[3] = 8; /* just one lun, LUN 0, size 8 bytes */
return 0;
@@ -2596,8 +2580,6 @@ static void atapi_qc_complete(struct ata
struct scsi_cmnd *cmd = qc->scsicmd;
unsigned int err_mask = qc->err_mask;
- VPRINTK("ENTER, err_mask 0x%X\n", err_mask);
-
/* handle completion from new EH */
if (unlikely(qc->ap->ops->error_handler &&
(err_mask || qc->flags & ATA_QCFLAG_SENSE_VALID))) {
@@ -3732,8 +3714,6 @@ static unsigned int ata_scsi_mode_select
u8 buffer[64];
const u8 *p = buffer;
- VPRINTK("ENTER\n");
-
six_byte = (cdb[0] == MODE_SELECT);
if (six_byte) {
if (scmd->cmd_len < 5) {
@@ -4032,26 +4012,6 @@ static inline ata_xlat_func_t ata_get_xl
return NULL;
}
-/**
- * ata_scsi_dump_cdb - dump SCSI command contents to dmesg
- * @ap: ATA port to which the command was being sent
- * @cmd: SCSI command to dump
- *
- * Prints the contents of a SCSI command via printk().
- */
-
-void ata_scsi_dump_cdb(struct ata_port *ap, struct scsi_cmnd *cmd)
-{
-#ifdef ATA_VERBOSE_DEBUG
- struct scsi_device *scsidev = cmd->device;
-
- VPRINTK("CDB (%u:%d,%d,%lld) %9ph\n",
- ap->print_id,
- scsidev->channel, scsidev->id, scsidev->lun,
- cmd->cmnd);
-#endif
-}
-
int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev)
{
struct ata_port *ap = dev->link->ap;
@@ -4139,8 +4099,6 @@ int ata_scsi_queuecmd(struct Scsi_Host *
spin_lock_irqsave(ap->lock, irq_flags);
- ata_scsi_dump_cdb(ap, cmd);
-
dev = ata_scsi_find_dev(ap, scsidev);
if (likely(dev))
rc = __ata_scsi_queuecmd(cmd, dev);
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -888,8 +888,6 @@ static void atapi_pio_bytes(struct ata_q
if (unlikely(!bytes))
goto atapi_check;
- VPRINTK("ata%u: xfering %d bytes\n", ap->print_id, bytes);
-
if (unlikely(__atapi_pio_bytes(qc, bytes)))
goto err_out;
ata_sff_sync(ap); /* flush */
@@ -2614,7 +2612,6 @@ static void ata_bmdma_fill_sg(struct ata
prd[pi].addr = cpu_to_le32(addr);
prd[pi].flags_len = cpu_to_le32(len & 0xffff);
- VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", pi, addr, len);
pi++;
sg_len -= len;
@@ -2674,7 +2671,6 @@ static void ata_bmdma_fill_sg_dumb(struc
prd[++pi].addr = cpu_to_le32(addr + 0x8000);
}
prd[pi].flags_len = cpu_to_le32(blen);
- VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", pi, addr, len);
pi++;
sg_len -= len;
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -150,7 +150,6 @@ extern int ata_scsi_user_scan(struct Scs
unsigned int id, u64 lun);
void ata_scsi_sdev_config(struct scsi_device *sdev);
int ata_scsi_dev_config(struct scsi_device *sdev, struct ata_device *dev);
-void ata_scsi_dump_cdb(struct ata_port *ap, struct scsi_cmnd *cmd);
int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev);
/* libata-eh.c */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 161/491] ata: libata-scsi: refactor ata_scsi_translate()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 160/491] ata: libata: remove pointless VPRINTK() calls Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 162/491] wifi: libertas: fix use-after-free in lbs_free_adapter() Greg Kroah-Hartman
` (334 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Martin K. Petersen, John Garry, Igor Pylypiv, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
[ Upstream commit bb3a8154b1a1dc2c86d037482c0a2cf9186829ed ]
Factor out of ata_scsi_translate() the code handling queued command
deferral using the port qc_defer callback and issuing the queued
command with ata_qc_issue() into the new function ata_scsi_qc_issue(),
and simplify the goto used in ata_scsi_translate().
While at it, also add a lockdep annotation to check that the port lock
is held when ata_scsi_translate() is called.
No functional changes.
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
[ scsi_done(cmd) => cmd->scsi_done(cmd) + DPRINTK ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 83 +++++++++++++++++++++++++++-------------------
1 file changed, 50 insertions(+), 33 deletions(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1668,6 +1668,42 @@ static void ata_scsi_qc_complete(struct
ata_qc_done(qc);
}
+static int ata_scsi_qc_issue(struct ata_port *ap, struct ata_queued_cmd *qc)
+{
+ int ret;
+
+ if (!ap->ops->qc_defer)
+ goto issue;
+
+ /* Check if the command needs to be deferred. */
+ ret = ap->ops->qc_defer(qc);
+ switch (ret) {
+ case 0:
+ break;
+ case ATA_DEFER_LINK:
+ ret = SCSI_MLQUEUE_DEVICE_BUSY;
+ break;
+ case ATA_DEFER_PORT:
+ ret = SCSI_MLQUEUE_HOST_BUSY;
+ break;
+ default:
+ WARN_ON_ONCE(1);
+ ret = SCSI_MLQUEUE_HOST_BUSY;
+ break;
+ }
+
+ if (ret) {
+ /* Force a requeue of the command to defer its execution. */
+ ata_qc_free(qc);
+ return ret;
+ }
+
+issue:
+ ata_qc_issue(qc);
+
+ return 0;
+}
+
/**
* ata_scsi_translate - Translate then issue SCSI command to ATA device
* @dev: ATA device to which the command is addressed
@@ -1691,69 +1727,50 @@ static void ata_scsi_qc_complete(struct
* spin_lock_irqsave(host lock)
*
* RETURNS:
- * 0 on success, SCSI_ML_QUEUE_DEVICE_BUSY if the command
- * needs to be deferred.
+ * 0 on success, SCSI_ML_QUEUE_DEVICE_BUSY or SCSI_MLQUEUE_HOST_BUSY if the
+ * command needs to be deferred.
*/
static int ata_scsi_translate(struct ata_device *dev, struct scsi_cmnd *cmd,
ata_xlat_func_t xlat_func)
{
struct ata_port *ap = dev->link->ap;
struct ata_queued_cmd *qc;
- int rc;
+ lockdep_assert_held(ap->lock);
+
+ /*
+ * ata_scsi_qc_new() calls scsi_done(cmd) in case of failure. So we
+ * have nothing further to do when allocating a qc fails.
+ */
qc = ata_scsi_qc_new(dev, cmd);
if (!qc)
- goto err_mem;
+ return 0;
/* data is present; dma-map it */
if (cmd->sc_data_direction == DMA_FROM_DEVICE ||
cmd->sc_data_direction == DMA_TO_DEVICE) {
if (unlikely(scsi_bufflen(cmd) < 1)) {
ata_dev_warn(dev, "WARNING: zero len r/w req\n");
- goto err_did;
+ cmd->result = (DID_ERROR << 16);
+ goto done;
}
ata_sg_init(qc, scsi_sglist(cmd), scsi_sg_count(cmd));
-
qc->dma_dir = cmd->sc_data_direction;
}
qc->complete_fn = ata_scsi_qc_complete;
if (xlat_func(qc))
- goto early_finish;
-
- if (ap->ops->qc_defer) {
- if ((rc = ap->ops->qc_defer(qc)))
- goto defer;
- }
+ goto done;
- /* select device, send command to hardware */
- ata_qc_issue(qc);
-
- return 0;
+ return ata_scsi_qc_issue(ap, qc);
-early_finish:
+done:
ata_qc_free(qc);
cmd->scsi_done(cmd);
DPRINTK("EXIT - early finish (good or error)\n");
return 0;
-
-err_did:
- ata_qc_free(qc);
- cmd->result = (DID_ERROR << 16);
- cmd->scsi_done(cmd);
-err_mem:
- DPRINTK("EXIT - internal\n");
- return 0;
-
-defer:
- ata_qc_free(qc);
- DPRINTK("EXIT - defer\n");
- if (rc == ATA_DEFER_LINK)
- return SCSI_MLQUEUE_DEVICE_BUSY;
- else
- return SCSI_MLQUEUE_HOST_BUSY;
}
struct ata_scsi_args {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 162/491] wifi: libertas: fix use-after-free in lbs_free_adapter()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 161/491] ata: libata-scsi: refactor ata_scsi_translate() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 163/491] wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() Greg Kroah-Hartman
` (333 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Hodges, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <git@danielhodges.dev>
[ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ]
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.
If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.
Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.
Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware")
Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ del_timer() => timer_delete_sync() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/libertas/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -882,8 +882,8 @@ static void lbs_free_adapter(struct lbs_
{
lbs_free_cmd_buffer(priv);
kfifo_free(&priv->event_fifo);
- del_timer(&priv->command_timer);
- del_timer(&priv->tx_lockup_timer);
+ timer_delete_sync(&priv->command_timer);
+ timer_delete_sync(&priv->tx_lockup_timer);
del_timer(&priv->auto_deepsleep_timer);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 163/491] wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 162/491] wifi: libertas: fix use-after-free in lbs_free_adapter() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 164/491] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Greg Kroah-Hartman
` (332 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vahagn Vardanian, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vahagn Vardanian <vahagn@redrays.io>
[ Upstream commit 017c1792525064a723971f0216e6ef86a8c7af11 ]
In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
at lines 1638 and 1642 without a prior NULL check:
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
...
pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
The mesh_matches_local() check above only validates the Mesh ID,
Mesh Configuration, and Supported Rates IEs. It does not verify the
presence of the Mesh Channel Switch Parameters IE (element ID 118).
When a received CSA action frame omits that IE, ieee802_11_parse_elems()
leaves elems->mesh_chansw_params_ie as NULL, and the unconditional
dereference causes a kernel NULL pointer dereference.
A remote mesh peer with an established peer link (PLINK_ESTAB) can
trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame
that includes a matching Mesh ID and Mesh Configuration IE but omits the
Mesh Channel Switch Parameters IE. No authentication beyond the default
open mesh peering is required.
Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]
CR2: 0000000000000000
Fix by adding a NULL check for mesh_chansw_params_ie after
mesh_matches_local() returns, consistent with how other optional IEs
are guarded throughout the mesh code.
The bug has been present since v3.13 (released 2014-01-19).
Fixes: 8f2535b92d68 ("mac80211: process the CSA frame for mesh accordingly")
Cc: stable@vger.kernel.org
Signed-off-by: Vahagn Vardanian <vahagn@redrays.io>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ adapted pointer access elems-> to stack struct elems, and replaced goto free with return ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mesh.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1435,6 +1435,9 @@ static void mesh_rx_csa_frame(struct iee
if (!mesh_matches_local(sdata, &elems))
return;
+ if (!elems.mesh_chansw_params_ie)
+ return;
+
ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
if (!--ifmsh->chsw_ttl)
fwd_csa = false;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 164/491] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 163/491] wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 165/491] smb: client: Dont log plaintext credentials in cifs_set_cifscreds Greg Kroah-Hartman
` (331 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniil Dulov, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit 767d23ade706d5fa51c36168e92a9c5533c351a1 ]
There is a use-after-free error in cfg80211_shutdown_all_interfaces found
by syzkaller:
BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220
Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326
CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: events cfg80211_rfkill_block_work
Call Trace:
<TASK>
dump_stack_lvl+0x116/0x1f0
print_report+0xcd/0x630
kasan_report+0xe0/0x110
cfg80211_shutdown_all_interfaces+0x213/0x220
cfg80211_rfkill_block_work+0x1e/0x30
process_one_work+0x9cf/0x1b70
worker_thread+0x6c8/0xf10
kthread+0x3c5/0x780
ret_from_fork+0x56d/0x700
ret_from_fork_asm+0x1a/0x30
</TASK>
The problem arises due to the rfkill_block work is not cancelled when wiphy
is being unregistered. In order to fix the issue cancel the corresponding
work in wiphy_unregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support")
Cc: stable@vger.kernel.org
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ Context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1046,6 +1046,7 @@ void wiphy_unregister(struct wiphy *wiph
rtnl_unlock();
flush_work(&rdev->scan_done_wk);
+ cancel_work_sync(&rdev->rfkill_block);
cancel_work_sync(&rdev->conn_work);
flush_work(&rdev->event_work);
cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 165/491] smb: client: Dont log plaintext credentials in cifs_set_cifscreds
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 164/491] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 166/491] net: phy: register phy led_triggers during probe to avoid AB-BA deadlock Greg Kroah-Hartman
` (330 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
Thorsten Blum, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d ]
When debug logging is enabled, cifs_set_cifscreds() logs the key
payload and exposes the plaintext username and password. Remove the
debug log to avoid exposing credentials.
Fixes: 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts")
Cc: stable@vger.kernel.org
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 1 -
1 file changed, 1 deletion(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2951,7 +2951,6 @@ cifs_set_cifscreds(struct smb_vol *vol,
/* find first : in payload */
payload = upayload->data;
delim = strnchr(payload, upayload->datalen, ':');
- cifs_dbg(FYI, "payload=%s\n", payload);
if (!delim) {
cifs_dbg(FYI, "Unable to find ':' in payload (datalen=%d)\n",
upayload->datalen);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 166/491] net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 165/491] smb: client: Dont log plaintext credentials in cifs_set_cifscreds Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 167/491] drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink Greg Kroah-Hartman
` (329 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shiji Yang, Andrew Lunn, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <andrew@lunn.ch>
[ Upstream commit c8dbdc6e380e7e96a51706db3e4b7870d8a9402d ]
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to get lock "triggers_list_lock" via down_write(&triggers_list_lock);
[ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0
[ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0
[ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c
[ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78
[ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654 <-- Hold lock "rtnl_mutex" by calling rtnl_lock();
[ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [<80014504>] syscall_common+0x34/0x58
Here LED_TRIGGER_PHY is registering LED triggers during phy_attach
while holding RTNL and then taking triggers_list_lock.
[ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168 <-- Trying to get lock "rtnl_mutex" via rtnl_lock();
[ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4
[ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360 <-- Hold lock "triggers_list_lock" by down_read(&triggers_list_lock);
[ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c
[ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc
[ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c
[ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4
[ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c
[ 1362.232164] [<80014504>] syscall_common+0x34/0x58
Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes
triggers_list_lock and then RTNL. A classical AB-BA deadlock.
phy_led_triggers_registers() does not require the RTNL, it does not
make any calls into the network stack which require protection. There
is also no requirement the PHY has been attached to a MAC, the
triggers only make use of phydev state. This allows the call to
phy_led_triggers_registers() to be placed elsewhere. PHY probe() and
release() don't hold RTNL, so solving the AB-BA deadlock.
Reported-by: Shiji Yang <yangshiji66@outlook.com>
Closes: https://lore.kernel.org/all/OS7PR01MB13602B128BA1AD3FA38B6D1FFBC69A@OS7PR01MB13602.jpnprd01.prod.outlook.com/
Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://patch.msgid.link/20260222152601.1978655-1-andrew@lunn.ch
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ dropped `is_on_sfp_module` guards and `CONFIG_PHYLIB_LEDS`/`of_phy_leds` logic ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/phy_device.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1412,7 +1412,6 @@ int phy_attach_direct(struct net_device
return err;
phy_resume(phydev);
- phy_led_triggers_register(phydev);
return err;
@@ -1669,8 +1668,6 @@ void phy_detach(struct phy_device *phyde
}
phydev->phylink = NULL;
- phy_led_triggers_unregister(phydev);
-
if (phydev->mdio.dev.driver)
module_put(phydev->mdio.dev.driver->owner);
@@ -2900,10 +2897,14 @@ static int phy_probe(struct device *dev)
/* Set the state to READY by default */
phydev->state = PHY_READY;
+ /* Register the PHY LED triggers */
+ phy_led_triggers_register(phydev);
+
+ return 0;
+
out:
/* Re-assert the reset signal on error */
- if (err)
- phy_device_reset(phydev, 1);
+ phy_device_reset(phydev, 1);
return err;
}
@@ -2914,6 +2915,8 @@ static int phy_remove(struct device *dev
cancel_delayed_work_sync(&phydev->state_queue);
+ phy_led_triggers_unregister(phydev);
+
phydev->state = PHY_DOWN;
sfp_bus_del_upstream(phydev->sfp_bus);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 167/491] drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 166/491] net: phy: register phy led_triggers during probe to avoid AB-BA deadlock Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 168/491] net/sched: act_gate: snapshot parameters with RCU on replace Greg Kroah-Hartman
` (328 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Natalie Vock, Alex Deucher,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Natalie Vock <natalie.vock@gmx.de>
[ Upstream commit 28dfe4317541e57fe52f9a290394cd29c348228b ]
This can be called while preemption is disabled, for example by
dcn32_internal_validate_bw which is called with the FPU active.
Fixes "BUG: scheduling while atomic" messages I encounter on my Navi31
machine.
Signed-off-by: Natalie Vock <natalie.vock@gmx.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b42dae2ebc5c84a68de63ec4ffdfec49362d53f1)
Cc: stable@vger.kernel.org
[ Context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -167,7 +167,7 @@ struct dc_stream_state *dc_create_stream
if (sink == NULL)
return NULL;
- stream = kzalloc(sizeof(struct dc_stream_state), GFP_KERNEL);
+ stream = kzalloc(sizeof(struct dc_stream_state), GFP_ATOMIC);
if (stream == NULL)
goto alloc_fail;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 168/491] net/sched: act_gate: snapshot parameters with RCU on replace
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 167/491] drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 169/491] s390/xor: Fix xor_xc_2() inline assembly constraints Greg Kroah-Hartman
` (327 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Moses, Vladimir Oltean,
Jamal Hadi Salim, Victor Nogueira, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moses <p@1g4.org>
[ Upstream commit 62413a9c3cb183afb9bb6e94dd68caf4e4145f4c ]
The gate action can be replaced while the hrtimer callback or dump path is
walking the schedule list.
Convert the parameters to an RCU-protected snapshot and swap updates under
tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits
the entry list, preserve the existing schedule so the effective state is
unchanged.
Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260223150512.2251594-2-p@1g4.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Different function signatures, hrtimer changes, context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tc_act/tc_gate.h | 33 ++++-
net/sched/act_gate.c | 266 ++++++++++++++++++++++++++++++-------------
2 files changed, 212 insertions(+), 87 deletions(-)
--- a/include/net/tc_act/tc_gate.h
+++ b/include/net/tc_act/tc_gate.h
@@ -32,6 +32,7 @@ struct tcf_gate_params {
s32 tcfg_clockid;
size_t num_entries;
struct list_head entries;
+ struct rcu_head rcu;
};
#define GATE_ACT_GATE_OPEN BIT(0)
@@ -39,7 +40,7 @@ struct tcf_gate_params {
struct tcf_gate {
struct tc_action common;
- struct tcf_gate_params param;
+ struct tcf_gate_params __rcu *param;
u8 current_gate_status;
ktime_t current_close_time;
u32 current_entry_octets;
@@ -65,47 +66,65 @@ static inline u32 tcf_gate_index(const s
return a->tcfa_index;
}
+static inline struct tcf_gate_params *tcf_gate_params_locked(const struct tc_action *a)
+{
+ struct tcf_gate *gact = to_gate(a);
+
+ return rcu_dereference_protected(gact->param,
+ lockdep_is_held(&gact->tcf_lock));
+}
+
static inline s32 tcf_gate_prio(const struct tc_action *a)
{
+ struct tcf_gate_params *p;
s32 tcfg_prio;
- tcfg_prio = to_gate(a)->param.tcfg_priority;
+ p = tcf_gate_params_locked(a);
+ tcfg_prio = p->tcfg_priority;
return tcfg_prio;
}
static inline u64 tcf_gate_basetime(const struct tc_action *a)
{
+ struct tcf_gate_params *p;
u64 tcfg_basetime;
- tcfg_basetime = to_gate(a)->param.tcfg_basetime;
+ p = tcf_gate_params_locked(a);
+ tcfg_basetime = p->tcfg_basetime;
return tcfg_basetime;
}
static inline u64 tcf_gate_cycletime(const struct tc_action *a)
{
+ struct tcf_gate_params *p;
u64 tcfg_cycletime;
- tcfg_cycletime = to_gate(a)->param.tcfg_cycletime;
+ p = tcf_gate_params_locked(a);
+ tcfg_cycletime = p->tcfg_cycletime;
return tcfg_cycletime;
}
static inline u64 tcf_gate_cycletimeext(const struct tc_action *a)
{
+ struct tcf_gate_params *p;
u64 tcfg_cycletimeext;
- tcfg_cycletimeext = to_gate(a)->param.tcfg_cycletime_ext;
+ p = tcf_gate_params_locked(a);
+ tcfg_cycletimeext = p->tcfg_cycletime_ext;
return tcfg_cycletimeext;
}
static inline u32 tcf_gate_num_entries(const struct tc_action *a)
{
+ struct tcf_gate_params *p;
u32 num_entries;
- num_entries = to_gate(a)->param.num_entries;
+ p = tcf_gate_params_locked(a);
+ num_entries = p->num_entries;
return num_entries;
}
@@ -119,7 +138,7 @@ static inline struct action_gate_entry
u32 num_entries;
int i = 0;
- p = &to_gate(a)->param;
+ p = tcf_gate_params_locked(a);
num_entries = p->num_entries;
list_for_each_entry(entry, &p->entries, list)
--- a/net/sched/act_gate.c
+++ b/net/sched/act_gate.c
@@ -32,9 +32,12 @@ static ktime_t gate_get_time(struct tcf_
return KTIME_MAX;
}
-static void gate_get_start_time(struct tcf_gate *gact, ktime_t *start)
+static void tcf_gate_params_free_rcu(struct rcu_head *head);
+
+static void gate_get_start_time(struct tcf_gate *gact,
+ const struct tcf_gate_params *param,
+ ktime_t *start)
{
- struct tcf_gate_params *param = &gact->param;
ktime_t now, base, cycle;
u64 n;
@@ -69,12 +72,14 @@ static enum hrtimer_restart gate_timer_f
{
struct tcf_gate *gact = container_of(timer, struct tcf_gate,
hitimer);
- struct tcf_gate_params *p = &gact->param;
struct tcfg_gate_entry *next;
+ struct tcf_gate_params *p;
ktime_t close_time, now;
spin_lock(&gact->tcf_lock);
+ p = rcu_dereference_protected(gact->param,
+ lockdep_is_held(&gact->tcf_lock));
next = gact->next_entry;
/* cycle start, clear pending bit, clear total octets */
@@ -227,6 +232,35 @@ static void release_entry_list(struct li
}
}
+static int tcf_gate_copy_entries(struct tcf_gate_params *dst,
+ const struct tcf_gate_params *src,
+ struct netlink_ext_ack *extack)
+{
+ struct tcfg_gate_entry *entry;
+ int i = 0;
+
+ list_for_each_entry(entry, &src->entries, list) {
+ struct tcfg_gate_entry *new;
+
+ new = kzalloc(sizeof(*new), GFP_ATOMIC);
+ if (!new) {
+ NL_SET_ERR_MSG(extack, "Not enough memory for entry");
+ return -ENOMEM;
+ }
+
+ new->index = entry->index;
+ new->gate_state = entry->gate_state;
+ new->interval = entry->interval;
+ new->ipv = entry->ipv;
+ new->maxoctets = entry->maxoctets;
+ list_add_tail(&new->list, &dst->entries);
+ i++;
+ }
+
+ dst->num_entries = i;
+ return 0;
+}
+
static int parse_gate_list(struct nlattr *list_attr,
struct tcf_gate_params *sched,
struct netlink_ext_ack *extack)
@@ -272,23 +306,42 @@ release_list:
return err;
}
-static void gate_setup_timer(struct tcf_gate *gact, u64 basetime,
- enum tk_offsets tko, s32 clockid,
- bool do_init)
-{
- if (!do_init) {
- if (basetime == gact->param.tcfg_basetime &&
- tko == gact->tk_offset &&
- clockid == gact->param.tcfg_clockid)
- return;
-
- spin_unlock_bh(&gact->tcf_lock);
- hrtimer_cancel(&gact->hitimer);
- spin_lock_bh(&gact->tcf_lock);
+static bool gate_timer_needs_cancel(u64 basetime, u64 old_basetime,
+ enum tk_offsets tko,
+ enum tk_offsets old_tko,
+ s32 clockid, s32 old_clockid)
+{
+ return basetime != old_basetime ||
+ clockid != old_clockid ||
+ tko != old_tko;
+}
+
+static int gate_clock_resolve(s32 clockid, enum tk_offsets *tko,
+ struct netlink_ext_ack *extack)
+{
+ switch (clockid) {
+ case CLOCK_REALTIME:
+ *tko = TK_OFFS_REAL;
+ return 0;
+ case CLOCK_MONOTONIC:
+ *tko = TK_OFFS_MAX;
+ return 0;
+ case CLOCK_BOOTTIME:
+ *tko = TK_OFFS_BOOT;
+ return 0;
+ case CLOCK_TAI:
+ *tko = TK_OFFS_TAI;
+ return 0;
+ default:
+ NL_SET_ERR_MSG(extack, "Invalid 'clockid'");
+ return -EINVAL;
}
- gact->param.tcfg_basetime = basetime;
- gact->param.tcfg_clockid = clockid;
- gact->tk_offset = tko;
+}
+
+static void gate_setup_timer(struct tcf_gate *gact, s32 clockid,
+ enum tk_offsets tko)
+{
+ WRITE_ONCE(gact->tk_offset, tko);
hrtimer_init(&gact->hitimer, clockid, HRTIMER_MODE_ABS_SOFT);
gact->hitimer.function = gate_timer_func;
}
@@ -300,14 +353,21 @@ static int tcf_gate_init(struct net *net
struct netlink_ext_ack *extack)
{
struct tc_action_net *tn = net_generic(net, gate_net_id);
- enum tk_offsets tk_offset = TK_OFFS_TAI;
+ u64 cycletime = 0, basetime = 0, cycletime_ext = 0;
+ struct tcf_gate_params *p = NULL, *old_p = NULL;
+ enum tk_offsets old_tk_offset = TK_OFFS_TAI;
+ const struct tcf_gate_params *cur_p = NULL;
struct nlattr *tb[TCA_GATE_MAX + 1];
+ enum tk_offsets tko = TK_OFFS_TAI;
struct tcf_chain *goto_ch = NULL;
- u64 cycletime = 0, basetime = 0;
- struct tcf_gate_params *p;
+ s32 timer_clockid = CLOCK_TAI;
+ bool use_old_entries = false;
+ s32 old_clockid = CLOCK_TAI;
+ bool need_cancel = false;
s32 clockid = CLOCK_TAI;
struct tcf_gate *gact;
struct tc_gate *parm;
+ u64 old_basetime = 0;
int ret = 0, err;
u32 gflags = 0;
s32 prio = -1;
@@ -324,26 +384,8 @@ static int tcf_gate_init(struct net *net
if (!tb[TCA_GATE_PARMS])
return -EINVAL;
- if (tb[TCA_GATE_CLOCKID]) {
+ if (tb[TCA_GATE_CLOCKID])
clockid = nla_get_s32(tb[TCA_GATE_CLOCKID]);
- switch (clockid) {
- case CLOCK_REALTIME:
- tk_offset = TK_OFFS_REAL;
- break;
- case CLOCK_MONOTONIC:
- tk_offset = TK_OFFS_MAX;
- break;
- case CLOCK_BOOTTIME:
- tk_offset = TK_OFFS_BOOT;
- break;
- case CLOCK_TAI:
- tk_offset = TK_OFFS_TAI;
- break;
- default:
- NL_SET_ERR_MSG(extack, "Invalid 'clockid'");
- return -EINVAL;
- }
- }
parm = nla_data(tb[TCA_GATE_PARMS]);
index = parm->index;
@@ -369,6 +411,60 @@ static int tcf_gate_init(struct net *net
return -EEXIST;
}
+ gact = to_gate(*a);
+
+ err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
+ if (err < 0)
+ goto release_idr;
+
+ p = kzalloc(sizeof(*p), GFP_KERNEL);
+ if (!p) {
+ err = -ENOMEM;
+ goto chain_put;
+ }
+ INIT_LIST_HEAD(&p->entries);
+
+ use_old_entries = !tb[TCA_GATE_ENTRY_LIST];
+ if (!use_old_entries) {
+ err = parse_gate_list(tb[TCA_GATE_ENTRY_LIST], p, extack);
+ if (err < 0)
+ goto err_free;
+ use_old_entries = !err;
+ }
+
+ if (ret == ACT_P_CREATED && use_old_entries) {
+ NL_SET_ERR_MSG(extack, "The entry list is empty");
+ err = -EINVAL;
+ goto err_free;
+ }
+
+ if (ret != ACT_P_CREATED) {
+ rcu_read_lock();
+ cur_p = rcu_dereference(gact->param);
+
+ old_basetime = cur_p->tcfg_basetime;
+ old_clockid = cur_p->tcfg_clockid;
+ old_tk_offset = READ_ONCE(gact->tk_offset);
+
+ basetime = old_basetime;
+ cycletime_ext = cur_p->tcfg_cycletime_ext;
+ prio = cur_p->tcfg_priority;
+ gflags = cur_p->tcfg_flags;
+
+ if (!tb[TCA_GATE_CLOCKID])
+ clockid = old_clockid;
+
+ err = 0;
+ if (use_old_entries) {
+ err = tcf_gate_copy_entries(p, cur_p, extack);
+ if (!err && !tb[TCA_GATE_CYCLE_TIME])
+ cycletime = cur_p->tcfg_cycletime;
+ }
+ rcu_read_unlock();
+ if (err)
+ goto err_free;
+ }
+
if (tb[TCA_GATE_PRIORITY])
prio = nla_get_s32(tb[TCA_GATE_PRIORITY]);
@@ -378,25 +474,26 @@ static int tcf_gate_init(struct net *net
if (tb[TCA_GATE_FLAGS])
gflags = nla_get_u32(tb[TCA_GATE_FLAGS]);
- gact = to_gate(*a);
- if (ret == ACT_P_CREATED)
- INIT_LIST_HEAD(&gact->param.entries);
+ if (tb[TCA_GATE_CYCLE_TIME])
+ cycletime = nla_get_u64(tb[TCA_GATE_CYCLE_TIME]);
- err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
- if (err < 0)
- goto release_idr;
+ if (tb[TCA_GATE_CYCLE_TIME_EXT])
+ cycletime_ext = nla_get_u64(tb[TCA_GATE_CYCLE_TIME_EXT]);
- spin_lock_bh(&gact->tcf_lock);
- p = &gact->param;
+ err = gate_clock_resolve(clockid, &tko, extack);
+ if (err)
+ goto err_free;
+ timer_clockid = clockid;
+
+ need_cancel = ret != ACT_P_CREATED &&
+ gate_timer_needs_cancel(basetime, old_basetime,
+ tko, old_tk_offset,
+ timer_clockid, old_clockid);
- if (tb[TCA_GATE_CYCLE_TIME])
- cycletime = nla_get_u64(tb[TCA_GATE_CYCLE_TIME]);
+ if (need_cancel)
+ hrtimer_cancel(&gact->hitimer);
- if (tb[TCA_GATE_ENTRY_LIST]) {
- err = parse_gate_list(tb[TCA_GATE_ENTRY_LIST], p, extack);
- if (err < 0)
- goto chain_put;
- }
+ spin_lock_bh(&gact->tcf_lock);
if (!cycletime) {
struct tcfg_gate_entry *entry;
@@ -405,22 +502,20 @@ static int tcf_gate_init(struct net *net
list_for_each_entry(entry, &p->entries, list)
cycle = ktime_add_ns(cycle, entry->interval);
cycletime = cycle;
- if (!cycletime) {
- err = -EINVAL;
- goto chain_put;
- }
}
p->tcfg_cycletime = cycletime;
+ p->tcfg_cycletime_ext = cycletime_ext;
- if (tb[TCA_GATE_CYCLE_TIME_EXT])
- p->tcfg_cycletime_ext =
- nla_get_u64(tb[TCA_GATE_CYCLE_TIME_EXT]);
-
- gate_setup_timer(gact, basetime, tk_offset, clockid,
- ret == ACT_P_CREATED);
+ if (need_cancel || ret == ACT_P_CREATED)
+ gate_setup_timer(gact, timer_clockid, tko);
p->tcfg_priority = prio;
p->tcfg_flags = gflags;
- gate_get_start_time(gact, &start);
+ p->tcfg_basetime = basetime;
+ p->tcfg_clockid = timer_clockid;
+ gate_get_start_time(gact, p, &start);
+
+ old_p = rcu_replace_pointer(gact->param, p,
+ lockdep_is_held(&gact->tcf_lock));
gact->current_close_time = start;
gact->current_gate_status = GATE_ACT_GATE_OPEN | GATE_ACT_PENDING;
@@ -437,11 +532,15 @@ static int tcf_gate_init(struct net *net
if (goto_ch)
tcf_chain_put_by_act(goto_ch);
+ if (old_p)
+ call_rcu(&old_p->rcu, tcf_gate_params_free_rcu);
+
return ret;
+err_free:
+ release_entry_list(&p->entries);
+ kfree(p);
chain_put:
- spin_unlock_bh(&gact->tcf_lock);
-
if (goto_ch)
tcf_chain_put_by_act(goto_ch);
release_idr:
@@ -449,21 +548,29 @@ release_idr:
* without taking tcf_lock.
*/
if (ret == ACT_P_CREATED)
- gate_setup_timer(gact, gact->param.tcfg_basetime,
- gact->tk_offset, gact->param.tcfg_clockid,
- true);
+ gate_setup_timer(gact, timer_clockid, tko);
+
tcf_idr_release(*a, bind);
return err;
}
+static void tcf_gate_params_free_rcu(struct rcu_head *head)
+{
+ struct tcf_gate_params *p = container_of(head, struct tcf_gate_params, rcu);
+
+ release_entry_list(&p->entries);
+ kfree(p);
+}
+
static void tcf_gate_cleanup(struct tc_action *a)
{
struct tcf_gate *gact = to_gate(a);
struct tcf_gate_params *p;
- p = &gact->param;
hrtimer_cancel(&gact->hitimer);
- release_entry_list(&p->entries);
+ p = rcu_dereference_protected(gact->param, 1);
+ if (p)
+ call_rcu(&p->rcu, tcf_gate_params_free_rcu);
}
static int dumping_entry(struct sk_buff *skb,
@@ -512,10 +619,9 @@ static int tcf_gate_dump(struct sk_buff
struct nlattr *entry_list;
struct tcf_t t;
- spin_lock_bh(&gact->tcf_lock);
- opt.action = gact->tcf_action;
-
- p = &gact->param;
+ rcu_read_lock();
+ opt.action = READ_ONCE(gact->tcf_action);
+ p = rcu_dereference(gact->param);
if (nla_put(skb, TCA_GATE_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
@@ -555,12 +661,12 @@ static int tcf_gate_dump(struct sk_buff
tcf_tm_dump(&t, &gact->tcf_tm);
if (nla_put_64bit(skb, TCA_GATE_TM, sizeof(t), &t, TCA_GATE_PAD))
goto nla_put_failure;
- spin_unlock_bh(&gact->tcf_lock);
+ rcu_read_unlock();
return skb->len;
nla_put_failure:
- spin_unlock_bh(&gact->tcf_lock);
+ rcu_read_unlock();
nlmsg_trim(skb, b);
return -1;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 169/491] s390/xor: Fix xor_xc_2() inline assembly constraints
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 168/491] net/sched: act_gate: snapshot parameters with RCU on replace Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 170/491] iomap: reject delalloc mappings during writeback Greg Kroah-Hartman
` (326 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit f775276edc0c505dc0f782773796c189f31a1123 ]
The inline assembly constraints for xor_xc_2() are incorrect. "bytes",
"p1", and "p2" are input operands, while all three of them are modified
within the inline assembly. Given that the function consists only of this
inline assembly it seems unlikely that this may cause any problems, however
fix this in any case.
Fixes: 2cfc5f9ce7f5 ("s390/xor: optimized xor routing using the XC instruction")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Link: https://lore.kernel.org/r/20260302133500.1560531-2-hca@linux.ibm.com
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/lib/xor.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/lib/xor.c
+++ b/arch/s390/lib/xor.c
@@ -28,8 +28,8 @@ static void xor_xc_2(unsigned long bytes
" j 3f\n"
"2: xc 0(1,%1),0(%2)\n"
"3:\n"
- : : "d" (bytes), "a" (p1), "a" (p2)
- : "0", "1", "cc", "memory");
+ : "+d" (bytes), "+a" (p1), "+a" (p2)
+ : : "0", "1", "cc", "memory");
}
static void xor_xc_3(unsigned long bytes, unsigned long *p1, unsigned long *p2,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 170/491] iomap: reject delalloc mappings during writeback
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 169/491] s390/xor: Fix xor_xc_2() inline assembly constraints Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 171/491] tracing: Fix syscall events activation by ensuring refcount hits zero Greg Kroah-Hartman
` (325 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit d320f160aa5ff36cdf83c645cca52b615e866e32 ]
Filesystems should never provide a delayed allocation mapping to
writeback; they're supposed to allocate the space before replying.
This can lead to weird IO errors and crashes in the block layer if the
filesystem is being malicious, or if it hadn't set iomap->dev because
it's a delalloc mapping.
Fix this by failing writeback on delalloc mappings. Currently no
filesystems actually misbehave in this manner, but we ought to be
stricter about things like that.
Cc: stable@vger.kernel.org # v5.5
Fixes: 598ecfbaa742ac ("iomap: lift the xfs writeback code to iomap")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Link: https://patch.msgid.link/20260302173002.GL13829@frogsfrogsfrogs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
[ Different error handling structure ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/iomap/buffered-io.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -1364,10 +1364,13 @@ iomap_writepage_map(struct iomap_writepa
error = wpc->ops->map_blocks(wpc, inode, file_offset);
if (error)
break;
- if (WARN_ON_ONCE(wpc->iomap.type == IOMAP_INLINE))
- continue;
if (wpc->iomap.type == IOMAP_HOLE)
continue;
+ if (WARN_ON_ONCE(wpc->iomap.type != IOMAP_UNWRITTEN &&
+ wpc->iomap.type != IOMAP_MAPPED)) {
+ error = -EIO;
+ break;
+ }
iomap_add_to_ioend(inode, file_offset, page, iop, wpc, wbc,
&submit_list);
count++;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 171/491] tracing: Fix syscall events activation by ensuring refcount hits zero
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 170/491] iomap: reject delalloc mappings during writeback Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 172/491] pmdomain: bcm: bcm2835-power: Fix broken reset status read Greg Kroah-Hartman
` (324 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Huiwen He, Steven Rostedt (Google), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 0a663b764dbdf135a126284f454c9f01f95a87d4 ]
When multiple syscall events are specified in the kernel command line
(e.g., trace_event=syscalls:sys_enter_openat,syscalls:sys_enter_close),
they are often not captured after boot, even though they appear enabled
in the tracing/set_event file.
The issue stems from how syscall events are initialized. Syscall
tracepoints require the global reference count (sys_tracepoint_refcount)
to transition from 0 to 1 to trigger the registration of the syscall
work (TIF_SYSCALL_TRACEPOINT) for tasks, including the init process (pid 1).
The current implementation of early_enable_events() with disable_first=true
used an interleaved sequence of "Disable A -> Enable A -> Disable B -> Enable B".
If multiple syscalls are enabled, the refcount never drops to zero,
preventing the 0->1 transition that triggers actual registration.
Fix this by splitting early_enable_events() into two distinct phases:
1. Disable all events specified in the buffer.
2. Enable all events specified in the buffer.
This ensures the refcount hits zero before re-enabling, allowing syscall
events to be properly activated during early boot.
The code is also refactored to use a helper function to avoid logic
duplication between the disable and enable phases.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20260224023544.1250787-1-hehuiwen@kylinos.cn
Fixes: ce1039bd3a89 ("tracing: Fix enabling of syscall events on the command line")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events.c | 51 +++++++++++++++++++++++++++++++-------------
1 file changed, 36 insertions(+), 15 deletions(-)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3393,27 +3393,23 @@ static __init int event_trace_memsetup(v
return 0;
}
-static __init void
-early_enable_events(struct trace_array *tr, bool disable_first)
+/*
+ * Helper function to enable or disable a comma-separated list of events
+ * from the bootup buffer.
+ */
+static __init void __early_set_events(struct trace_array *tr, bool enable)
{
char *buf = bootup_event_buf;
char *token;
- int ret;
-
- while (true) {
- token = strsep(&buf, ",");
-
- if (!token)
- break;
+ while ((token = strsep(&buf, ","))) {
if (*token) {
- /* Restarting syscalls requires that we stop them first */
- if (disable_first)
+ if (enable) {
+ if (ftrace_set_clr_event(tr, token, 1))
+ pr_warn("Failed to enable trace event: %s\n", token);
+ } else {
ftrace_set_clr_event(tr, token, 0);
-
- ret = ftrace_set_clr_event(tr, token, 1);
- if (ret)
- pr_warn("Failed to enable trace event: %s\n", token);
+ }
}
/* Put back the comma to allow this to be called again */
@@ -3422,6 +3418,31 @@ early_enable_events(struct trace_array *
}
}
+/**
+ * early_enable_events - enable events from the bootup buffer
+ * @tr: The trace array to enable the events in
+ * @disable_first: If true, disable all events before enabling them
+ *
+ * This function enables events from the bootup buffer. If @disable_first
+ * is true, it will first disable all events in the buffer before enabling
+ * them.
+ *
+ * For syscall events, which rely on a global refcount to register the
+ * SYSCALL_WORK_SYSCALL_TRACEPOINT flag (especially for pid 1), we must
+ * ensure the refcount hits zero before re-enabling them. A simple
+ * "disable then enable" per-event is not enough if multiple syscalls are
+ * used, as the refcount will stay above zero. Thus, we need a two-phase
+ * approach: disable all, then enable all.
+ */
+static __init void
+early_enable_events(struct trace_array *tr, bool disable_first)
+{
+ if (disable_first)
+ __early_set_events(tr, false);
+
+ __early_set_events(tr, true);
+}
+
static __init int event_trace_enable(void)
{
struct trace_array *tr = top_trace_array();
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 172/491] pmdomain: bcm: bcm2835-power: Fix broken reset status read
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 171/491] tracing: Fix syscall events activation by ensuring refcount hits zero Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 173/491] iio: light: bh1780: fix PM runtime leak on error path Greg Kroah-Hartman
` (323 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maíra Canal, Florian Fainelli,
Stefan Wahren, Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit 550bae2c0931dbb664a61b08c21cf156f0a5362a ]
bcm2835_reset_status() has a misplaced parenthesis on every PM_READ()
call. Since PM_READ(reg) expands to readl(power->base + (reg)), the
expression:
PM_READ(PM_GRAFX & PM_V3DRSTN)
computes the bitwise AND of the register offset PM_GRAFX with the
bitmask PM_V3DRSTN before using the result as a register offset, reading
from the wrong MMIO address instead of the intended PM_GRAFX register.
The same issue affects the PM_IMAGE cases.
Fix by moving the closing parenthesis so PM_READ() receives only the
register offset, and the bitmask is applied to the value returned by
the read.
Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/bcm/bcm2835-power.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -566,11 +566,11 @@ static int bcm2835_reset_status(struct r
switch (id) {
case BCM2835_RESET_V3D:
- return !PM_READ(PM_GRAFX & PM_V3DRSTN);
+ return !(PM_READ(PM_GRAFX) & PM_V3DRSTN);
case BCM2835_RESET_H264:
- return !PM_READ(PM_IMAGE & PM_H264RSTN);
+ return !(PM_READ(PM_IMAGE) & PM_H264RSTN);
case BCM2835_RESET_ISP:
- return !PM_READ(PM_IMAGE & PM_ISPRSTN);
+ return !(PM_READ(PM_IMAGE) & PM_ISPRSTN);
default:
return -EINVAL;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 173/491] iio: light: bh1780: fix PM runtime leak on error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 172/491] pmdomain: bcm: bcm2835-power: Fix broken reset status read Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 174/491] smb: client: fix atomic open with O_DIRECT & O_SYNC Greg Kroah-Hartman
` (322 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoniu Miclaus, Linus Walleij,
Stable, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
[ Upstream commit dd72e6c3cdea05cad24e99710939086f7a113fb5 ]
Move pm_runtime_put_autosuspend() before the error check to ensure
the PM runtime reference count is always decremented after
pm_runtime_get_sync(), regardless of whether the read operation
succeeds or fails.
Fixes: 1f0477f18306 ("iio: light: new driver for the ROHM BH1780")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ moved both pm_runtime_mark_last_busy() and pm_runtime_put_autosuspend() before the error check instead of just pm_runtime_put_autosuspend() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/bh1780.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/bh1780.c
+++ b/drivers/iio/light/bh1780.c
@@ -109,10 +109,10 @@ static int bh1780_read_raw(struct iio_de
case IIO_LIGHT:
pm_runtime_get_sync(&bh1780->client->dev);
value = bh1780_read_word(bh1780, BH1780_REG_DLOW);
- if (value < 0)
- return value;
pm_runtime_mark_last_busy(&bh1780->client->dev);
pm_runtime_put_autosuspend(&bh1780->client->dev);
+ if (value < 0)
+ return value;
*val = value;
return IIO_VAL_INT;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 174/491] smb: client: fix atomic open with O_DIRECT & O_SYNC
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 173/491] iio: light: bh1780: fix PM runtime leak on error path Greg Kroah-Hartman
@ 2026-04-13 15:56 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 175/491] smb: client: fix iface port assignment in parse_server_interfaces Greg Kroah-Hartman
` (321 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
David Howells, Henrique Carvalho, Tom Talpey, linux-cifs,
Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
[ Upstream commit 4a7d2729dc99437dbb880a64c47828c0d191b308 ]
When user application requests O_DIRECT|O_SYNC along with O_CREAT on
open(2), CREATE_NO_BUFFER and CREATE_WRITE_THROUGH bits were missed in
CREATE request when performing an atomic open, thus leading to
potentially data integrity issues.
Fix this by setting those missing bits in CREATE request when
O_DIRECT|O_SYNC has been specified in cifs_do_create().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
[ adapted file paths from fs/smb/client/ to fs/cifs/ ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsglob.h | 11 +++++++++++
fs/cifs/dir.c | 1 +
fs/cifs/file.c | 17 +++--------------
3 files changed, 15 insertions(+), 14 deletions(-)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -26,6 +26,7 @@
#include <linux/mm.h>
#include <linux/mempool.h>
#include <linux/workqueue.h>
+#include <linux/fcntl.h>
#include "cifs_fs_sb.h"
#include "cifsacl.h"
#include <crypto/internal/hash.h>
@@ -2124,4 +2125,14 @@ static inline bool cifs_ses_exiting(stru
return ret;
}
+static inline int cifs_open_create_options(unsigned int oflags, int opts)
+{
+ /* O_SYNC also has bit for O_DSYNC so following check picks up either */
+ if (oflags & O_SYNC)
+ opts |= CREATE_WRITE_THROUGH;
+ if (oflags & O_DIRECT)
+ opts |= CREATE_NO_BUFFER;
+ return opts;
+}
+
#endif /* _CIFS_GLOB_H */
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -348,6 +348,7 @@ cifs_do_create(struct inode *inode, stru
goto out;
}
+ create_options |= cifs_open_create_options(oflags, create_options);
/*
* if we're not using unix extensions, see if we need to set
* ATTR_READONLY on the create call
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -216,19 +216,13 @@ cifs_nt_open(char *full_path, struct ino
*********************************************************************/
disposition = cifs_get_disposition(f_flags);
-
/* BB pass O_SYNC flag through on file attributes .. BB */
buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
if (!buf)
return -ENOMEM;
- /* O_SYNC also has bit for O_DSYNC so following check picks up either */
- if (f_flags & O_SYNC)
- create_options |= CREATE_WRITE_THROUGH;
-
- if (f_flags & O_DIRECT)
- create_options |= CREATE_NO_BUFFER;
+ create_options |= cifs_open_create_options(f_flags, create_options);
oparms.tcon = tcon;
oparms.cifs_sb = cifs_sb;
@@ -750,13 +744,8 @@ cifs_reopen_file(struct cifsFileInfo *cf
}
desired_access = cifs_convert_flags(cfile->f_flags);
-
- /* O_SYNC also has bit for O_DSYNC so following check picks up either */
- if (cfile->f_flags & O_SYNC)
- create_options |= CREATE_WRITE_THROUGH;
-
- if (cfile->f_flags & O_DIRECT)
- create_options |= CREATE_NO_BUFFER;
+ create_options |= cifs_open_create_options(cfile->f_flags,
+ create_options);
if (server->ops->get_lease_key)
server->ops->get_lease_key(inode, &cfile->fid);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 175/491] smb: client: fix iface port assignment in parse_server_interfaces
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-04-13 15:56 ` [PATCH 5.10 174/491] smb: client: fix atomic open with O_DIRECT & O_SYNC Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 176/491] s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute Greg Kroah-Hartman
` (320 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dr. Thomas Orgis, Enzo Matsumiya,
Henrique Carvalho, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
[ Upstream commit d4c7210d2f3ea481a6481f03040a64d9077a6172 ]
parse_server_interfaces() initializes interface socket addresses with
CIFS_PORT. When the mount uses a non-default port this overwrites the
configured destination port.
Later, cifs_chan_update_iface() copies this sockaddr into server->dstaddr,
causing reconnect attempts to use the wrong port after server interface
updates.
Use the existing port from server->dstaddr instead.
Cc: stable@vger.kernel.org
Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries")
Tested-by: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de>
Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[ adapted struct types, function signature, lock name, and file path ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -437,7 +437,7 @@ smb3_negotiate_rsize(struct cifs_tcon *t
static int
parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
- size_t buf_len,
+ size_t buf_len, struct cifs_ses *ses,
struct cifs_server_iface **iface_list,
size_t *iface_count)
{
@@ -447,6 +447,7 @@ parse_server_interfaces(struct network_i
struct iface_info_ipv4 *p4;
struct iface_info_ipv6 *p6;
struct cifs_server_iface *info;
+ __be16 port;
ssize_t bytes_left;
size_t next = 0;
int nb_iface = 0;
@@ -493,6 +494,15 @@ parse_server_interfaces(struct network_i
goto out;
}
+ spin_lock(&cifs_tcp_ses_lock);
+ if (ses->server->dstaddr.ss_family == AF_INET)
+ port = ((struct sockaddr_in *)&ses->server->dstaddr)->sin_port;
+ else if (ses->server->dstaddr.ss_family == AF_INET6)
+ port = ((struct sockaddr_in6 *)&ses->server->dstaddr)->sin6_port;
+ else
+ port = cpu_to_be16(CIFS_PORT);
+ spin_unlock(&cifs_tcp_ses_lock);
+
info = *iface_list;
bytes_left = buf_len;
p = buf;
@@ -519,7 +529,7 @@ parse_server_interfaces(struct network_i
memcpy(&addr4->sin_addr, &p4->IPv4Address, 4);
/* [MS-SMB2] 2.2.32.5.1.1 Clients MUST ignore these */
- addr4->sin_port = cpu_to_be16(CIFS_PORT);
+ addr4->sin_port = port;
cifs_dbg(FYI, "%s: ipv4 %pI4\n", __func__,
&addr4->sin_addr);
@@ -533,7 +543,7 @@ parse_server_interfaces(struct network_i
/* [MS-SMB2] 2.2.32.5.1.2 Clients MUST ignore these */
addr6->sin6_flowinfo = 0;
addr6->sin6_scope_id = 0;
- addr6->sin6_port = cpu_to_be16(CIFS_PORT);
+ addr6->sin6_port = port;
cifs_dbg(FYI, "%s: ipv6 %pI6\n", __func__,
&addr6->sin6_addr);
@@ -600,7 +610,7 @@ SMB3_request_interfaces(const unsigned i
goto out;
}
- rc = parse_server_interfaces(out_buf, ret_data_len,
+ rc = parse_server_interfaces(out_buf, ret_data_len, ses,
&iface_list, &iface_count);
if (rc)
goto out;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 176/491] s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 175/491] smb: client: fix iface port assignment in parse_server_interfaces Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 177/491] xfs: ensure dquot item is deleted from AIL only after log shutdown Greg Kroah-Hartman
` (319 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ingo Franzki, Harald Freudenberger,
Vasily Gorbik, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <freude@linux.ibm.com>
[ Upstream commit 598bbefa8032cc58b564a81d1ad68bd815c8dc0f ]
The serialnr sysfs attribute for CCA cards when queried always
used the default domain for sending the request down to the card.
If for any reason exactly this default domain is disabled then
the attribute code fails to retrieve the CCA info and the sysfs
entry shows an empty string. Works as designed but the serial
number is a card attribute and thus it does not matter which
domain is used for the query. So if there are other domains on
this card available, these could be used.
So extend the code to use AUTOSEL_DOM for the domain value to
address any online domain within the card for querying the cca
info and thus show the serialnr as long as there is one domain
usable regardless of the default domain setting.
Fixes: 8f291ebf3270 ("s390/zcrypt: enable card/domain autoselect on ep11 cprbs")
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
[ preserved zc->online as the fourth argument to cca_get_info() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/crypto/zcrypt_ccamisc.c | 12 +++++++-----
drivers/s390/crypto/zcrypt_cex4.c | 3 +--
2 files changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1680,11 +1680,13 @@ static int fetch_cca_info(u16 cardnr, u1
memset(ci, 0, sizeof(*ci));
- /* get first info from zcrypt device driver about this apqn */
- rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
- if (rc)
- return rc;
- ci->hwtype = devstat.hwtype;
+ /* if specific domain given, fetch status and hw info for this apqn */
+ if (domain != AUTOSEL_DOM) {
+ rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
+ if (rc)
+ return rc;
+ ci->hwtype = devstat.hwtype;
+ }
/* prep page for rule array and var array use */
pg = (u8 *) __get_free_page(GFP_KERNEL);
--- a/drivers/s390/crypto/zcrypt_cex4.c
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -84,8 +84,7 @@ static ssize_t cca_serialnr_show(struct
memset(&ci, 0, sizeof(ci));
- if (ap_domain_index >= 0)
- cca_get_info(ac->id, ap_domain_index, &ci, zc->online);
+ cca_get_info(ac->id, AUTOSEL_DOM, &ci, zc->online);
return scnprintf(buf, PAGE_SIZE, "%s\n", ci.serial);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 177/491] xfs: ensure dquot item is deleted from AIL only after log shutdown
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 176/491] s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 178/491] xfs: fix integer overflow in bmap intent sort comparator Greg Kroah-Hartman
` (318 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Carlos Maiolino,
Christoph Hellwig, Carlos Maiolino, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <leo.lilong@huawei.com>
[ Upstream commit 186ac39b8a7d3ec7ce9c5dd45e5c2730177f375c ]
In xfs_qm_dqflush(), when a dquot flush fails due to corruption
(the out_abort error path), the original code removed the dquot log
item from the AIL before calling xfs_force_shutdown(). This ordering
introduces a subtle race condition that can lead to data loss after
a crash.
The AIL tracks the oldest dirty metadata in the journal. The position
of the tail item in the AIL determines the log tail LSN, which is the
oldest LSN that must be preserved for crash recovery. When an item is
removed from the AIL, the log tail can advance past the LSN of that item.
The race window is as follows: if the dquot item happens to be at
the tail of the log, removing it from the AIL allows the log tail
to advance. If a concurrent log write is sampling the tail LSN at
the same time and subsequently writes a complete checkpoint (i.e.,
one containing a commit record) to disk before the shutdown takes
effect, the journal will no longer protect the dquot's last
modification. On the next mount, log recovery will not replay the
dquot changes, even though they were never written back to disk,
resulting in silent data loss.
Fix this by calling xfs_force_shutdown() before xfs_trans_ail_delete()
in the out_abort path. Once the log is shut down, no new log writes
can complete with an updated tail LSN, making it safe to remove the
dquot item from the AIL.
Cc: stable@vger.kernel.org
Fixes: b707fffda6a3 ("xfs: abort consistently on dquot flush failure")
Signed-off-by: Long Li <leo.lilong@huawei.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ adapted error path to preserve existing out_unlock label between xfs_trans_ail_delete and xfs_dqfunlock ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_dquot.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1324,9 +1324,15 @@ xfs_qm_dqflush(
return 0;
out_abort:
+ /*
+ * Shut down the log before removing the dquot item from the AIL.
+ * Otherwise, the log tail may advance past this item's LSN while
+ * log writes are still in progress, making these unflushed changes
+ * unrecoverable on the next mount.
+ */
+ xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
dqp->q_flags &= ~XFS_DQFLAG_DIRTY;
xfs_trans_ail_delete(lip, 0);
- xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
out_unlock:
xfs_dqfunlock(dqp);
return error;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 178/491] xfs: fix integer overflow in bmap intent sort comparator
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 177/491] xfs: ensure dquot item is deleted from AIL only after log shutdown Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 179/491] crypto: atmel-sha204a - Fix OOM ->tfm_count leak Greg Kroah-Hartman
` (317 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Darrick J. Wong,
Carlos Maiolino, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <leo.lilong@huawei.com>
[ Upstream commit 362c490980867930a098b99f421268fbd7ca05fd ]
xfs_bmap_update_diff_items() sorts bmap intents by inode number using
a subtraction of two xfs_ino_t (uint64_t) values, with the result
truncated to int. This is incorrect when two inode numbers differ by
more than INT_MAX (2^31 - 1), which is entirely possible on large XFS
filesystems.
Fix this by replacing the subtraction with cmp_int().
Cc: <stable@vger.kernel.org> # v4.9
Fixes: 9f3afb57d5f1 ("xfs: implement deferred bmbt map/unmap operations")
Signed-off-by: Long Li <leo.lilong@huawei.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ replaced `bi_entry()` macro with `container_of()` and inlined `cmp_int()` as a manual three-way comparison expression ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_bmap_item.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -273,7 +273,8 @@ xfs_bmap_update_diff_items(
ba = container_of(a, struct xfs_bmap_intent, bi_list);
bb = container_of(b, struct xfs_bmap_intent, bi_list);
- return ba->bi_owner->i_ino - bb->bi_owner->i_ino;
+ return (ba->bi_owner->i_ino > bb->bi_owner->i_ino) -
+ (ba->bi_owner->i_ino < bb->bi_owner->i_ino);
}
/* Set the map extent flags for this mapping. */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 179/491] crypto: atmel-sha204a - Fix OOM ->tfm_count leak
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 178/491] xfs: fix integer overflow in bmap intent sort comparator Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 180/491] drm/msm: Fix dma_free_attrs() buffer size Greg Kroah-Hartman
` (316 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit d240b079a37e90af03fd7dfec94930eb6c83936e ]
If memory allocation fails, decrement ->tfm_count to avoid blocking
future reads.
Cc: stable@vger.kernel.org
Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[ adapted kmalloc_obj() macro to kmalloc(sizeof()) ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-sha204a.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -52,9 +52,10 @@ static int atmel_sha204a_rng_read_nonblo
rng->priv = 0;
} else {
work_data = kmalloc(sizeof(*work_data), GFP_ATOMIC);
- if (!work_data)
+ if (!work_data) {
+ atomic_dec(&i2c_priv->tfm_count);
return -ENOMEM;
-
+ }
work_data->ctx = i2c_priv;
work_data->client = i2c_priv->client;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 180/491] drm/msm: Fix dma_free_attrs() buffer size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 179/491] crypto: atmel-sha204a - Fix OOM ->tfm_count leak Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 181/491] arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation Greg Kroah-Hartman
` (315 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Dmitry Baryshkov,
Rob Clark, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit e4eb6e4dd6348dd00e19c2275e3fbaed304ca3bd ]
The gpummu->table buffer is alloc'd with size TABLE_SIZE + 32 in
a2xx_gpummu_new() but freed with size TABLE_SIZE in
a2xx_gpummu_destroy().
Change the free size to match the allocation.
Fixes: c2052a4e5c99 ("drm/msm: implement a2xx mmu")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/707340/
Message-ID: <20260226095714.12126-2-fourier.thomas@gmail.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/msm_gpummu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/msm/msm_gpummu.c
+++ b/drivers/gpu/drm/msm/msm_gpummu.c
@@ -72,7 +72,7 @@ static void msm_gpummu_destroy(struct ms
{
struct msm_gpummu *gpummu = to_msm_gpummu(mmu);
- dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,
+ dma_free_attrs(mmu->dev, TABLE_SIZE + 32, gpummu->table, gpummu->pt_base,
DMA_ATTR_FORCE_CONTIGUOUS);
kfree(gpummu);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 181/491] arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 180/491] drm/msm: Fix dma_free_attrs() buffer size Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 182/491] nfsd: define exports_proc_ops with CONFIG_PROC_FS Greg Kroah-Hartman
` (314 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Catalin Marinas, Jianpeng Chang,
Will Deacon, Huang, Ying, Guenter Roeck, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
[ Upstream commit c25c4aa3f79a488cc270507935a29c07dc6bddfc ]
Commit 143937ca51cc ("arm64, mm: avoid always making PTE dirty in
pte_mkwrite()") changed pte_mkwrite_novma() to only clear PTE_RDONLY
when PTE_DIRTY is set. This was to allow writable-clean PTEs for swap
pages that haven't actually been written.
However, this broke kexec and hibernation for some platforms. Both go
through trans_pgd_create_copy() -> _copy_pte(), which calls
pte_mkwrite_novma() to make the temporary linear-map copy fully
writable. With the updated pte_mkwrite_novma(), read-only kernel pages
(without PTE_DIRTY) remain read-only in the temporary mapping.
While such behaviour is fine for user pages where hardware DBM or
trapping will make them writeable, subsequent in-kernel writes by the
kexec relocation code will fault.
Add PTE_DIRTY back to all _PAGE_KERNEL* protection definitions. This was
the case prior to 5.4, commit aa57157be69f ("arm64: Ensure
VM_WRITE|VM_SHARED ptes are clean by default"). With the kernel
linear-map PTEs always having PTE_DIRTY set, pte_mkwrite_novma()
correctly clears PTE_RDONLY.
Fixes: 143937ca51cc ("arm64, mm: avoid always making PTE dirty in pte_mkwrite()")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: stable@vger.kernel.org
Reported-by: Jianpeng Chang <jianpeng.chang.cn@windriver.com>
Link: https://lore.kernel.org/r/20251204062722.3367201-1-jianpeng.chang.cn@windriver.com
Cc: Will Deacon <will@kernel.org>
Cc: Huang, Ying <ying.huang@linux.alibaba.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Signed-off-by: Will Deacon <will@kernel.org>
[ added PTE_DIRTY to PAGE_KERNEL* macros directly instead of _PAGE_KERNEL* ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/pgtable-prot.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm64/include/asm/pgtable-prot.h
+++ b/arch/arm64/include/asm/pgtable-prot.h
@@ -65,11 +65,11 @@ extern bool arm64_use_ng_mappings;
#define _PAGE_DEFAULT (_PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL))
-#define PAGE_KERNEL __pgprot(PROT_NORMAL)
-#define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) | PTE_RDONLY)
-#define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE | PTE_PXN)) | PTE_RDONLY)
-#define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN)
-#define PAGE_KERNEL_EXEC_CONT __pgprot((PROT_NORMAL & ~PTE_PXN) | PTE_CONT)
+#define PAGE_KERNEL __pgprot(PROT_NORMAL | PTE_DIRTY)
+#define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) | PTE_RDONLY | PTE_DIRTY)
+#define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE | PTE_PXN)) | PTE_RDONLY | PTE_DIRTY)
+#define PAGE_KERNEL_EXEC __pgprot((PROT_NORMAL & ~PTE_PXN) | PTE_DIRTY)
+#define PAGE_KERNEL_EXEC_CONT __pgprot((PROT_NORMAL & ~PTE_PXN) | PTE_CONT | PTE_DIRTY)
#define PAGE_S2_MEMATTR(attr) \
({ \
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 182/491] nfsd: define exports_proc_ops with CONFIG_PROC_FS
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 181/491] arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 183/491] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd Greg Kroah-Hartman
` (313 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Rix, Jeff Layton, Chuck Lever,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Rix <trix@redhat.com>
[ Upstream commit 340086da9a87820b40601141a0e9e87c954ac006 ]
gcc with W=1 and ! CONFIG_PROC_FS
fs/nfsd/nfsctl.c:161:30: error: ‘exports_proc_ops’
defined but not used [-Werror=unused-const-variable=]
161 | static const struct proc_ops exports_proc_ops = {
| ^~~~~~~~~~~~~~~~
The only use of exports_proc_ops is when CONFIG_PROC_FS
is defined, so its definition should be likewise conditional.
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: e7fcf179b82d ("NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -155,18 +155,6 @@ static int exports_net_open(struct net *
return 0;
}
-static int exports_proc_open(struct inode *inode, struct file *file)
-{
- return exports_net_open(current->nsproxy->net_ns, file);
-}
-
-static const struct proc_ops exports_proc_ops = {
- .proc_open = exports_proc_open,
- .proc_read = seq_read,
- .proc_lseek = seq_lseek,
- .proc_release = seq_release,
-};
-
static int exports_nfsd_open(struct inode *inode, struct file *file)
{
return exports_net_open(inode->i_sb->s_fs_info, file);
@@ -1423,6 +1411,19 @@ static struct file_system_type nfsd_fs_t
MODULE_ALIAS_FS("nfsd");
#ifdef CONFIG_PROC_FS
+
+static int exports_proc_open(struct inode *inode, struct file *file)
+{
+ return exports_net_open(current->nsproxy->net_ns, file);
+}
+
+static const struct proc_ops exports_proc_ops = {
+ .proc_open = exports_proc_open,
+ .proc_read = seq_read,
+ .proc_lseek = seq_lseek,
+ .proc_release = seq_release,
+};
+
static int create_proc_exports_entry(void)
{
struct proc_dir_entry *entry;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 183/491] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 182/491] nfsd: define exports_proc_ops with CONFIG_PROC_FS Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 184/491] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Greg Kroah-Hartman
` (312 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Misbah Anjum N, Jeff Layton,
NeilBrown, Olga Kornievskaia, Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit e7fcf179b82d3a3730fd8615da01b087cc654d0b ]
The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.
Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.
Reported-by: Misbah Anjum N <misanjum@linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/
Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Tested-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -152,9 +152,19 @@ static int exports_net_open(struct net *
seq = file->private_data;
seq->private = nn->svc_export_cache;
+ get_net(net);
return 0;
}
+static int exports_release(struct inode *inode, struct file *file)
+{
+ struct seq_file *seq = file->private_data;
+ struct cache_detail *cd = seq->private;
+
+ put_net(cd->net);
+ return seq_release(inode, file);
+}
+
static int exports_nfsd_open(struct inode *inode, struct file *file)
{
return exports_net_open(inode->i_sb->s_fs_info, file);
@@ -164,7 +174,7 @@ static const struct file_operations expo
.open = exports_nfsd_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = seq_release,
+ .release = exports_release,
};
static int export_features_show(struct seq_file *m, void *v)
@@ -1421,7 +1431,7 @@ static const struct proc_ops exports_pro
.proc_open = exports_proc_open,
.proc_read = seq_read,
.proc_lseek = seq_lseek,
- .proc_release = seq_release,
+ .proc_release = exports_release,
};
static int create_proc_exports_entry(void)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 184/491] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 183/491] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 185/491] mtd: partitions: redboot: fix style issues Greg Kroah-Hartman
` (311 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Nicholas Carlini,
Jeff Layton, Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2 ]
The NFSv4.0 replay cache uses a fixed 112-byte inline buffer
(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.
This size was calculated based on OPEN responses and does not account
for LOCK denied responses, which include the conflicting lock owner as
a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).
When a LOCK operation is denied due to a conflict with an existing lock
that has a large owner, nfsd4_encode_operation() copies the full encoded
response into the undersized replay buffer via read_bytes_from_xdr_buf()
with no bounds check. This results in a slab-out-of-bounds write of up
to 944 bytes past the end of the buffer, corrupting adjacent heap memory.
This can be triggered remotely by an unauthenticated attacker with two
cooperating NFSv4.0 clients: one sets a lock with a large owner string,
then the other requests a conflicting lock to provoke the denial.
We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full
opaque, but that would increase the size of every stateowner, when most
lockowners are not that large.
Instead, fix this by checking the encoded response length against
NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the
response is too large, set rp_buflen to 0 to skip caching the replay
payload. The status is still cached, and the client already received the
correct response on the original request.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Reported-by: Nicholas Carlini <npc@anthropic.com>
Tested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ replaced `op_status_offset + XDR_UNIT` with existing `post_err_offset` variable ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 9 +++++++--
fs/nfsd/state.h | 17 ++++++++++++-----
2 files changed, 19 insertions(+), 7 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5438,9 +5438,14 @@ nfsd4_encode_operation(struct nfsd4_comp
int len = xdr->buf->len - post_err_offset;
so->so_replay.rp_status = op->status;
- so->so_replay.rp_buflen = len;
- read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
+ if (len <= NFSD4_REPLAY_ISIZE) {
+ so->so_replay.rp_buflen = len;
+ read_bytes_from_xdr_buf(xdr->buf,
+ post_err_offset,
so->so_replay.rp_buf, len);
+ } else {
+ so->so_replay.rp_buflen = 0;
+ }
}
status:
*p = op->status;
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -430,11 +430,18 @@ struct nfs4_client_reclaim {
struct xdr_netobj cr_princhash;
};
-/* A reasonable value for REPLAY_ISIZE was estimated as follows:
- * The OPEN response, typically the largest, requires
- * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) +
- * 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
- * 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
+/*
+ * REPLAY_ISIZE is sized for an OPEN response with delegation:
+ * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
+ * 8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
+ * 4(deleg. recall flag) + 20(deleg. space limit) +
+ * ~32(deleg. ace) = 112 bytes
+ *
+ * Some responses can exceed this. A LOCK denial includes the conflicting
+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
+ * saved. Enlarging this constant increases the size of every
+ * nfs4_stateowner.
*/
#define NFSD4_REPLAY_ISIZE 112
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 185/491] mtd: partitions: redboot: fix style issues
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 184/491] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 186/491] mtd: Avoid boot crash in RedBoot partition table parser Greg Kroah-Hartman
` (310 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Corentin Labbe, Linus Walleij,
Miquel Raynal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Labbe <clabbe@baylibre.com>
[ Upstream commit eb1765c40530ccc8690b9dad88cec6aaa6bfb498 ]
This patch fixes easy checkpatch issues.
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210520114851.1274609-2-clabbe@baylibre.com
Stable-dep-of: 8e2f8020270a ("mtd: Avoid boot crash in RedBoot partition table parser")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/parsers/redboot.c | 69 ++++++++++++++++++++----------------------
1 file changed, 34 insertions(+), 35 deletions(-)
--- a/drivers/mtd/parsers/redboot.c
+++ b/drivers/mtd/parsers/redboot.c
@@ -17,15 +17,15 @@
#include <linux/module.h>
struct fis_image_desc {
- unsigned char name[16]; // Null terminated name
- uint32_t flash_base; // Address within FLASH of image
- uint32_t mem_base; // Address in memory where it executes
- uint32_t size; // Length of image
- uint32_t entry_point; // Execution entry point
- uint32_t data_length; // Length of actual data
- unsigned char _pad[256-(16+7*sizeof(uint32_t))];
- uint32_t desc_cksum; // Checksum over image descriptor
- uint32_t file_cksum; // Checksum over image data
+ unsigned char name[16]; // Null terminated name
+ u32 flash_base; // Address within FLASH of image
+ u32 mem_base; // Address in memory where it executes
+ u32 size; // Length of image
+ u32 entry_point; // Execution entry point
+ u32 data_length; // Length of actual data
+ unsigned char _pad[256 - (16 + 7 * sizeof(u32))];
+ u32 desc_cksum; // Checksum over image descriptor
+ u32 file_cksum; // Checksum over image data
};
struct fis_list {
@@ -91,12 +91,12 @@ static int parse_redboot_partitions(stru
parse_redboot_of(master);
- if ( directory < 0 ) {
+ if (directory < 0) {
offset = master->size + directory * master->erasesize;
while (mtd_block_isbad(master, offset)) {
if (!offset) {
- nogood:
- printk(KERN_NOTICE "Failed to find a non-bad block to check for RedBoot partition table\n");
+nogood:
+ pr_notice("Failed to find a non-bad block to check for RedBoot partition table\n");
return -EIO;
}
offset -= master->erasesize;
@@ -114,8 +114,8 @@ static int parse_redboot_partitions(stru
if (!buf)
return -ENOMEM;
- printk(KERN_NOTICE "Searching for RedBoot partition table in %s at offset 0x%lx\n",
- master->name, offset);
+ pr_notice("Searching for RedBoot partition table in %s at offset 0x%lx\n",
+ master->name, offset);
ret = mtd_read(master, offset, master->erasesize, &retlen,
(void *)buf);
@@ -151,14 +151,13 @@ static int parse_redboot_partitions(stru
&& swab32(buf[i].size) < master->erasesize)) {
int j;
/* Update numslots based on actual FIS directory size */
- numslots = swab32(buf[i].size) / sizeof (struct fis_image_desc);
+ numslots = swab32(buf[i].size) / sizeof(struct fis_image_desc);
for (j = 0; j < numslots; ++j) {
-
/* A single 0xff denotes a deleted entry.
* Two of them in a row is the end of the table.
*/
if (buf[j].name[0] == 0xff) {
- if (buf[j].name[1] == 0xff) {
+ if (buf[j].name[1] == 0xff) {
break;
} else {
continue;
@@ -185,8 +184,8 @@ static int parse_redboot_partitions(stru
}
if (i == numslots) {
/* Didn't find it */
- printk(KERN_NOTICE "No RedBoot partition table detected in %s\n",
- master->name);
+ pr_notice("No RedBoot partition table detected in %s\n",
+ master->name);
ret = 0;
goto out;
}
@@ -205,7 +204,7 @@ static int parse_redboot_partitions(stru
break;
new_fl = kmalloc(sizeof(struct fis_list), GFP_KERNEL);
- namelen += strlen(buf[i].name)+1;
+ namelen += strlen(buf[i].name) + 1;
if (!new_fl) {
ret = -ENOMEM;
goto out;
@@ -214,13 +213,13 @@ static int parse_redboot_partitions(stru
if (data && data->origin)
buf[i].flash_base -= data->origin;
else
- buf[i].flash_base &= master->size-1;
+ buf[i].flash_base &= master->size - 1;
/* I'm sure the JFFS2 code has done me permanent damage.
* I now think the following is _normal_
*/
prev = &fl;
- while(*prev && (*prev)->img->flash_base < new_fl->img->flash_base)
+ while (*prev && (*prev)->img->flash_base < new_fl->img->flash_base)
prev = &(*prev)->next;
new_fl->next = *prev;
*prev = new_fl;
@@ -240,7 +239,7 @@ static int parse_redboot_partitions(stru
}
}
#endif
- parts = kzalloc(sizeof(*parts)*nrparts + nulllen + namelen, GFP_KERNEL);
+ parts = kzalloc(sizeof(*parts) * nrparts + nulllen + namelen, GFP_KERNEL);
if (!parts) {
ret = -ENOMEM;
@@ -249,23 +248,22 @@ static int parse_redboot_partitions(stru
nullname = (char *)&parts[nrparts];
#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
- if (nulllen > 0) {
+ if (nulllen > 0)
strcpy(nullname, nullstring);
- }
#endif
names = nullname + nulllen;
- i=0;
+ i = 0;
#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
if (fl->img->flash_base) {
- parts[0].name = nullname;
- parts[0].size = fl->img->flash_base;
- parts[0].offset = 0;
+ parts[0].name = nullname;
+ parts[0].size = fl->img->flash_base;
+ parts[0].offset = 0;
i++;
}
#endif
- for ( ; i<nrparts; i++) {
+ for ( ; i < nrparts; i++) {
parts[i].size = fl->img->size;
parts[i].offset = fl->img->flash_base;
parts[i].name = names;
@@ -273,17 +271,17 @@ static int parse_redboot_partitions(stru
strcpy(names, fl->img->name);
#ifdef CONFIG_MTD_REDBOOT_PARTS_READONLY
if (!memcmp(names, "RedBoot", 8) ||
- !memcmp(names, "RedBoot config", 15) ||
- !memcmp(names, "FIS directory", 14)) {
+ !memcmp(names, "RedBoot config", 15) ||
+ !memcmp(names, "FIS directory", 14)) {
parts[i].mask_flags = MTD_WRITEABLE;
}
#endif
- names += strlen(names)+1;
+ names += strlen(names) + 1;
#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
- if(fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
+ if (fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
i++;
- parts[i].offset = parts[i-1].size + parts[i-1].offset;
+ parts[i].offset = parts[i - 1].size + parts[i - 1].offset;
parts[i].size = fl->next->img->flash_base - parts[i].offset;
parts[i].name = nullname;
}
@@ -297,6 +295,7 @@ static int parse_redboot_partitions(stru
out:
while (fl) {
struct fis_list *old = fl;
+
fl = fl->next;
kfree(old);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 186/491] mtd: Avoid boot crash in RedBoot partition table parser
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 185/491] mtd: partitions: redboot: fix style issues Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 187/491] pmdomain: bcm: bcm2835-power: Increase ASB control timeout Greg Kroah-Hartman
` (309 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, linux-hardening,
Finn Thain, Miquel Raynal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <fthain@linux-m68k.org>
[ Upstream commit 8e2f8020270af7777d49c2e7132260983e4fc566 ]
Given CONFIG_FORTIFY_SOURCE=y and a recent compiler,
commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when
available") produces the warning below and an oops.
Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000
------------[ cut here ]------------
WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1
memcmp: detected buffer overflow: 15 byte read of buffer size 14
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE
As Kees said, "'names' is pointing to the final 'namelen' many bytes
of the allocation ... 'namelen' could be basically any length at all.
This fortify warning looks legit to me -- this code used to be reading
beyond the end of the allocation."
Since the size of the dynamic allocation is calculated with strlen()
we can use strcmp() instead of memcmp() and remain within bounds.
Cc: Kees Cook <kees@kernel.org>
Cc: stable@vger.kernel.org
Cc: linux-hardening@vger.kernel.org
Link: https://lore.kernel.org/all/202602151911.AD092DFFCD@keescook/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Finn Thain <fthain@linux-m68k.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/parsers/redboot.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/mtd/parsers/redboot.c
+++ b/drivers/mtd/parsers/redboot.c
@@ -270,9 +270,9 @@ nogood:
strcpy(names, fl->img->name);
#ifdef CONFIG_MTD_REDBOOT_PARTS_READONLY
- if (!memcmp(names, "RedBoot", 8) ||
- !memcmp(names, "RedBoot config", 15) ||
- !memcmp(names, "FIS directory", 14)) {
+ if (!strcmp(names, "RedBoot") ||
+ !strcmp(names, "RedBoot config") ||
+ !strcmp(names, "FIS directory")) {
parts[i].mask_flags = MTD_WRITEABLE;
}
#endif
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 187/491] pmdomain: bcm: bcm2835-power: Increase ASB control timeout
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 186/491] mtd: Avoid boot crash in RedBoot partition table parser Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 188/491] iio: imu: inv_icm42600: fix odr switch when turning buffer off Greg Kroah-Hartman
` (308 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maíra Canal, Stefan Wahren,
Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <mcanal@igalia.com>
[ Upstream commit b826d2c0b0ecb844c84431ba6b502e744f5d919a ]
The bcm2835_asb_control() function uses a tight polling loop to wait
for the ASB bridge to acknowledge a request. During intensive workloads,
this handshake intermittently fails for V3D's master ASB on BCM2711,
resulting in "Failed to disable ASB master for v3d" errors during
runtime PM suspend. As a consequence, the failed power-off leaves V3D in
a broken state, leading to bus faults or system hangs on later accesses.
As the timeout is insufficient in some scenarios, increase the polling
timeout from 1us to 5us, which is still negligible in the context of a
power domain transition. Also, replace the open-coded ktime_get_ns()/
cpu_relax() polling loop with readl_poll_timeout_atomic().
Cc: stable@vger.kernel.org
Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ adapted unified bcm2835_asb_control() function changes to separate bcm2835_asb_enable() and bcm2835_asb_disable() functions ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/bcm/bcm2835-power.c | 27 +++++++++++----------------
1 file changed, 11 insertions(+), 16 deletions(-)
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -9,6 +9,7 @@
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/io.h>
+#include <linux/iopoll.h>
#include <linux/mfd/bcm2835-pm.h>
#include <linux/module.h>
#include <linux/platform_device.h>
@@ -150,40 +151,34 @@ struct bcm2835_power {
static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
{
- u64 start;
+ u32 val;
if (!reg)
return 0;
- start = ktime_get_ns();
-
/* Enable the module's async AXI bridges. */
ASB_WRITE(reg, ASB_READ(reg) & ~ASB_REQ_STOP);
- while (ASB_READ(reg) & ASB_ACK) {
- cpu_relax();
- if (ktime_get_ns() - start >= 1000)
- return -ETIMEDOUT;
- }
+
+ if (readl_poll_timeout_atomic(power->asb + reg, val,
+ !(val & ASB_ACK), 0, 5))
+ return -ETIMEDOUT;
return 0;
}
static int bcm2835_asb_disable(struct bcm2835_power *power, u32 reg)
{
- u64 start;
+ u32 val;
if (!reg)
return 0;
- start = ktime_get_ns();
-
/* Enable the module's async AXI bridges. */
ASB_WRITE(reg, ASB_READ(reg) | ASB_REQ_STOP);
- while (!(ASB_READ(reg) & ASB_ACK)) {
- cpu_relax();
- if (ktime_get_ns() - start >= 1000)
- return -ETIMEDOUT;
- }
+
+ if (readl_poll_timeout_atomic(power->asb + reg, val,
+ !!(val & ASB_ACK), 0, 5))
+ return -ETIMEDOUT;
return 0;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 188/491] iio: imu: inv_icm42600: fix odr switch when turning buffer off
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 187/491] pmdomain: bcm: bcm2835-power: Increase ASB control timeout Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector Greg Kroah-Hartman
` (307 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit ffd32db8263d2d785a2c419486a450dc80693235 ]
ODR switch is done in 2 steps when FIFO is on : change the ODR register
value and acknowledge change when reading the FIFO ODR change flag.
When we are switching odr and turning buffer off just afterward, we are
losing the FIFO ODR change flag and ODR switch is blocked.
Fix the issue by force applying any waiting ODR change when turning
buffer off.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -377,6 +377,7 @@ out_unlock:
static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
+ struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
struct device *dev = regmap_get_device(st->map);
unsigned int sensor;
unsigned int *watermark;
@@ -398,6 +399,8 @@ static int inv_icm42600_buffer_postdisab
mutex_lock(&st->lock);
+ inv_icm42600_timestamp_apply_odr(ts, 0, 0, 0);
+
ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
if (ret)
goto out_unlock;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 188/491] iio: imu: inv_icm42600: fix odr switch when turning buffer off Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-15 11:55 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 190/491] usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling Greg Kroah-Hartman
` (306 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Xu Yang, Arnaud Ferraris,
Heikki Krogerus, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 8345b1539faa49fcf9c9439c3cbd97dac6eca171 ]
usb_role_switch_is_parent() was walking up to the parent node and checking
for the "usb-role-switch" property regardless of the type of the passed
fwnode. This could cause unrelated device nodes to be probed as potential
role switch parent, leading to spurious matches and "-EPROBE_DEFER" being
returned infinitely.
Till now only Type-B connector node will have a parent node which may
present "usb-role-switch" property and register the role switch device.
For Type-C connector node, its parent node will always be a Type-C chip
device which will never register the role switch device. However, it may
still present a non-boolean "usb-role-switch = <&usb_controller>" property
for historical compatibility.
So restrict the helper to only operate on Type-B connector when attempting
to get the role switch from parent node.
Fixes: 6fadd72943b8 ("usb: roles: get usb-role-switch from parent")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Tested-by: Arnaud Ferraris <arnaud.ferraris@collabora.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260309074313.2809867-3-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ replace fwnode_device_is_compatible() call with it's expansion ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/roles/class.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/roles/class.c
+++ b/drivers/usb/roles/class.c
@@ -108,9 +108,14 @@ static void *usb_role_switch_match(struc
static struct usb_role_switch *
usb_role_switch_is_parent(struct fwnode_handle *fwnode)
{
- struct fwnode_handle *parent = fwnode_get_parent(fwnode);
+ struct fwnode_handle *parent;
struct device *dev;
+ if (fwnode_property_match_string(fwnode, "compatible", "usb-b-connector") < 0)
+ return NULL;
+
+ parent = fwnode_get_parent(fwnode);
+
if (!fwnode_property_present(parent, "usb-role-switch")) {
fwnode_handle_put(parent);
return NULL;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 190/491] usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device Greg Kroah-Hartman
` (305 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jiasheng Jiang, Thinh Nguyen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
[ Upstream commit b9fde507355342a2d64225d582dc8b98ff5ecb19 ]
The `tpg->tpg_nexus` pointer in the USB Target driver is dynamically
managed and tied to userspace configuration via ConfigFS. It can be
NULL if the USB host sends requests before the nexus is fully
established or immediately after it is dropped.
Currently, functions like `bot_submit_command()` and the data
transfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately
dereference `tv_nexus->tvn_se_sess` without any validation. If a
malicious or misconfigured USB host sends a BOT (Bulk-Only Transport)
command during this race window, it triggers a NULL pointer
dereference, leading to a kernel panic (local DoS).
This exposes an inconsistent API usage within the module, as peer
functions like `usbg_submit_command()` and `bot_send_bad_response()`
correctly implement a NULL check for `tv_nexus` before proceeding.
Fix this by bringing consistency to the nexus handling. Add the
missing `if (!tv_nexus)` checks to the vulnerable BOT command and
request processing paths, aborting the command gracefully with an
error instead of crashing the system.
Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Cc: stable <stable@kernel.org>
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260219023834.17976-1-jiashengjiangcool@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1032,6 +1032,13 @@ static void usbg_cmd_work(struct work_st
se_cmd = &cmd->se_cmd;
tpg = cmd->fu->tpg;
tv_nexus = tpg->tpg_nexus;
+ if (!tv_nexus) {
+ struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
+
+ dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
+ return;
+ }
+
dir = get_cmd_dir(cmd->cmd_buf);
if (dir < 0) {
transport_init_se_cmd(se_cmd,
@@ -1162,6 +1169,13 @@ static void bot_cmd_work(struct work_str
se_cmd = &cmd->se_cmd;
tpg = cmd->fu->tpg;
tv_nexus = tpg->tpg_nexus;
+ if (!tv_nexus) {
+ struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
+
+ dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
+ return;
+ }
+
dir = get_cmd_dir(cmd->cmd_buf);
if (dir < 0) {
transport_init_se_cmd(se_cmd,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 190/491] usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-15 12:10 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 192/491] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC Greg Kroah-Hartman
` (304 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 2df6162785f31f1bbb598cfc3b08e4efc88f80b6 ]
So far the driver populated the struct can_priv::do_set_bittiming() and
struct can_priv::fd::do_set_data_bittiming() callbacks.
Before bringing up the interface, user space has to configure the bitrates.
With these callbacks the configuration is directly forwarded into the CAN
hardware. Then the interface can be brought up.
An ifdown-ifup cycle (without changing the bit rates) doesn't re-configure
the bitrates in the CAN hardware. This leads to a problem with the
CANable-2.5 [1] firmware, which resets the configured bit rates during
ifdown.
To fix the problem remove both bit timing callbacks and always configure
the bitrates in the struct net_device_ops::ndo_open() callback.
[1] https://github.com/Elmue/CANable-2.5-firmware-Slcan-and-Candlelight
Cc: stable@vger.kernel.org
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20260219-gs_usb-always-configure-bitrates-v2-1-671f8ba5b0a5@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
[ No CAN-FD ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/gs_usb.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -413,9 +413,8 @@ static void gs_usb_receive_bulk_callback
}
}
-static int gs_usb_set_bittiming(struct net_device *netdev)
+static int gs_usb_set_bittiming(struct gs_can *dev)
{
- struct gs_can *dev = netdev_priv(netdev);
struct can_bittiming *bt = &dev->can.bittiming;
struct usb_interface *intf = dev->iface;
int rc;
@@ -445,7 +444,7 @@ static int gs_usb_set_bittiming(struct n
kfree(dbt);
if (rc < 0)
- dev_err(netdev->dev.parent, "Couldn't set bittimings (err=%d)",
+ dev_err(dev->netdev->dev.parent, "Couldn't set bittimings (err=%d)",
rc);
return (rc > 0) ? 0 : rc;
@@ -675,6 +674,13 @@ static int gs_can_open(struct net_device
if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+ rc = gs_usb_set_bittiming(dev);
+ if (rc) {
+ netdev_err(netdev, "failed to set bittiming: %pe\n", ERR_PTR(rc));
+ kfree(dm);
+ return rc;
+ }
+
/* finally start device */
dev->can.state = CAN_STATE_ERROR_ACTIVE;
dm->mode = cpu_to_le32(GS_CAN_MODE_START);
@@ -888,7 +894,6 @@ static struct gs_can *gs_make_candev(uns
dev->can.state = CAN_STATE_STOPPED;
dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
dev->can.bittiming_const = &dev->bt_const;
- dev->can.do_set_bittiming = gs_usb_set_bittiming;
dev->can.ctrlmode_supported = 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 192/491] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 193/491] ALSA: pcm: fix wait_time calculations Greg Kroah-Hartman
` (303 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naveen N Rao (AMD), Jim Mattson,
Sean Christopherson, Paolo Bonzini, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit 3989a6d036c8ec82c0de3614bed23a1dacd45de5 ]
Initialize all per-vCPU AVIC control fields in the VMCB if AVIC is enabled
in KVM and the VM has an in-kernel local APIC, i.e. if it's _possible_ the
vCPU could activate AVIC at any point in its lifecycle. Configuring the
VMCB if and only if AVIC is active "works" purely because of optimizations
in kvm_create_lapic() to speculatively set apicv_active if AVIC is enabled
*and* to defer updates until the first KVM_RUN. In quotes because KVM
likely won't do the right thing if kvm_apicv_activated() is false, i.e. if
a vCPU is created while APICv is inhibited at the VM level for whatever
reason. E.g. if the inhibit is *removed* before KVM_REQ_APICV_UPDATE is
handled in KVM_RUN, then __kvm_vcpu_update_apicv() will elide calls to
vendor code due to seeing "apicv_active == activate".
Cleaning up the initialization code will also allow fixing a bug where KVM
incorrectly leaves CR8 interception enabled when AVIC is activated without
creating a mess with respect to whether AVIC is activated or not.
Cc: stable@vger.kernel.org
Fixes: 67034bb9dd5e ("KVM: SVM: Add irqchip_split() checks before enabling AVIC")
Fixes: 6c3e4422dd20 ("svm: Add support for dynamic APICv")
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Reviewed-by: Jim Mattson <jmattson@google.com>
Link: https://patch.msgid.link/20260203190711.458413-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ Context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/avic.c | 2 +-
arch/x86/kvm/svm/svm.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/avic.c
+++ b/arch/x86/kvm/svm/avic.c
@@ -203,7 +203,7 @@ void avic_init_vmcb(struct vcpu_svm *svm
vmcb->control.avic_logical_id = lpa & AVIC_HPA_MASK;
vmcb->control.avic_physical_id = ppa & AVIC_HPA_MASK;
vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID_COUNT;
- if (kvm_apicv_activated(svm->vcpu.kvm))
+ if (kvm_vcpu_apicv_active(&svm->vcpu))
vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
else
vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1230,7 +1230,7 @@ static void init_vmcb(struct vcpu_svm *s
svm_check_invpcid(svm);
- if (kvm_vcpu_apicv_active(&svm->vcpu))
+ if (avic && irqchip_in_kernel(svm->vcpu.kvm))
avic_init_vmcb(svm);
/*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 193/491] ALSA: pcm: fix wait_time calculations
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 192/491] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 194/491] ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Greg Kroah-Hartman
` (302 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oswald Buddenhagen, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
[ Upstream commit 3ed2b549b39f57239aad50a255ece353997183fd ]
... in wait_for_avail() and snd_pcm_drain().
t was calculated in seconds, so it would be pretty much always zero, to
be subsequently de-facto ignored due to being max(t, 10)'d. And then it
(i.e., 10) would be treated as secs, which doesn't seem right.
However, fixing it to properly calculate msecs would potentially cause
timeouts when using twice the period size for the default timeout (which
seems reasonable to me), so instead use the buffer size plus 10 percent
to be on the safe side ... but that still seems insufficient, presumably
because the hardware typically needs a moment to fire up. To compensate
for this, we up the minimal timeout to 100ms, which is still two orders
of magnitude less than the bogus minimum.
substream->wait_time was also misinterpreted as jiffies, despite being
documented as being in msecs. Only the soc/sof driver sets it - to 500,
which looks very much like msecs were intended.
Speaking of which, shouldn't snd_pcm_drain() also use substream->
wait_time?
As a drive-by, make the debug messages on timeout less confusing.
Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
Link: https://lore.kernel.org/r/20230405201219.2197774-1-oswald.buddenhagen@gmx.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stable-dep-of: 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_lib.c | 11 +++++------
sound/core/pcm_native.c | 8 ++++----
2 files changed, 9 insertions(+), 10 deletions(-)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1843,15 +1843,14 @@ static int wait_for_avail(struct snd_pcm
if (substream->wait_time) {
wait_time = substream->wait_time;
} else {
- wait_time = 10;
+ wait_time = 100;
if (runtime->rate) {
- long t = runtime->period_size * 2 /
- runtime->rate;
+ long t = runtime->buffer_size * 1100 / runtime->rate;
wait_time = max(t, wait_time);
}
- wait_time = msecs_to_jiffies(wait_time * 1000);
}
+ wait_time = msecs_to_jiffies(wait_time);
}
for (;;) {
@@ -1899,8 +1898,8 @@ static int wait_for_avail(struct snd_pcm
}
if (!tout) {
pcm_dbg(substream->pcm,
- "%s write error (DMA or IRQ trouble?)\n",
- is_playback ? "playback" : "capture");
+ "%s timeout (DMA or IRQ trouble?)\n",
+ is_playback ? "playback write" : "capture read");
err = -EIO;
break;
}
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2155,12 +2155,12 @@ static int snd_pcm_drain(struct snd_pcm_
if (runtime->no_period_wakeup)
tout = MAX_SCHEDULE_TIMEOUT;
else {
- tout = 10;
+ tout = 100;
if (runtime->rate) {
- long t = runtime->period_size * 2 / runtime->rate;
+ long t = runtime->buffer_size * 1100 / runtime->rate;
tout = max(t, tout);
}
- tout = msecs_to_jiffies(tout * 1000);
+ tout = msecs_to_jiffies(tout);
}
tout = schedule_timeout(tout);
@@ -2183,7 +2183,7 @@ static int snd_pcm_drain(struct snd_pcm_
result = -ESTRPIPE;
else {
dev_dbg(substream->pcm->card->dev,
- "playback drain error (DMA or IRQ trouble?)\n");
+ "playback drain timeout (DMA or IRQ trouble?)\n");
snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
result = -EIO;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 194/491] ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 193/491] ALSA: pcm: fix wait_time calculations Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 195/491] smb: client: Compare MACs in constant time Greg Kroah-Hartman
` (301 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mehul Rao, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehul Rao <mehulrao@gmail.com>
[ Upstream commit 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 ]
In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s->runtime at line 2157). After
releasing the stream lock at line 2169, the code accesses
runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size
(lines 2170-2178) — all referencing the linked stream's runtime without
any lock or refcount protecting its lifetime.
A concurrent close() on the linked stream's fd triggers
snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()
→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).
No synchronization prevents kfree(runtime) from completing while the
drain path dereferences the stale pointer.
Fix by caching the needed runtime fields (no_period_wakeup, rate,
buffer_size) into local variables while still holding the stream lock,
and using the cached values after the lock is released.
Fixes: f2b3614cefb6 ("ALSA: PCM - Don't check DMA time-out too shortly")
Cc: stable@vger.kernel.org
Signed-off-by: Mehul Rao <mehulrao@gmail.com>
Link: https://patch.msgid.link/20260305193508.311096-1-mehulrao@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_native.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2129,6 +2129,10 @@ static int snd_pcm_drain(struct snd_pcm_
for (;;) {
long tout;
struct snd_pcm_runtime *to_check;
+ unsigned int drain_rate;
+ snd_pcm_uframes_t drain_bufsz;
+ bool drain_no_period_wakeup;
+
if (signal_pending(current)) {
result = -ERESTARTSYS;
break;
@@ -2148,16 +2152,25 @@ static int snd_pcm_drain(struct snd_pcm_
snd_pcm_group_unref(group, substream);
if (!to_check)
break; /* all drained */
+ /*
+ * Cache the runtime fields needed after unlock.
+ * A concurrent close() on the linked stream may free
+ * its runtime via snd_pcm_detach_substream() once we
+ * release the stream lock below.
+ */
+ drain_no_period_wakeup = to_check->no_period_wakeup;
+ drain_rate = to_check->rate;
+ drain_bufsz = to_check->buffer_size;
init_waitqueue_entry(&wait, current);
set_current_state(TASK_INTERRUPTIBLE);
add_wait_queue(&to_check->sleep, &wait);
snd_pcm_stream_unlock_irq(substream);
- if (runtime->no_period_wakeup)
+ if (drain_no_period_wakeup)
tout = MAX_SCHEDULE_TIMEOUT;
else {
tout = 100;
- if (runtime->rate) {
- long t = runtime->buffer_size * 1100 / runtime->rate;
+ if (drain_rate) {
+ long t = drain_bufsz * 1100 / drain_rate;
tout = max(t, tout);
}
tout = msecs_to_jiffies(tout);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 195/491] smb: client: Compare MACs in constant time
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 194/491] ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 196/491] net/tcp-md5: Fix MAC comparison to be constant-time Greg Kroah-Hartman
` (300 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
Eric Biggers, Steve French
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 26bc83b88bbbf054f0980a4a42047a8d1e210e4c upstream.
To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsencrypt.c | 3 ++-
fs/cifs/smb2transport.c | 4 +++-
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -36,6 +36,7 @@
#include <linux/fips.h>
#include <crypto/arc4.h>
#include <crypto/aead.h>
+#include <crypto/algapi.h>
int __cifs_calc_signature(struct smb_rqst *rqst,
struct TCP_Server_Info *server, char *signature,
@@ -255,7 +256,7 @@ int cifs_verify_signature(struct smb_rqs
/* cifs_dump_mem("what we think it should be: ",
what_we_think_sig_should_be, 16); */
- if (memcmp(server_response_sig, what_we_think_sig_should_be, 8))
+ if (crypto_memneq(server_response_sig, what_we_think_sig_should_be, 8))
return -EACCES;
else
return 0;
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -31,6 +31,7 @@
#include <asm/processor.h>
#include <linux/mempool.h>
#include <linux/highmem.h>
+#include <crypto/algapi.h>
#include <crypto/aead.h>
#include "smb2pdu.h"
#include "cifsglob.h"
@@ -687,7 +688,8 @@ smb2_verify_signature(struct smb_rqst *r
if (rc)
return rc;
- if (memcmp(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE)) {
+ if (crypto_memneq(server_response_sig, shdr->Signature,
+ SMB2_SIGNATURE_SIZE)) {
cifs_dbg(VFS, "sign fail cmd 0x%x message id 0x%llx\n",
shdr->Command, shdr->MessageId);
return -EACCES;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 196/491] net/tcp-md5: Fix MAC comparison to be constant-time
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 195/491] smb: client: Compare MACs in constant time Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 197/491] staging: rtl8723bs: fix null dereference in find_network Greg Kroah-Hartman
` (299 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 46d0d6f50dab706637f4c18a470aac20a21900d3 upstream.
To prevent timing attacks, MACs need to be compared in constant
time. Use the appropriate helper function for this.
Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.")
Fixes: 658ddaaf6694 ("tcp: md5: RST: getting md5 key from listener")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20260302203409.13388-1-ebiggers@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_ipv4.c | 5 +++--
net/ipv6/tcp_ipv6.c | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -78,6 +78,7 @@
#include <linux/inetdevice.h>
#include <linux/btf_ids.h>
+#include <crypto/algapi.h>
#include <crypto/hash.h>
#include <linux/scatterlist.h>
@@ -764,7 +765,7 @@ static void tcp_v4_send_reset(const stru
genhash = tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
- if (genhash || memcmp(hash_location, newhash, 16) != 0)
+ if (genhash || crypto_memneq(hash_location, newhash, 16))
goto out;
}
@@ -1451,7 +1452,7 @@ static bool tcp_v4_inbound_md5_hash(cons
hash_expected,
NULL, skb);
- if (genhash || memcmp(hash_location, newhash, 16) != 0) {
+ if (genhash || crypto_memneq(hash_location, newhash, 16)) {
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s L3 index %d\n",
&iph->saddr, ntohs(th->source),
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -63,6 +63,7 @@
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
+#include <crypto/algapi.h>
#include <crypto/hash.h>
#include <linux/scatterlist.h>
@@ -810,7 +811,7 @@ static bool tcp_v6_inbound_md5_hash(cons
hash_expected,
NULL, skb);
- if (genhash || memcmp(hash_location, newhash, 16) != 0) {
+ if (genhash || crypto_memneq(hash_location, newhash, 16)) {
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u L3 index %d\n",
genhash ? "failed" : "mismatch",
@@ -1071,7 +1072,7 @@ static void tcp_v6_send_reset(const stru
goto out;
genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
- if (genhash || memcmp(hash_location, newhash, 16) != 0)
+ if (genhash || crypto_memneq(hash_location, newhash, 16))
goto out;
}
#endif
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 197/491] staging: rtl8723bs: fix null dereference in find_network
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 196/491] net/tcp-md5: Fix MAC comparison to be constant-time Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 198/491] soc: fsl: qbman: fix race condition in qman_destroy_fq Greg Kroah-Hartman
` (298 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ethan Tidmore
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
[ Upstream commit 41460a19654c32d39fd0e3a3671cd8d4b7b8479f ]
The variable pwlan has the possibility of being NULL when passed into
rtw_free_network_nolock() which would later dereference the variable.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260202205429.20181-1-ethantidmore06@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -967,10 +967,12 @@ static void find_network(struct adapter
struct wlan_network *tgt_network = &pmlmepriv->cur_network;
pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
- if (pwlan)
- pwlan->fixed = false;
- else
+ if (!pwlan) {
RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("rtw_free_assoc_resources : pwlan == NULL\n\n"));
+ return;
+ }
+
+ pwlan->fixed = false;
if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) &&
(adapter->stapriv.asoc_sta_count == 1))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 198/491] soc: fsl: qbman: fix race condition in qman_destroy_fq
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 197/491] staging: rtl8723bs: fix null dereference in find_network Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Greg Kroah-Hartman
` (297 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Genoud, CHAMPSEIX Thomas,
Christophe Leroy (CS GROUP), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Genoud <richard.genoud@bootlin.com>
[ Upstream commit 014077044e874e270ec480515edbc1cadb976cf2 ]
When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between
fq_table[fq->idx] state and freeing/allocating from the pool and
WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered.
Indeed, we can have:
Thread A Thread B
qman_destroy_fq() qman_create_fq()
qman_release_fqid()
qman_shutdown_fq()
gen_pool_free()
-- At this point, the fqid is available again --
qman_alloc_fqid()
-- so, we can get the just-freed fqid in thread B --
fq->fqid = fqid;
fq->idx = fqid * 2;
WARN_ON(fq_table[fq->idx]);
fq_table[fq->idx] = fq;
fq_table[fq->idx] = NULL;
And adding some logs between qman_release_fqid() and
fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more.
To prevent that, ensure that fq_table[fq->idx] is set to NULL before
gen_pool_free() is called by using smp_wmb().
Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver")
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com>
Tested-by: CHAMPSEIX Thomas <thomas.champseix@alstomgroup.com>
Link: https://lore.kernel.org/r/20251223072549.397625-1-richard.genoud@bootlin.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/fsl/qbman/qman.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 7abc9b6a04ab6..0309ed2df0d71 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1827,6 +1827,8 @@ EXPORT_SYMBOL(qman_create_fq);
void qman_destroy_fq(struct qman_fq *fq)
{
+ int leaked;
+
/*
* We don't need to lock the FQ as it is a pre-condition that the FQ be
* quiesced. Instead, run some checks.
@@ -1834,11 +1836,29 @@ void qman_destroy_fq(struct qman_fq *fq)
switch (fq->state) {
case qman_fq_state_parked:
case qman_fq_state_oos:
- if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID))
- qman_release_fqid(fq->fqid);
+ /*
+ * There's a race condition here on releasing the fqid,
+ * setting the fq_table to NULL, and freeing the fqid.
+ * To prevent it, this order should be respected:
+ */
+ if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID)) {
+ leaked = qman_shutdown_fq(fq->fqid);
+ if (leaked)
+ pr_debug("FQID %d leaked\n", fq->fqid);
+ }
DPAA_ASSERT(fq_table[fq->idx]);
fq_table[fq->idx] = NULL;
+
+ if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID) && !leaked) {
+ /*
+ * fq_table[fq->idx] should be set to null before
+ * freeing fq->fqid otherwise it could by allocated by
+ * qman_alloc_fqid() while still being !NULL
+ */
+ smp_wmb();
+ gen_pool_free(qm_fqalloc, fq->fqid | DPAA_GENALLOC_OFF, 1);
+ }
return;
default:
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 198/491] soc: fsl: qbman: fix race condition in qman_destroy_fq Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-15 12:42 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 200/491] Bluetooth: LE L2CAP: Disconnect if received packets SDU exceeds IMTU Greg Kroah-Hartman
` (296 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peddolla Harshavardhan Reddy,
Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
[ Upstream commit 6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 ]
When the nl80211 socket that originated a PMSR request is
closed, cfg80211_release_pmsr() sets the request's nl_portid
to zero and schedules pmsr_free_wk to process the abort
asynchronously. If the interface is concurrently torn down
before that work runs, cfg80211_pmsr_wdev_down() calls
cfg80211_pmsr_process_abort() directly. However, the already-
scheduled pmsr_free_wk work item remains pending and may run
after the interface has been removed from the driver. This
could cause the driver's abort_pmsr callback to operate on a
torn-down interface, leading to undefined behavior and
potential crashes.
Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()
before calling cfg80211_pmsr_process_abort(). This ensures any
pending or in-progress work is drained before interface teardown
proceeds, preventing the work from invoking the driver abort
callback after the interface is gone.
Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
Link: https://patch.msgid.link/20260305160712.1263829-3-peddolla.reddy@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/pmsr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 7503c7dd71ab5..32cea07b98fd1 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -620,6 +620,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
}
spin_unlock_bh(&wdev->pmsr_lock);
+ cancel_work_sync(&wdev->pmsr_free_wk);
if (found)
cfg80211_pmsr_process_abort(wdev);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 200/491] Bluetooth: LE L2CAP: Disconnect if received packets SDU exceeds IMTU
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 201/491] Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Greg Kroah-Hartman
` (295 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Eggers,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <ceggers@arri.de>
[ Upstream commit e1d9a66889867c232657a9b6f25d451d7c3ab96f ]
Core 6.0, Vol 3, Part A, 3.4.3:
"If the SDU length field value exceeds the receiver's MTU, the receiver
shall disconnect the channel..."
This fixes L2CAP/LE/CFC/BV-26-C (running together with 'l2test -r -P
0x0027 -V le_public -I 100').
Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index bac2abce4bd78..9c1d68b1e83b5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7639,8 +7639,10 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
return -ENOBUFS;
}
- if (chan->imtu < skb->len) {
- BT_ERR("Too big LE L2CAP PDU");
+ if (skb->len > chan->imtu) {
+ BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len,
+ chan->imtu);
+ l2cap_send_disconn_req(chan, ECONNRESET);
return -ENOBUFS;
}
@@ -7665,7 +7667,9 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
sdu_len, skb->len, chan->imtu);
if (sdu_len > chan->imtu) {
- BT_ERR("Too big LE L2CAP SDU length received");
+ BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
+ skb->len, sdu_len);
+ l2cap_send_disconn_req(chan, ECONNRESET);
err = -EMSGSIZE;
goto failed;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 201/491] Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 200/491] Bluetooth: LE L2CAP: Disconnect if received packets SDU exceeds IMTU Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 202/491] Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Greg Kroah-Hartman
` (294 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Eggers,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <ceggers@arri.de>
[ Upstream commit b6a2bf43aa37670432843bc73ae2a6288ba4d6f8 ]
Core 6.0, Vol 3, Part A, 3.4.3:
"... If the sum of the payload sizes for the K-frames exceeds the
specified SDU length, the receiver shall disconnect the channel."
This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
0x0027 -V le_public').
Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9c1d68b1e83b5..ed113cfdce23b 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7705,6 +7705,7 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
if (chan->sdu->len + skb->len > chan->sdu_len) {
BT_ERR("Too much LE L2CAP data received");
+ l2cap_send_disconn_req(chan, ECONNRESET);
err = -EINVAL;
goto failed;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 202/491] Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 201/491] Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 203/491] Bluetooth: HIDP: Fix possible UAF Greg Kroah-Hartman
` (293 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Eggers,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <ceggers@arri.de>
[ Upstream commit 0e4d4dcc1a6e82cc6f9abf32193558efa7e1613d ]
The last test step ("Test with Invalid public key X and Y, all set to
0") expects to get an "DHKEY check failed" instead of "unspecified".
Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 79550d115364e..0871dca1ceac9 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2738,7 +2738,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
!crypto_memneq(key, smp->local_pk, 64)) {
bt_dev_err(hdev, "Remote and local public keys are identical");
- return SMP_UNSPECIFIED;
+ return SMP_DHKEY_CHECK_FAILED;
}
memcpy(smp->remote_pk, key, 64);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 203/491] Bluetooth: HIDP: Fix possible UAF
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 202/491] Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 204/491] net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Greg Kroah-Hartman
` (292 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, soufiane el hachmi,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit dbf666e4fc9bdd975a61bf682b3f75cb0145eedd ]
This fixes the following trace caused by not dropping l2cap_conn
reference when user->remove callback is called:
[ 97.809249] l2cap_conn_free: freeing conn ffff88810a171c00
[ 97.809907] CPU: 1 UID: 0 PID: 1419 Comm: repro_standalon Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 97.809935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 97.809947] Call Trace:
[ 97.809954] <TASK>
[ 97.809961] dump_stack_lvl (lib/dump_stack.c:122)
[ 97.809990] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
[ 97.810017] l2cap_conn_del (./include/linux/kref.h:66 net/bluetooth/l2cap_core.c:1821 net/bluetooth/l2cap_core.c:1798)
[ 97.810055] l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7347 (discriminator 1) net/bluetooth/l2cap_core.c:7340 (discriminator 1))
[ 97.810086] ? __pfx_l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7341)
[ 97.810117] hci_conn_hash_flush (./include/net/bluetooth/hci_core.h:2152 (discriminator 2) net/bluetooth/hci_conn.c:2644 (discriminator 2))
[ 97.810148] hci_dev_close_sync (net/bluetooth/hci_sync.c:5360)
[ 97.810180] ? __pfx_hci_dev_close_sync (net/bluetooth/hci_sync.c:5285)
[ 97.810212] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810242] ? up_write (./arch/x86/include/asm/atomic64_64.h:87 (discriminator 5) ./include/linux/atomic/atomic-arch-fallback.h:2852 (discriminator 5) ./include/linux/atomic/atomic-long.h:268 (discriminator 5) ./include/linux/atomic/atomic-instrumented.h:3391 (discriminator 5) kernel/locking/rwsem.c:1385 (discriminator 5) kernel/locking/rwsem.c:1643 (discriminator 5))
[ 97.810267] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810290] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
[ 97.810320] hci_unregister_dev (net/bluetooth/hci_core.c:504 net/bluetooth/hci_core.c:2716)
[ 97.810346] vhci_release (drivers/bluetooth/hci_vhci.c:691)
[ 97.810375] ? __pfx_vhci_release (drivers/bluetooth/hci_vhci.c:678)
[ 97.810404] __fput (fs/file_table.c:470)
[ 97.810430] task_work_run (kernel/task_work.c:235)
[ 97.810451] ? __pfx_task_work_run (kernel/task_work.c:201)
[ 97.810472] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810495] ? do_raw_spin_unlock (./include/asm-generic/qspinlock.h:128 (discriminator 5) kernel/locking/spinlock_debug.c:142 (discriminator 5))
[ 97.810527] do_exit (kernel/exit.c:972)
[ 97.810547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810574] ? __pfx_do_exit (kernel/exit.c:897)
[ 97.810594] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
[ 97.810616] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810639] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
[ 97.810664] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810688] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 97.810721] do_group_exit (kernel/exit.c:1093)
[ 97.810745] get_signal (kernel/signal.c:3007 (discriminator 1))
[ 97.810772] ? security_file_permission (./arch/x86/include/asm/jump_label.h:37 security/security.c:2366)
[ 97.810803] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810826] ? vfs_read (fs/read_write.c:555)
[ 97.810854] ? __pfx_get_signal (kernel/signal.c:2800)
[ 97.810880] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810905] ? __pfx_vfs_read (fs/read_write.c:555)
[ 97.810932] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810960] arch_do_signal_or_restart (arch/x86/kernel/signal.c:337 (discriminator 1))
[ 97.810990] ? __pfx_arch_do_signal_or_restart (arch/x86/kernel/signal.c:334)
[ 97.811021] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811055] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811078] ? ksys_read (fs/read_write.c:707)
[ 97.811106] ? __pfx_ksys_read (fs/read_write.c:707)
[ 97.811137] exit_to_user_mode_loop (kernel/entry/common.c:66 kernel/entry/common.c:98)
[ 97.811169] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
[ 97.811192] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811215] ? trace_hardirqs_off (./include/trace/events/preemptirq.h:36 (discriminator 33) kernel/trace/trace_preemptirq.c:95 (discriminator 33) kernel/trace/trace_preemptirq.c:90 (discriminator 33))
[ 97.811240] do_syscall_64 (./include/linux/irq-entry-common.h:226 ./include/linux/irq-entry-common.h:256 ./include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100)
[ 97.811268] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811292] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3))
[ 97.811318] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 97.811338] RIP: 0033:0x445cfe
[ 97.811352] Code: Unable to access opcode bytes at 0x445cd4.
Code starting with the faulting instruction
===========================================
[ 97.811360] RSP: 002b:00007f65c41c6dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 97.811378] RAX: fffffffffffffe00 RBX: 00007f65c41c76c0 RCX: 0000000000445cfe
[ 97.811391] RDX: 0000000000000400 RSI: 00007f65c41c6e40 RDI: 0000000000000004
[ 97.811403] RBP: 00007f65c41c7250 R08: 0000000000000000 R09: 0000000000000000
[ 97.811415] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffe8
[ 97.811428] R13: 0000000000000000 R14: 00007fff780a8c00 R15: 00007f65c41c76c0
[ 97.811453] </TASK>
[ 98.402453] ==================================================================
[ 98.403560] BUG: KASAN: use-after-free in __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.404541] Read of size 8 at addr ffff888113ee40a8 by task khidpd_00050004/1430
[ 98.405361]
[ 98.405563] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 98.405588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 98.405600] Call Trace:
[ 98.405607] <TASK>
[ 98.405614] dump_stack_lvl (lib/dump_stack.c:122)
[ 98.405641] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 98.405667] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.405691] ? __virt_addr_valid (arch/x86/mm/physaddr.c:55)
[ 98.405724] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405748] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)
[ 98.405778] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405807] __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405832] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
[ 98.405859] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.405888] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
[ 98.405915] ? __pfx___mutex_lock (kernel/locking/mutex.c:775)
[ 98.405939] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.405963] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
[ 98.405984] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.406015] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406038] ? lock_release (kernel/locking/lockdep.c:5536 kernel/locking/lockdep.c:5889 kernel/locking/lockdep.c:5875)
[ 98.406061] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406085] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194)
[ 98.406107] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406130] ? __timer_delete_sync (kernel/time/timer.c:1592)
[ 98.406158] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.406186] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406210] l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.406263] hidp_session_thread (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/linux/kref.h:64 net/bluetooth/hidp/core.c:996 net/bluetooth/hidp/core.c:1305)
[ 98.406293] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.406323] ? kthread (kernel/kthread.c:433)
[ 98.406340] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.406370] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406393] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.406424] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.406453] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406476] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
[ 98.406499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406523] ? kthread (kernel/kthread.c:433)
[ 98.406539] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406565] ? kthread (kernel/kthread.c:433)
[ 98.406581] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.406610] kthread (kernel/kthread.c:467)
[ 98.406627] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.406645] ret_from_fork (arch/x86/kernel/process.c:164)
[ 98.406674] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
[ 98.406704] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406728] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.406747] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
[ 98.406774] </TASK>
[ 98.406780]
[ 98.433693] The buggy address belongs to the physical page:
[ 98.434405] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888113ee7c40 pfn:0x113ee4
[ 98.435557] flags: 0x200000000000000(node=0|zone=2)
[ 98.436198] raw: 0200000000000000 ffffea0004244308 ffff8881f6f3ebc0 0000000000000000
[ 98.437195] raw: ffff888113ee7c40 0000000000000000 00000000ffffffff 0000000000000000
[ 98.438115] page dumped because: kasan: bad access detected
[ 98.438951]
[ 98.439211] Memory state around the buggy address:
[ 98.439871] ffff888113ee3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.440714] ffff888113ee4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.441580] >ffff888113ee4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.442458] ^
[ 98.443011] ffff888113ee4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.443889] ffff888113ee4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.444768] ==================================================================
[ 98.445719] Disabling lock debugging due to kernel taint
[ 98.448074] l2cap_conn_free: freeing conn ffff88810c22b400
[ 98.450012] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Tainted: G B 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 98.450040] Tainted: [B]=BAD_PAGE
[ 98.450047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 98.450059] Call Trace:
[ 98.450065] <TASK>
[ 98.450071] dump_stack_lvl (lib/dump_stack.c:122)
[ 98.450099] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
[ 98.450125] l2cap_conn_put (net/bluetooth/l2cap_core.c:1822)
[ 98.450154] session_free (net/bluetooth/hidp/core.c:990)
[ 98.450181] hidp_session_thread (net/bluetooth/hidp/core.c:1307)
[ 98.450213] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.450271] ? kthread (kernel/kthread.c:433)
[ 98.450293] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.450339] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450368] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.450406] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.450442] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450471] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
[ 98.450499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450528] ? kthread (kernel/kthread.c:433)
[ 98.450547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450578] ? kthread (kernel/kthread.c:433)
[ 98.450598] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.450637] kthread (kernel/kthread.c:467)
[ 98.450657] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.450680] ret_from_fork (arch/x86/kernel/process.c:164)
[ 98.450715] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
[ 98.450752] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450782] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.450804] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
[ 98.450836] </TASK>
Fixes: b4f34d8d9d26 ("Bluetooth: hidp: add new session-management helpers")
Reported-by: soufiane el hachmi <kilwa10@gmail.com>
Tested-by: soufiane el hachmi <kilwa10@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hidp/core.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 3ff870599eb77..068c3c2505170 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -987,7 +987,8 @@ static void session_free(struct kref *ref)
skb_queue_purge(&session->intr_transmit);
fput(session->intr_sock->file);
fput(session->ctrl_sock->file);
- l2cap_conn_put(session->conn);
+ if (session->conn)
+ l2cap_conn_put(session->conn);
kfree(session);
}
@@ -1165,6 +1166,15 @@ static void hidp_session_remove(struct l2cap_conn *conn,
down_write(&hidp_session_sem);
+ /* Drop L2CAP reference immediately to indicate that
+ * l2cap_unregister_user() shall not be called as it is already
+ * considered removed.
+ */
+ if (session->conn) {
+ l2cap_conn_put(session->conn);
+ session->conn = NULL;
+ }
+
hidp_session_terminate(session);
cancel_work_sync(&session->dev_init);
@@ -1302,7 +1312,9 @@ static int hidp_session_thread(void *arg)
* Instead, this call has the same semantics as if user-space tried to
* delete the session.
*/
- l2cap_unregister_user(session->conn, &session->user);
+ if (session->conn)
+ l2cap_unregister_user(session->conn, &session->user);
+
hidp_session_put(session);
module_put_and_kthread_exit(0);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 204/491] net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 203/491] Bluetooth: HIDP: Fix possible UAF Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 205/491] netfilter: ctnetlink: remove refcounting in expectation dumpers Greg Kroah-Hartman
` (291 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d00f90e0af54102fb271,
Eric Dumazet, Jiayuan Chen, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit e1f0a18c9564cdb16523c802e2c6fe5874e3d944 ]
syzkaller reported a bug [1], and the reproducer is available at [2].
ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN,
TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects
calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING
(-ECONNREFUSED), but lacks a check for TCP_SYN_SENT.
When rose_connect() is called a second time while the first connection
attempt is still in progress (TCP_SYN_SENT), it overwrites
rose->neighbour via rose_get_neigh(). If that returns NULL, the socket
is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL.
When the socket is subsequently closed, rose_release() sees
ROSE_STATE_1 and calls rose_write_internal() ->
rose_transmit_link(skb, NULL), causing a NULL pointer dereference.
Per connect(2), a second connect() while a connection is already in
progress should return -EALREADY. Add this missing check for
TCP_SYN_SENT to complete the state validation in rose_connect().
[1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271
[2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d00f90e0af54102fb271@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0027.GAE@google.com/T/
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260311070611.76913-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rose/af_rose.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 04173c85d92b5..0130c13f73552 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -808,6 +808,11 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
goto out_release;
}
+ if (sk->sk_state == TCP_SYN_SENT) {
+ err = -EALREADY;
+ goto out_release;
+ }
+
sk->sk_state = TCP_CLOSE;
sock->state = SS_UNCONNECTED;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 205/491] netfilter: ctnetlink: remove refcounting in expectation dumpers
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 204/491] net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 206/491] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Greg Kroah-Hartman
` (290 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a ]
Same pattern as previous patch: do not keep the expectation object
alive via refcount, only store a cookie value and then use that
as the skip hint for dump resumption.
AFAICS this has the same issue as the one resolved in the conntrack
dumper, when we do
if (!refcount_inc_not_zero(&exp->use))
to increment the refcount, there is a chance that exp == last, which
causes a double-increment of the refcount and subsequent memory leak.
Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping")
Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 5cb81eeda909 ("netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 41 ++++++++++++----------------
1 file changed, 17 insertions(+), 24 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f622fcad3f503..98a4c41f6df19 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3137,23 +3137,27 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
return 0;
}
#endif
-static int ctnetlink_exp_done(struct netlink_callback *cb)
+
+static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp)
{
- if (cb->args[1])
- nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
- return 0;
+ unsigned long id = (unsigned long)exp;
+
+ id += nf_ct_get_id(exp->master);
+ id += exp->class;
+
+ return id ? id : 1;
}
static int
ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
{
struct net *net = sock_net(skb->sk);
- struct nf_conntrack_expect *exp, *last;
struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
u_int8_t l3proto = nfmsg->nfgen_family;
+ unsigned long last_id = cb->args[1];
+ struct nf_conntrack_expect *exp;
rcu_read_lock();
- last = (struct nf_conntrack_expect *)cb->args[1];
for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
restart:
hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
@@ -3165,7 +3169,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
continue;
if (cb->args[1]) {
- if (exp != last)
+ if (ctnetlink_exp_id(exp) != last_id)
continue;
cb->args[1] = 0;
}
@@ -3174,9 +3178,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
cb->nlh->nlmsg_seq,
IPCTNL_MSG_EXP_NEW,
exp) < 0) {
- if (!refcount_inc_not_zero(&exp->use))
- continue;
- cb->args[1] = (unsigned long)exp;
+ cb->args[1] = ctnetlink_exp_id(exp);
goto out;
}
}
@@ -3187,32 +3189,30 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
}
out:
rcu_read_unlock();
- if (last)
- nf_ct_expect_put(last);
-
return skb->len;
}
static int
ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
{
- struct nf_conntrack_expect *exp, *last;
struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
struct nf_conn *ct = cb->data;
struct nf_conn_help *help = nfct_help(ct);
u_int8_t l3proto = nfmsg->nfgen_family;
+ unsigned long last_id = cb->args[1];
+ struct nf_conntrack_expect *exp;
if (cb->args[0])
return 0;
rcu_read_lock();
- last = (struct nf_conntrack_expect *)cb->args[1];
+
restart:
hlist_for_each_entry_rcu(exp, &help->expectations, lnode) {
if (l3proto && exp->tuple.src.l3num != l3proto)
continue;
if (cb->args[1]) {
- if (exp != last)
+ if (ctnetlink_exp_id(exp) != last_id)
continue;
cb->args[1] = 0;
}
@@ -3220,9 +3220,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
cb->nlh->nlmsg_seq,
IPCTNL_MSG_EXP_NEW,
exp) < 0) {
- if (!refcount_inc_not_zero(&exp->use))
- continue;
- cb->args[1] = (unsigned long)exp;
+ cb->args[1] = ctnetlink_exp_id(exp);
goto out;
}
}
@@ -3233,9 +3231,6 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
cb->args[0] = 1;
out:
rcu_read_unlock();
- if (last)
- nf_ct_expect_put(last);
-
return skb->len;
}
@@ -3254,7 +3249,6 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
struct nf_conntrack_zone zone;
struct netlink_dump_control c = {
.dump = ctnetlink_exp_ct_dump_table,
- .done = ctnetlink_exp_done,
};
err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
@@ -3305,7 +3299,6 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl,
else {
struct netlink_dump_control c = {
.dump = ctnetlink_exp_dump_table,
- .done = ctnetlink_exp_done,
};
return netlink_dump_start(ctnl, skb, nlh, &c);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 206/491] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 205/491] netfilter: ctnetlink: remove refcounting in expectation dumpers Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 207/491] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Greg Kroah-Hartman
` (289 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 5cb81eeda909dbb2def209dd10636b51549a3f8a ]
ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the
netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the
conntrack reference immediately after netlink_dump_start(). When the
dump spans multiple rounds, the second recvmsg() triggers the dump
callback which dereferences the now-freed conntrack via nfct_help(ct),
leading to a use-after-free on ct->ext.
The bug is that the netlink_dump_control has no .start or .done
callbacks to manage the conntrack reference across dump rounds. Other
dump functions in the same file (e.g. ctnetlink_get_conntrack) properly
use .start/.done callbacks for this purpose.
Fix this by adding .start and .done callbacks that hold and release the
conntrack reference for the duration of the dump, and move the
nfct_help() call after the cb->args[0] early-return check in the dump
callback to avoid dereferencing ct->ext unnecessarily.
BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0
Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133
CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY
Call Trace:
<TASK>
ctnetlink_exp_ct_dump_table+0x4f/0x2e0
netlink_dump+0x333/0x880
netlink_recvmsg+0x3e2/0x4b0
? aa_sk_perm+0x184/0x450
sock_recvmsg+0xde/0xf0
Allocated by task 133:
kmem_cache_alloc_noprof+0x134/0x440
__nf_conntrack_alloc+0xa8/0x2b0
ctnetlink_create_conntrack+0xa1/0x900
ctnetlink_new_conntrack+0x3cf/0x7d0
nfnetlink_rcv_msg+0x48e/0x510
netlink_rcv_skb+0xc9/0x1f0
nfnetlink_rcv+0xdb/0x220
netlink_unicast+0x3ec/0x590
netlink_sendmsg+0x397/0x690
__sys_sendmsg+0xf4/0x180
Freed by task 0:
slab_free_after_rcu_debug+0xad/0x1e0
rcu_core+0x5c3/0x9c0
Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 98a4c41f6df19..9fe2c5b3523c5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3197,7 +3197,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
{
struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
struct nf_conn *ct = cb->data;
- struct nf_conn_help *help = nfct_help(ct);
+ struct nf_conn_help *help;
u_int8_t l3proto = nfmsg->nfgen_family;
unsigned long last_id = cb->args[1];
struct nf_conntrack_expect *exp;
@@ -3205,6 +3205,10 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
if (cb->args[0])
return 0;
+ help = nfct_help(ct);
+ if (!help)
+ return 0;
+
rcu_read_lock();
restart:
@@ -3234,6 +3238,24 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
return skb->len;
}
+static int ctnetlink_dump_exp_ct_start(struct netlink_callback *cb)
+{
+ struct nf_conn *ct = cb->data;
+
+ if (!refcount_inc_not_zero(&ct->ct_general.use))
+ return -ENOENT;
+ return 0;
+}
+
+static int ctnetlink_dump_exp_ct_done(struct netlink_callback *cb)
+{
+ struct nf_conn *ct = cb->data;
+
+ if (ct)
+ nf_ct_put(ct);
+ return 0;
+}
+
static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
struct sk_buff *skb,
const struct nlmsghdr *nlh,
@@ -3249,6 +3271,8 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
struct nf_conntrack_zone zone;
struct netlink_dump_control c = {
.dump = ctnetlink_exp_ct_dump_table,
+ .start = ctnetlink_dump_exp_ct_start,
+ .done = ctnetlink_dump_exp_ct_done,
};
err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 207/491] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 206/491] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 208/491] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Greg Kroah-Hartman
` (288 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Johannes Möller,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Johannes Möller <research@johannes-moeller.dev>
[ Upstream commit fbce58e719a17aa215c724473fd5baaa4a8dc57c ]
sip_help_tcp() parses the SIP Content-Length header with
simple_strtoul(), which returns unsigned long, but stores the result in
unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are
silently truncated before computing the SIP message boundary.
For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32,
causing the parser to miscalculate where the current message ends. The
loop then treats trailing data in the TCP segment as a second SIP
message and processes it through the SDP parser.
Fix this by changing clen to unsigned long to match the return type of
simple_strtoul(), and reject Content-Length values that exceed the
remaining TCP payload length.
Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support")
Signed-off-by: Lukas Johannes Möller <research@johannes-moeller.dev>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_sip.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 751df19fe0f8a..5db17768ec2ad 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1529,11 +1529,12 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
{
struct tcphdr *th, _tcph;
unsigned int dataoff, datalen;
- unsigned int matchoff, matchlen, clen;
+ unsigned int matchoff, matchlen;
unsigned int msglen, origlen;
const char *dptr, *end;
s16 diff, tdiff = 0;
int ret = NF_ACCEPT;
+ unsigned long clen;
bool term;
if (ctinfo != IP_CT_ESTABLISHED &&
@@ -1568,6 +1569,9 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
if (dptr + matchoff == end)
break;
+ if (clen > datalen)
+ break;
+
term = false;
for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
if (end[0] == '\r' && end[1] == '\n' &&
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 208/491] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 207/491] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 209/491] netfilter: nft_ct: add seqadj extension for natted connections Greg Kroah-Hartman
` (287 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Klaudia Kloc, Dawid Moczadło,
Jenny Guanni Qu, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <qguanni@gmail.com>
[ Upstream commit 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a ]
In decode_int(), the CONS case calls get_bits(bs, 2) to read a length
value, then calls get_uint(bs, len) without checking that len bytes
remain in the buffer. The existing boundary check only validates the
2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint()
reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte
slab-out-of-bounds read.
Add a boundary check for len bytes after get_bits() and before
get_uint().
Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_h323_asn1.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 62aa22a078769..c972e9488e16f 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -331,6 +331,8 @@ static int decode_int(struct bitstr *bs, const struct field_t *f,
if (nf_h323_error_boundary(bs, 0, 2))
return H323_ERROR_BOUND;
len = get_bits(bs, 2) + 1;
+ if (nf_h323_error_boundary(bs, len, 0))
+ return H323_ERROR_BOUND;
BYTE_ALIGN(bs);
if (base && (f->attr & DECODE)) { /* timeToLive */
unsigned int v = get_uint(bs, len) + f->lb;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 209/491] netfilter: nft_ct: add seqadj extension for natted connections
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 208/491] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 210/491] netfilter: nft_ct: drop pending enqueued packets on removal Greg Kroah-Hartman
` (286 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Melnychenko, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Melnychenko <a.melnychenko@vyos.io>
[ Upstream commit 90918e3b6404c2a37837b8f11692471b4c512de2 ]
Sequence adjustment may be required for FTP traffic with PASV/EPSV modes.
due to need to re-write packet payload (IP, port) on the ftp control
connection. This can require changes to the TCP length and expected
seq / ack_seq.
The easiest way to reproduce this issue is with PASV mode.
Example ruleset:
table inet ftp_nat {
ct helper ftp_helper {
type "ftp" protocol tcp
l3proto inet
}
chain prerouting {
type filter hook prerouting priority 0; policy accept;
tcp dport 21 ct state new ct helper set "ftp_helper"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
tcp dport 21 dnat ip prefix to ip daddr map {
192.168.100.1 : 192.168.13.2/32 }
}
chain postrouting {
type nat hook postrouting priority 100 ; policy accept;
tcp sport 21 snat ip prefix to ip saddr map {
192.168.13.2 : 192.168.100.1/32 }
}
}
Note that the ftp helper gets assigned *after* the dnat setup.
The inverse (nat after helper assign) is handled by an existing
check in nf_nat_setup_info() and will not show the problem.
Topoloy:
+-------------------+ +----------------------------------+
| FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
+-------------------+ +----------------------------------+
|
+-----------------------+
| Client: 192.168.100.2 |
+-----------------------+
ftp nat changes do not work as expected in this case:
Connected to 192.168.100.1.
[..]
ftp> epsv
EPSV/EPRT on IPv4 off.
ftp> ls
227 Entering passive mode (192,168,100,1,209,129).
421 Service not available, remote server has closed connection.
Kernel logs:
Missing nfct_seqadj_ext_add() setup call
WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41
[..]
__nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]
nf_nat_ftp+0x142/0x280 [nf_nat_ftp]
help+0x4d1/0x880 [nf_conntrack_ftp]
nf_confirm+0x122/0x2e0 [nf_conntrack]
nf_hook_slow+0x3c/0xb0
..
Fix this by adding the required extension when a conntrack helper is assigned
to a connection that has a nat binding.
Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support")
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 36eae0956f65 ("netfilter: nft_ct: drop pending enqueued packets on removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_ct.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index f95f1dbc48dea..0b194628818a5 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -22,6 +22,7 @@
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
struct nft_ct {
enum nft_ct_keys key:8;
@@ -1106,6 +1107,10 @@ static void nft_ct_helper_obj_eval(struct nft_object *obj,
if (help) {
rcu_assign_pointer(help->helper, to_assign);
set_bit(IPS_HELPER_BIT, &ct->status);
+
+ if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
+ if (!nfct_seqadj_ext_add(ct))
+ regs->verdict.code = NF_DROP;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 210/491] netfilter: nft_ct: drop pending enqueued packets on removal
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 209/491] netfilter: nft_ct: add seqadj extension for natted connections Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 211/491] netfilter: xt_CT: drop pending enqueued packets on template removal Greg Kroah-Hartman
` (285 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Pablo Neira Ayuso,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 36eae0956f659e48d5366d9b083d9417f3263ddc ]
Packets sitting in nfqueue might hold a reference to:
- templates that specify the conntrack zone, because a percpu area is
used and module removal is possible.
- conntrack timeout policies and helper, where object removal leave
a stale reference.
Since these objects can just go away, drop enqueued packets to avoid
stale reference to them.
If there is a need for finer grain removal, this logic can be revisited
to make selective packet drop upon dependencies.
Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_ct.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 0b194628818a5..e788d5d9e7aeb 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -23,6 +23,7 @@
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_seqadj.h>
+#include "nf_internals.h"
struct nft_ct {
enum nft_ct_keys key:8;
@@ -533,6 +534,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
#endif
#ifdef CONFIG_NF_CONNTRACK_ZONES
case NFT_CT_ZONE:
+ nf_queue_nf_hook_drop(ctx->net);
mutex_lock(&nft_ct_pcpu_mutex);
if (--nft_ct_pcpu_template_refcnt == 0)
nft_ct_tmpl_put_pcpu();
@@ -930,6 +932,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
struct nf_ct_timeout *timeout = priv->timeout;
+ nf_queue_nf_hook_drop(ctx->net);
nf_ct_untimeout(ctx->net, timeout);
nf_ct_netns_put(ctx->net, ctx->family);
kfree(priv->timeout);
@@ -1062,6 +1065,7 @@ static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
{
struct nft_ct_helper_obj *priv = nft_obj_data(obj);
+ nf_queue_nf_hook_drop(ctx->net);
if (priv->helper4)
nf_conntrack_helper_put(priv->helper4);
if (priv->helper6)
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 211/491] netfilter: xt_CT: drop pending enqueued packets on template removal
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 210/491] netfilter: nft_ct: drop pending enqueued packets on removal Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 212/491] netfilter: xt_time: use unsigned int for monthday bit shift Greg Kroah-Hartman
` (284 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Pablo Neira Ayuso,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit f62a218a946b19bb59abdd5361da85fa4606b96b ]
Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:
- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.
The use of templates with zone and event cache filter are safe, since
this just copies values.
Flush these enqueued packets in case the template rule gets removed.
Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_CT.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index ffff1e1f79b91..6ad76f3a956cc 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -16,6 +16,7 @@
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>
+#include "nf_internals.h"
static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
{
@@ -270,6 +271,9 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
struct nf_conn_help *help;
if (ct) {
+ if (info->helper[0] || info->timeout[0])
+ nf_queue_nf_hook_drop(par->net);
+
help = nfct_help(ct);
if (help)
nf_conntrack_helper_put(help->helper);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 212/491] netfilter: xt_time: use unsigned int for monthday bit shift
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 211/491] netfilter: xt_CT: drop pending enqueued packets on template removal Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 213/491] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Greg Kroah-Hartman
` (283 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Klaudia Kloc, Dawid Moczadło,
Jenny Guanni Qu, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <qguanni@gmail.com>
[ Upstream commit 00050ec08cecfda447e1209b388086d76addda3a ]
The monthday field can be up to 31, and shifting a signed integer 1
by 31 positions (1 << 31) is undefined behavior in C, as the result
overflows a 32-bit signed int. Use 1U to ensure well-defined behavior
for all valid monthday values.
Change the weekday shift to 1U as well for consistency.
Fixes: ee4411a1b1e0 ("[NETFILTER]: x_tables: add xt_time match")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_time.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 6aa12d0f54e23..61de85e02a40f 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -227,13 +227,13 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par)
localtime_2(¤t_time, stamp);
- if (!(info->weekdays_match & (1 << current_time.weekday)))
+ if (!(info->weekdays_match & (1U << current_time.weekday)))
return false;
/* Do not spend time computing monthday if all days match anyway */
if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) {
localtime_3(¤t_time, stamp);
- if (!(info->monthdays_match & (1 << current_time.monthday)))
+ if (!(info->monthdays_match & (1U << current_time.monthday)))
return false;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 213/491] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 212/491] netfilter: xt_time: use unsigned int for monthday bit shift Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 214/491] net: bcmgenet: increase WoL poll timeout Greg Kroah-Hartman
` (282 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Klaudia Kloc, Dawid Moczadło,
Jenny Guanni Qu, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <qguanni@gmail.com>
[ Upstream commit f173d0f4c0f689173f8cdac79991043a4a89bf66 ]
In DecodeQ931(), the UserUserIE code path reads a 16-bit length from
the packet, then decrements it by 1 to skip the protocol discriminator
byte before passing it to DecodeH323_UserInformation(). If the encoded
length is 0, the decrement wraps to -1, which is then passed as a
large value to the decoder, leading to an out-of-bounds read.
Add a check to ensure len is positive after the decrement.
Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_h323_asn1.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index c972e9488e16f..7b1497ed97d26 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -924,6 +924,8 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931)
break;
p++;
len--;
+ if (len <= 0)
+ break;
return DecodeH323_UserInformation(buf, p, len,
&q931->UUIE);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 214/491] net: bcmgenet: increase WoL poll timeout
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 213/491] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 215/491] sched: idle: Consolidate the handling of two special cases Greg Kroah-Hartman
` (281 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Chen, Florian Fainelli,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
[ Upstream commit 6cfc3bc02b977f2fba5f7268e6504d1931a774f7 ]
Some systems require more than 5ms to get into WoL mode. Increase the
timeout value to 50ms.
Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260312191852.3904571-1-justin.chen@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index 35c12938cb348..ac402631576cc 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -102,7 +102,7 @@ static int bcmgenet_poll_wol_status(struct bcmgenet_priv *priv)
while (!(bcmgenet_rbuf_readl(priv, RBUF_STATUS)
& RBUF_STATUS_WOL)) {
retries++;
- if (retries > 5) {
+ if (retries > 50) {
netdev_crit(dev, "polling wol mode timeout\n");
return -ETIMEDOUT;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 215/491] sched: idle: Consolidate the handling of two special cases
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 214/491] net: bcmgenet: increase WoL poll timeout Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 216/491] PM: runtime: Fix a race condition related to device removal Greg Kroah-Hartman
` (280 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Christian Loehle,
Frederic Weisbecker, Qais Yousef, Aboorva Devarajan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit f4c31b07b136839e0fb3026f8a5b6543e3b14d2f ]
There are two special cases in the idle loop that are handled
inconsistently even though they are analogous.
The first one is when a cpuidle driver is absent and the default CPU
idle time power management implemented by the architecture code is used.
In that case, the scheduler tick is stopped every time before invoking
default_idle_call().
The second one is when a cpuidle driver is present, but there is only
one idle state in its table. In that case, the scheduler tick is never
stopped at all.
Since each of these approaches has its drawbacks, reconcile them with
the help of one simple heuristic. Namely, stop the tick if the CPU has
been woken up by it in the previous iteration of the idle loop, or let
it tick otherwise.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Qais Yousef <qyousef@layalina.io>
Reviewed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Fixes: ed98c3491998 ("sched: idle: Do not stop the tick before cpuidle_idle_call()")
[ rjw: Added Fixes tag, changelog edits ]
Link: https://patch.msgid.link/4741364.LvFx2qVVIh@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/idle.c | 30 +++++++++++++++++++++---------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 8c38b4fe9ee72..50b18ba9ca9cd 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -158,6 +158,14 @@ static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev,
return cpuidle_enter(drv, dev, next_state);
}
+static void idle_call_stop_or_retain_tick(bool stop_tick)
+{
+ if (stop_tick || tick_nohz_tick_stopped())
+ tick_nohz_idle_stop_tick();
+ else
+ tick_nohz_idle_retain_tick();
+}
+
/**
* cpuidle_idle_call - the main idle function
*
@@ -167,7 +175,7 @@ static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev,
* set, and it returns with polling set. If it ever stops polling, it
* must clear the polling bit.
*/
-static void cpuidle_idle_call(void)
+static void cpuidle_idle_call(bool stop_tick)
{
struct cpuidle_device *dev = cpuidle_get_device();
struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
@@ -189,7 +197,7 @@ static void cpuidle_idle_call(void)
*/
if (cpuidle_not_available(drv, dev)) {
- tick_nohz_idle_stop_tick();
+ idle_call_stop_or_retain_tick(stop_tick);
default_idle_call();
goto exit_idle;
@@ -224,17 +232,19 @@ static void cpuidle_idle_call(void)
next_state = cpuidle_find_deepest_state(drv, dev, max_latency_ns);
call_cpuidle(drv, dev, next_state);
} else if (drv->state_count > 1) {
- bool stop_tick = true;
+ /*
+ * stop_tick is expected to be true by default by cpuidle
+ * governors, which allows them to select idle states with
+ * target residency above the tick period length.
+ */
+ stop_tick = true;
/*
* Ask the cpuidle framework to choose a convenient idle state.
*/
next_state = cpuidle_select(drv, dev, &stop_tick);
- if (stop_tick || tick_nohz_tick_stopped())
- tick_nohz_idle_stop_tick();
- else
- tick_nohz_idle_retain_tick();
+ idle_call_stop_or_retain_tick(stop_tick);
entered_state = call_cpuidle(drv, dev, next_state);
/*
@@ -242,7 +252,7 @@ static void cpuidle_idle_call(void)
*/
cpuidle_reflect(dev, entered_state);
} else {
- tick_nohz_idle_retain_tick();
+ idle_call_stop_or_retain_tick(stop_tick);
/*
* If there is only a single idle state (or none), there is
@@ -270,6 +280,7 @@ static void cpuidle_idle_call(void)
static void do_idle(void)
{
int cpu = smp_processor_id();
+ bool got_tick = false;
/*
* Check if we need to update blocked load
@@ -312,8 +323,9 @@ static void do_idle(void)
tick_nohz_idle_restart_tick();
cpu_idle_poll();
} else {
- cpuidle_idle_call();
+ cpuidle_idle_call(got_tick);
}
+ got_tick = tick_nohz_idle_got_tick();
arch_cpu_idle_exit();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 216/491] PM: runtime: Fix a race condition related to device removal
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 215/491] sched: idle: Consolidate the handling of two special cases Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 217/491] net: usb: aqc111: Do not perform PM inside suspend callback Greg Kroah-Hartman
` (279 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Lei,
syzbot+6c905ab800f20cf4086c, Bart Van Assche, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 29ab768277617452d88c0607c9299cdc63b6e9ff ]
The following code in pm_runtime_work() may dereference the dev->parent
pointer after the parent device has been freed:
/* Maybe the parent is now able to suspend. */
if (parent && !parent->power.ignore_children) {
spin_unlock(&dev->power.lock);
spin_lock(&parent->power.lock);
rpm_idle(parent, RPM_ASYNC);
spin_unlock(&parent->power.lock);
spin_lock(&dev->power.lock);
}
Fix this by inserting a flush_work() call in pm_runtime_remove().
Without this patch blktest block/001 triggers the following complaint
sporadically:
BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160
Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081
Workqueue: pm pm_runtime_work
Call Trace:
<TASK>
dump_stack_lvl+0x61/0x80
print_address_description.constprop.0+0x8b/0x310
print_report+0xfd/0x1d7
kasan_report+0xd8/0x1d0
__kasan_check_byte+0x42/0x60
lock_acquire.part.0+0x38/0x230
lock_acquire+0x70/0x160
_raw_spin_lock+0x36/0x50
rpm_suspend+0xc6a/0xfe0
rpm_idle+0x578/0x770
pm_runtime_work+0xee/0x120
process_one_work+0xde3/0x1410
worker_thread+0x5eb/0xfe0
kthread+0x37b/0x480
ret_from_fork+0x6cb/0x920
ret_from_fork_asm+0x11/0x20
</TASK>
Allocated by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_alloc_info+0x3d/0x50
__kasan_kmalloc+0xa0/0xb0
__kmalloc_noprof+0x311/0x990
scsi_alloc_target+0x122/0xb60 [scsi_mod]
__scsi_scan_target+0x101/0x460 [scsi_mod]
scsi_scan_channel+0x179/0x1c0 [scsi_mod]
scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]
store_scan+0x2d2/0x390 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
do_syscall_64+0xee/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 4314:
kasan_save_stack+0x2a/0x50
kasan_save_track+0x18/0x40
kasan_save_free_info+0x3f/0x50
__kasan_slab_free+0x67/0x80
kfree+0x225/0x6c0
scsi_target_dev_release+0x3d/0x60 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]
device_release+0xa3/0x220
kobject_cleanup+0x105/0x3a0
kobject_put+0x72/0xd0
put_device+0x17/0x20
scsi_device_put+0x7f/0xc0 [scsi_mod]
sdev_store_delete+0xa5/0x120 [scsi_mod]
dev_attr_store+0x43/0x80
sysfs_kf_write+0xde/0x140
kernfs_fop_write_iter+0x3ef/0x670
vfs_write+0x506/0x1470
ksys_write+0xfd/0x230
__x64_sys_write+0x76/0xc0
x64_sys_call+0x213/0x1810
Reported-by: Ming Lei <ming.lei@redhat.com>
Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/
Reported-by: syzbot+6c905ab800f20cf4086c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/
Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/runtime.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index d15d033be2c97..ec14c3089e329 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1776,6 +1776,7 @@ void pm_runtime_reinit(struct device *dev)
void pm_runtime_remove(struct device *dev)
{
__pm_runtime_disable(dev, false);
+ flush_work(&dev->power.work);
pm_runtime_reinit(dev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 217/491] net: usb: aqc111: Do not perform PM inside suspend callback
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 216/491] PM: runtime: Fix a race condition related to device removal Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 218/491] igc: fix missing update of skb->tail in igc_xmit_frame() Greg Kroah-Hartman
` (278 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+48dc1e8dfc92faf1124c,
Nikola Z. Ivanov, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikola Z. Ivanov <zlatistiv@gmail.com>
[ Upstream commit 069c8f5aebe4d5224cf62acc7d4b3486091c658a ]
syzbot reports "task hung in rpm_resume"
This is caused by aqc111_suspend calling
the PM variant of its write_cmd routine.
The simplified call trace looks like this:
rpm_suspend()
usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING
aqc111_suspend() - called for the usb device interface
aqc111_write32_cmd()
usb_autopm_get_interface()
pm_runtime_resume_and_get()
rpm_resume() - here we call rpm_resume() on our parent
rpm_resume() - Here we wait for a status change that will never happen.
At this point we block another task which holds
rtnl_lock and locks up the whole networking stack.
Fix this by replacing the write_cmd calls with their _nopm variants
Reported-by: syzbot+48dc1e8dfc92faf1124c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48dc1e8dfc92faf1124c
Fixes: e58ba4544c77 ("net: usb: aqc111: Add support for wake on LAN by MAGIC packet")
Signed-off-by: Nikola Z. Ivanov <zlatistiv@gmail.com>
Link: https://patch.msgid.link/20260313141643.1181386-1-zlatistiv@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/aqc111.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index ab9431ea295ad..7d38ce2e77017 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1400,14 +1400,14 @@ static int aqc111_suspend(struct usb_interface *intf, pm_message_t message)
aqc111_write16_cmd_nopm(dev, AQ_ACCESS_MAC,
SFR_MEDIUM_STATUS_MODE, 2, ®16);
- aqc111_write_cmd(dev, AQ_WOL_CFG, 0, 0,
- WOL_CFG_SIZE, &wol_cfg);
- aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,
- &aqc111_data->phy_cfg);
+ aqc111_write_cmd_nopm(dev, AQ_WOL_CFG, 0, 0,
+ WOL_CFG_SIZE, &wol_cfg);
+ aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
+ &aqc111_data->phy_cfg);
} else {
aqc111_data->phy_cfg |= AQ_LOW_POWER;
- aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,
- &aqc111_data->phy_cfg);
+ aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
+ &aqc111_data->phy_cfg);
/* Disable RX path */
aqc111_read16_cmd_nopm(dev, AQ_ACCESS_MAC,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 218/491] igc: fix missing update of skb->tail in igc_xmit_frame()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 217/491] net: usb: aqc111: Do not perform PM inside suspend callback Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 219/491] wifi: mac80211: fix NULL deref in mesh_matches_local() Greg Kroah-Hartman
` (277 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kohei Enju, Simon Horman,
Paul Menzel, Avigail Dahan, Tony Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <kohei@enjuk.jp>
[ Upstream commit 0ffba246652faf4a36aedc66059c2f94e4c83ea5 ]
igc_xmit_frame() misses updating skb->tail when the packet size is
shorter than the minimum one.
Use skb_put_padto() in alignment with other Intel Ethernet drivers.
Fixes: 0507ef8a0372 ("igc: Add transmit and receive fastpath and interrupt handlers")
Signed-off-by: Kohei Enju <kohei@enjuk.jp>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igc/igc_main.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 7593e8b7469c5..e59de43704b51 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -1522,11 +1522,8 @@ static netdev_tx_t igc_xmit_frame(struct sk_buff *skb,
/* The minimum packet size with TCTL.PSP set is 17 so pad the skb
* in order to meet this minimum size requirement.
*/
- if (skb->len < 17) {
- if (skb_padto(skb, 17))
- return NETDEV_TX_OK;
- skb->len = 17;
- }
+ if (skb_put_padto(skb, 17))
+ return NETDEV_TX_OK;
return igc_xmit_frame_ring(skb, igc_tx_queue_mapping(adapter, skb));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 219/491] wifi: mac80211: fix NULL deref in mesh_matches_local()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 218/491] igc: fix missing update of skb->tail in igc_xmit_frame() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 220/491] wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Greg Kroah-Hartman
` (276 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit c73bb9a2d33bf81f6eecaa0f474b6c6dbe9855bd ]
mesh_matches_local() unconditionally dereferences ie->mesh_config to
compare mesh configuration parameters. When called from
mesh_rx_csa_frame(), the parsed action-frame elements may not contain a
Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a
kernel NULL pointer dereference.
The other two callers are already safe:
- ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before
calling mesh_matches_local()
- mesh_plink_get_event() is only reached through
mesh_process_plink_frame(), which checks !elems->mesh_config, too
mesh_rx_csa_frame() is the only caller that passes raw parsed elements
to mesh_matches_local() without guarding mesh_config. An adjacent
attacker can exploit this by sending a crafted CSA action frame that
includes a valid Mesh ID IE but omits the Mesh Configuration IE,
crashing the kernel.
The captured crash log:
Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: events_unbound cfg80211_wiphy_work
[...]
Call Trace:
<TASK>
? __pfx_mesh_matches_local (net/mac80211/mesh.c:65)
ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686)
[...]
ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802)
[...]
cfg80211_wiphy_work (net/wireless/core.c:426)
process_one_work (net/kernel/workqueue.c:3280)
? assign_work (net/kernel/workqueue.c:1219)
worker_thread (net/kernel/workqueue.c:3352)
? __pfx_worker_thread (net/kernel/workqueue.c:3385)
kthread (net/kernel/kthread.c:436)
[...]
ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255)
</TASK>
This patch adds a NULL check for ie->mesh_config at the top of
mesh_matches_local() to return false early when the Mesh Configuration
IE is absent.
Fixes: 2e3c8736820b ("mac80211: support functions for mesh")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260318034244.2595020-1-xmei5@asu.edu
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 20b8ff83e3dbd..4b09cd19c4e04 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -75,6 +75,9 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
* - MDA enabled
* - Power management control on fc
*/
+ if (!ie->mesh_config)
+ return false;
+
if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
(ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 220/491] wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 219/491] wifi: mac80211: fix NULL deref in mesh_matches_local() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 221/491] net: macb: fix uninitialized rx_fs_lock Greg Kroah-Hartman
` (275 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Astrand, Guenter Roeck,
Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit deb353d9bb009638b7762cae2d0b6e8fdbb41a69 ]
Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom
before skb_push"), wl1271_tx_allocate() and with it
wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.
However, in wlcore_tx_work_locked(), a return value of -EAGAIN from
wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being
full. This causes the code to flush the buffer, put the skb back at the
head of the queue, and immediately retry the same skb in a tight while
loop.
Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens
immediately with GFP_ATOMIC, this will result in an infinite loop and a
CPU soft lockup. Return -ENOMEM instead so the packet is dropped and
the loop terminates.
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
Assisted-by: Gemini:gemini-3.1-pro
Fixes: e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push")
Cc: Peter Astrand <astrand@lysator.liu.se>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://patch.msgid.link/20260318064636.3065925-1-linux@roeck-us.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ti/wlcore/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index e86cc3425e997..ac1411db8e5a8 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -213,7 +213,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
if (skb_headroom(skb) < (total_len - skb->len) &&
pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {
wl1271_free_tx_id(wl, id);
- return -EAGAIN;
+ return -ENOMEM;
}
desc = skb_push(skb, total_len - skb->len);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 221/491] net: macb: fix uninitialized rx_fs_lock
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 220/491] wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 222/491] udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n Greg Kroah-Hartman
` (274 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 34b11cc56e4369bc08b1f4c4a04222d75ed596ce ]
If hardware doesn't support RX Flow Filters, rx_fs_lock spinlock is not
initialized leading to the following assertion splat triggerable via
set_rxnfc callback.
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 949 Comm: syz.0.6 Not tainted 6.1.164+ #113
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:974 [inline]
register_lock_class+0x141b/0x17f0 kernel/locking/lockdep.c:1287
__lock_acquire+0x74f/0x6c40 kernel/locking/lockdep.c:4928
lock_acquire kernel/locking/lockdep.c:5662 [inline]
lock_acquire+0x190/0x4b0 kernel/locking/lockdep.c:5627
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x33/0x50 kernel/locking/spinlock.c:162
gem_del_flow_filter drivers/net/ethernet/cadence/macb_main.c:3562 [inline]
gem_set_rxnfc+0x533/0xac0 drivers/net/ethernet/cadence/macb_main.c:3667
ethtool_set_rxnfc+0x18c/0x280 net/ethtool/ioctl.c:961
__dev_ethtool net/ethtool/ioctl.c:2956 [inline]
dev_ethtool+0x229c/0x6290 net/ethtool/ioctl.c:3095
dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510
sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215
sock_ioctl+0x577/0x6d0 net/socket.c:1320
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
A more straightforward solution would be to always initialize rx_fs_lock,
just like rx_fs_list. However, in this case the driver set_rxnfc callback
would return with a rather confusing error code, e.g. -EINVAL. So deny
set_rxnfc attempts directly if the RX filtering feature is not supported
by hardware.
Fixes: ae8223de3df5 ("net: macb: Added support for RX filtering")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20260316103826.74506-2-pchelkin@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index c407e8d0eb618..f49e4e0494db3 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -3381,6 +3381,9 @@ static int gem_set_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd)
struct macb *bp = netdev_priv(netdev);
int ret;
+ if (!(netdev->hw_features & NETIF_F_NTUPLE))
+ return -EOPNOTSUPP;
+
switch (cmd->cmd) {
case ETHTOOL_SRXCLSRLINS:
if ((cmd->fs.location >= bp->max_tuples)
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 222/491] udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 221/491] net: macb: fix uninitialized rx_fs_lock Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 223/491] net: bonding: fix NULL deref in bond_debug_rlb_hash_show Greg Kroah-Hartman
` (273 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit b3a6df291fecf5f8a308953b65ca72b7fc9e015d ]
When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0
(success) without actually creating a socket. Callers such as
fou_create() then proceed to dereference the uninitialized socket
pointer, resulting in a NULL pointer dereference.
The captured NULL deref crash:
BUG: kernel NULL pointer dereference, address: 0000000000000018
RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)
[...]
Call Trace:
<TASK>
genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)
genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
[...]
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
genl_rcv (net/netlink/genetlink.c:1219)
netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))
__sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))
__x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))
do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)
This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so
callers correctly take their error paths. There is only one caller of
the vulnerable function and only privileged users can trigger it.
Fixes: fd384412e199b ("udp_tunnel: Seperate ipv6 functions into its own file.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260317010241.1893893-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/udp_tunnel.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index 24ece06bad9ef..97a739c21f1f8 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -47,7 +47,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
static inline int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
struct socket **sockp)
{
- return 0;
+ return -EPFNOSUPPORT;
}
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 223/491] net: bonding: fix NULL deref in bond_debug_rlb_hash_show
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 222/491] udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 224/491] nfnetlink_osf: validate individual option lengths in fingerprints Greg Kroah-Hartman
` (272 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 605b52497bf89b3b154674deb135da98f916e390 ]
rlb_clear_slave intentionally keeps RLB hash-table entries on
the rx_hashtbl_used_head list with slave set to NULL when no
replacement slave is available. However, bond_debug_rlb_hash_show
visites client_info->slave without checking if it's NULL.
Other used-list iterators in bond_alb.c already handle this NULL-slave
state safely:
- rlb_update_client returns early on !client_info->slave
- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance
compare slave values before visiting
- lb_req_update_subnet_clients continues if slave is NULL
The following NULL deref crash can be trigger in
bond_debug_rlb_hash_show:
[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)
[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286
[ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204
[ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078
[ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000
[ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0
[ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8
[ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000
[ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0
[ 1.295897] Call Trace:
[ 1.296134] seq_read_iter (fs/seq_file.c:231)
[ 1.296341] seq_read (fs/seq_file.c:164)
[ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))
[ 1.296658] vfs_read (fs/read_write.c:572)
[ 1.296981] ksys_read (fs/read_write.c:717)
[ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
[ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add a NULL check and print "(none)" for entries with no assigned slave.
Fixes: caafa84251b88 ("bonding: add the debugfs interface to see RLB hash table")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260317005034.1888794-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_debugfs.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
index 8b6cf2bf9025a..bb31f986ae592 100644
--- a/drivers/net/bonding/bond_debugfs.c
+++ b/drivers/net/bonding/bond_debugfs.c
@@ -34,11 +34,17 @@ static int bond_debug_rlb_hash_show(struct seq_file *m, void *v)
for (; hash_index != RLB_NULL_INDEX;
hash_index = client_info->used_next) {
client_info = &(bond_info->rx_hashtbl[hash_index]);
- seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
- &client_info->ip_src,
- &client_info->ip_dst,
- &client_info->mac_dst,
- client_info->slave->dev->name);
+ if (client_info->slave)
+ seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
+ &client_info->ip_src,
+ &client_info->ip_dst,
+ &client_info->mac_dst,
+ client_info->slave->dev->name);
+ else
+ seq_printf(m, "%-15pI4 %-15pI4 %-17pM (none)\n",
+ &client_info->ip_src,
+ &client_info->ip_dst,
+ &client_info->mac_dst);
}
spin_unlock_bh(&bond->mode_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 224/491] nfnetlink_osf: validate individual option lengths in fingerprints
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 223/491] net: bonding: fix NULL deref in bond_debug_rlb_hash_show Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 225/491] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Greg Kroah-Hartman
` (271 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit dbdfaae9609629a9569362e3b8f33d0a20fd783c ]
nfnl_osf_add_callback() validates opt_num bounds and string
NUL-termination but does not check individual option length fields.
A zero-length option causes nf_osf_match_one() to enter the option
matching loop even when foptsize sums to zero, which matches packets
with no TCP options where ctx->optp is NULL:
Oops: general protection fault
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
nf_osf_match (net/netfilter/nfnetlink_osf.c:227)
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)
nf_hook_slow (net/netfilter/core.c:623)
ip_local_deliver (net/ipv4/ip_input.c:262)
ip_rcv (net/ipv4/ip_input.c:573)
Additionally, an MSS option (kind=2) with length < 4 causes
out-of-bounds reads when nf_osf_match_one() unconditionally accesses
optp[2] and optp[3] for MSS value extraction. While RFC 9293
section 3.2 specifies that the MSS option is always exactly 4
bytes (Kind=2, Length=4), the check uses "< 4" rather than
"!= 4" because lengths greater than 4 do not cause memory
safety issues -- the buffer is guaranteed to be at least
foptsize bytes by the ctx->optsize == foptsize check.
Reject fingerprints where any option has zero length, or where an MSS
option has length less than 4, at add time rather than trusting these
values in the packet matching hot path.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_osf.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 573a372e760f4..a2d7bfb4c1a69 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -303,7 +303,9 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
{
struct nf_osf_user_finger *f;
struct nf_osf_finger *kf = NULL, *sf;
+ unsigned int tot_opt_len = 0;
int err = 0;
+ int i;
if (!capable(CAP_NET_ADMIN))
return -EPERM;
@@ -319,6 +321,17 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
if (f->opt_num > ARRAY_SIZE(f->opt))
return -EINVAL;
+ for (i = 0; i < f->opt_num; i++) {
+ if (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)
+ return -EINVAL;
+ if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
+ return -EINVAL;
+
+ tot_opt_len += f->opt[i].length;
+ if (tot_opt_len > MAX_IPOPTLEN)
+ return -EINVAL;
+ }
+
if (!memchr(f->genre, 0, MAXGENRELEN) ||
!memchr(f->subtype, 0, MAXGENRELEN) ||
!memchr(f->version, 0, MAXGENRELEN))
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 225/491] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 224/491] nfnetlink_osf: validate individual option lengths in fingerprints Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 226/491] icmp: fix NULL pointer dereference in icmp_tag_validation() Greg Kroah-Hartman
` (270 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Anas Iqbal, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anas Iqbal <mohd.abd.6602@gmail.com>
[ Upstream commit b48731849609cbd8c53785a48976850b443153fd ]
Smatch reports:
drivers/net/dsa/bcm_sf2.c:997 bcm_sf2_sw_resume() warn:
'priv->clk' from clk_prepare_enable() not released on lines: 983,990.
The clock enabled by clk_prepare_enable() in bcm_sf2_sw_resume()
is not released if bcm_sf2_sw_rst() or bcm_sf2_cfp_resume() fails.
Add the missing clk_disable_unprepare() calls in the error paths
to properly release the clock resource.
Fixes: e9ec5c3bd238 ("net: dsa: bcm_sf2: request and handle clocks")
Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com>
Link: https://patch.msgid.link/20260318084212.1287-1-mohd.abd.6602@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/bcm_sf2.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index d0f94a5fae5ae..7c64317e0f191 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -871,13 +871,17 @@ static int bcm_sf2_sw_resume(struct dsa_switch *ds)
ret = bcm_sf2_sw_rst(priv);
if (ret) {
pr_err("%s: failed to software reset switch\n", __func__);
+ if (!priv->wol_ports_mask)
+ clk_disable_unprepare(priv->clk);
return ret;
}
ret = bcm_sf2_cfp_resume(ds);
- if (ret)
+ if (ret) {
+ if (!priv->wol_ports_mask)
+ clk_disable_unprepare(priv->clk);
return ret;
-
+ }
if (priv->hw_params.num_gphy == 1)
bcm_sf2_gphy_enable_set(ds, true);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 226/491] icmp: fix NULL pointer dereference in icmp_tag_validation()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 225/491] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 227/491] hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() Greg Kroah-Hartman
` (269 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 614aefe56af8e13331e50220c936fc0689cf5675 ]
icmp_tag_validation() unconditionally dereferences the result of
rcu_dereference(inet_protos[proto]) without checking for NULL.
The inet_protos[] array is sparse -- only about 15 of 256 protocol
numbers have registered handlers. When ip_no_pmtu_disc is set to 3
(hardened PMTU mode) and the kernel receives an ICMP Fragmentation
Needed error with a quoted inner IP header containing an unregistered
protocol number, the NULL dereference causes a kernel panic in
softirq context.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)
Call Trace:
<IRQ>
icmp_rcv (net/ipv4/icmp.c:1527)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
ip_local_deliver_finish (net/ipv4/ip_input.c:242)
ip_local_deliver (net/ipv4/ip_input.c:262)
ip_rcv (net/ipv4/ip_input.c:573)
__netif_receive_skb_one_core (net/core/dev.c:6164)
process_backlog (net/core/dev.c:6628)
handle_softirqs (kernel/softirq.c:561)
</IRQ>
Add a NULL check before accessing icmp_strict_tag_validation. If the
protocol has no registered handler, return false since it cannot
perform strict tag validation.
Fixes: 8ed1dc44d3e9 ("ipv4: introduce hardened ip_no_pmtu_disc mode")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/icmp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index efeeed4f0517e..3c74fecce2382 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -844,10 +844,12 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
static bool icmp_tag_validation(int proto)
{
+ const struct net_protocol *ipprot;
bool ok;
rcu_read_lock();
- ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+ ipprot = rcu_dereference(inet_protos[proto]);
+ ok = ipprot ? ipprot->icmp_strict_tag_validation : false;
rcu_read_unlock();
return ok;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 227/491] hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 226/491] icmp: fix NULL pointer dereference in icmp_tag_validation() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 228/491] i2c: fsi: Fix a potential leak in fsi_i2c_probe() Greg Kroah-Hartman
` (268 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
commit 86259558e422b250aa6aa57163a6d759074573f5 upstream.
isl68137_avs_enable_show_page() uses the return value of
pmbus_read_byte_data() without checking for errors. If the I2C transaction
fails, a negative error code is passed through bitwise operations,
producing incorrect output.
Add an error check to propagate the return value if it is negative.
Additionally, modernize the callback by replacing sprintf()
with sysfs_emit().
Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260318193952.47908-2-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/pmbus/isl68137.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/pmbus/isl68137.c
+++ b/drivers/hwmon/pmbus/isl68137.c
@@ -80,8 +80,11 @@ static ssize_t isl68137_avs_enable_show_
{
int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
- return sprintf(buf, "%d\n",
- (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS ? 1 : 0);
+ if (val < 0)
+ return val;
+
+ return sysfs_emit(buf, "%d\n",
+ (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS);
}
static ssize_t isl68137_avs_enable_store_page(struct i2c_client *client,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 228/491] i2c: fsi: Fix a potential leak in fsi_i2c_probe()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 227/491] hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 229/491] mtd: rawnand: serialize lock/unlock against other NAND operations Greg Kroah-Hartman
` (267 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Andi Shyti
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed upstream.
In the commit in Fixes:, when the code has been updated to use an explicit
for loop, instead of for_each_available_child_of_node(), the assumption
that a reference to a device_node structure would be released at each
iteration has been broken.
Now, an explicit of_node_put() is needed to release the reference.
Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-fsi.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/i2c/busses/i2c-fsi.c
+++ b/drivers/i2c/busses/i2c-fsi.c
@@ -728,6 +728,7 @@ static int fsi_i2c_probe(struct device *
rc = i2c_add_adapter(&port->adapter);
if (rc < 0) {
dev_err(dev, "Failed to register adapter: %d\n", rc);
+ of_node_put(np);
kfree(port);
continue;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 229/491] mtd: rawnand: serialize lock/unlock against other NAND operations
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 228/491] i2c: fsi: Fix a potential leak in fsi_i2c_probe() Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 230/491] mtd: rawnand: brcmnand: read/write oob during EDU transfer Greg Kroah-Hartman
` (266 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kamal Dasu, William Zhang,
Miquel Raynal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Dasu <kamal.dasu@broadcom.com>
[ Upstream commit bab2bc6e850a697a23b9e5f0e21bb8c187615e95 ]
nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
without holding the NAND device lock. On controllers that implement
SET_FEATURES via multiple low-level PIO commands, these can race with
concurrent UBI/UBIFS background erase/write operations that hold the
device lock, resulting in cmd_pending conflicts on the NAND controller.
Add nand_get_device()/nand_release_device() around the lock/unlock
operations to serialize them against all other NAND controller access.
Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation")
Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/nand_base.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index 308fcbe394a5e..b40dc3ac8615a 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -4383,11 +4383,16 @@ static void nand_shutdown(struct mtd_info *mtd)
static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
{
struct nand_chip *chip = mtd_to_nand(mtd);
+ int ret;
if (!chip->ops.lock_area)
return -ENOTSUPP;
- return chip->ops.lock_area(chip, ofs, len);
+ nand_get_device(chip);
+ ret = chip->ops.lock_area(chip, ofs, len);
+ nand_release_device(chip);
+
+ return ret;
}
/**
@@ -4399,11 +4404,16 @@ static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
static int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
{
struct nand_chip *chip = mtd_to_nand(mtd);
+ int ret;
if (!chip->ops.unlock_area)
return -ENOTSUPP;
- return chip->ops.unlock_area(chip, ofs, len);
+ nand_get_device(chip);
+ ret = chip->ops.unlock_area(chip, ofs, len);
+ nand_release_device(chip);
+
+ return ret;
}
/* Set default functions */
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 230/491] mtd: rawnand: brcmnand: read/write oob during EDU transfer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 229/491] mtd: rawnand: serialize lock/unlock against other NAND operations Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 231/491] mtd: rawnand: brcmnand: move to polling in pio mode on oops write Greg Kroah-Hartman
` (265 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kamal Dasu, Miquel Raynal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Dasu <kdasu.kdev@gmail.com>
[ Upstream commit a071912636cc3420f54e2a6312c1625ac763cf03 ]
Added support to read/write oob during EDU transfers.
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210311170909.9031-1-kdasu.kdev@gmail.com
Stable-dep-of: da9ba4dcc01e ("mtd: rawnand: brcmnand: skip DMA during panic write")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 59 +++++++++++++++++++++---
1 file changed, 52 insertions(+), 7 deletions(-)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index cb35090510470..a101df3b19f70 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -245,6 +245,9 @@ struct brcmnand_controller {
u32 edu_ext_addr;
u32 edu_cmd;
u32 edu_config;
+ int sas; /* spare area size, per flash cache */
+ int sector_size_1k;
+ u8 *oob;
/* flash_dma reg */
const u16 *flash_dma_offsets;
@@ -252,7 +255,7 @@ struct brcmnand_controller {
dma_addr_t dma_pa;
int (*dma_trans)(struct brcmnand_host *host, u64 addr, u32 *buf,
- u32 len, u8 dma_cmd);
+ u8 *oob, u32 len, u8 dma_cmd);
/* in-memory cache of the FLASH_CACHE, used only for some commands */
u8 flash_cache[FC_BYTES];
@@ -1527,6 +1530,23 @@ static irqreturn_t brcmnand_edu_irq(int irq, void *data)
edu_writel(ctrl, EDU_EXT_ADDR, ctrl->edu_ext_addr);
edu_readl(ctrl, EDU_EXT_ADDR);
+ if (ctrl->oob) {
+ if (ctrl->edu_cmd == EDU_CMD_READ) {
+ ctrl->oob += read_oob_from_regs(ctrl,
+ ctrl->edu_count + 1,
+ ctrl->oob, ctrl->sas,
+ ctrl->sector_size_1k);
+ } else {
+ brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+ ctrl->edu_ext_addr);
+ brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
+ ctrl->oob += write_oob_to_regs(ctrl,
+ ctrl->edu_count,
+ ctrl->oob, ctrl->sas,
+ ctrl->sector_size_1k);
+ }
+ }
+
mb(); /* flush previous writes */
edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
edu_readl(ctrl, EDU_CMD);
@@ -1908,9 +1928,10 @@ static void brcmnand_write_buf(struct nand_chip *chip, const uint8_t *buf,
* Kick EDU engine
*/
static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
- u32 len, u8 cmd)
+ u8 *oob, u32 len, u8 cmd)
{
struct brcmnand_controller *ctrl = host->ctrl;
+ struct brcmnand_cfg *cfg = &host->hwcfg;
unsigned long timeo = msecs_to_jiffies(200);
int ret = 0;
int dir = (cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE);
@@ -1918,6 +1939,9 @@ static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
unsigned int trans = len >> FC_SHIFT;
dma_addr_t pa;
+ dev_dbg(ctrl->dev, "EDU %s %p:%p\n", ((edu_cmd == EDU_CMD_READ) ?
+ "read" : "write"), buf, oob);
+
pa = dma_map_single(ctrl->dev, buf, len, dir);
if (dma_mapping_error(ctrl->dev, pa)) {
dev_err(ctrl->dev, "unable to map buffer for EDU DMA\n");
@@ -1929,6 +1953,8 @@ static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
ctrl->edu_ext_addr = addr;
ctrl->edu_cmd = edu_cmd;
ctrl->edu_count = trans;
+ ctrl->sas = cfg->spare_area_size;
+ ctrl->oob = oob;
edu_writel(ctrl, EDU_DRAM_ADDR, (u32)ctrl->edu_dram_addr);
edu_readl(ctrl, EDU_DRAM_ADDR);
@@ -1937,6 +1963,16 @@ static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
edu_writel(ctrl, EDU_LENGTH, FC_BYTES);
edu_readl(ctrl, EDU_LENGTH);
+ if (ctrl->oob && (ctrl->edu_cmd == EDU_CMD_WRITE)) {
+ brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+ ctrl->edu_ext_addr);
+ brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
+ ctrl->oob += write_oob_to_regs(ctrl,
+ 1,
+ ctrl->oob, ctrl->sas,
+ ctrl->sector_size_1k);
+ }
+
/* Start edu engine */
mb(); /* flush previous writes */
edu_writel(ctrl, EDU_CMD, ctrl->edu_cmd);
@@ -1951,6 +1987,14 @@ static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
dma_unmap_single(ctrl->dev, pa, len, dir);
+ /* read last subpage oob */
+ if (ctrl->oob && (ctrl->edu_cmd == EDU_CMD_READ)) {
+ ctrl->oob += read_oob_from_regs(ctrl,
+ 1,
+ ctrl->oob, ctrl->sas,
+ ctrl->sector_size_1k);
+ }
+
/* for program page check NAND status */
if (((brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
INTFC_FLASH_STATUS) & NAND_STATUS_FAIL) &&
@@ -2060,7 +2104,7 @@ static void brcmnand_dma_run(struct brcmnand_host *host, dma_addr_t desc)
}
static int brcmnand_dma_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
- u32 len, u8 dma_cmd)
+ u8 *oob, u32 len, u8 dma_cmd)
{
struct brcmnand_controller *ctrl = host->ctrl;
dma_addr_t buf_pa;
@@ -2205,8 +2249,9 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
try_dmaread:
brcmnand_clear_ecc_addr(ctrl);
- if (ctrl->dma_trans && !oob && flash_dma_buf_ok(buf)) {
- err = ctrl->dma_trans(host, addr, buf,
+ if (ctrl->dma_trans && (has_edu(ctrl) || !oob) &&
+ flash_dma_buf_ok(buf)) {
+ err = ctrl->dma_trans(host, addr, buf, oob,
trans * FC_BYTES,
CMD_PAGE_READ);
@@ -2354,8 +2399,8 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
for (i = 0; i < ctrl->max_oob; i += 4)
oob_reg_write(ctrl, i, 0xffffffff);
- if (use_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
- if (ctrl->dma_trans(host, addr, (u32 *)buf, mtd->writesize,
+ if (use_dma(ctrl) && (has_edu(ctrl) || !oob) && flash_dma_buf_ok(buf)) {
+ if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,
CMD_PROGRAM_PAGE))
ret = -EIO;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 231/491] mtd: rawnand: brcmnand: move to polling in pio mode on oops write
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 230/491] mtd: rawnand: brcmnand: read/write oob during EDU transfer Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 232/491] mtd: rawnand: brcmnand: skip DMA during panic write Greg Kroah-Hartman
` (264 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kamal Dasu, Miquel Raynal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Dasu <kdasu.kdev@gmail.com>
[ Upstream commit 22ca05b82d3e3abc2b116a11ee41b6b692b95530 ]
This change makes sure that Broadcom NAND driver moves to interrupt
polling on the first brcmnand_write() call.
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210311170909.9031-2-kdasu.kdev@gmail.com
Stable-dep-of: da9ba4dcc01e ("mtd: rawnand: brcmnand: skip DMA during panic write")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index a101df3b19f70..669c332d37ee8 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -2399,6 +2399,10 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
for (i = 0; i < ctrl->max_oob; i += 4)
oob_reg_write(ctrl, i, 0xffffffff);
+ if (mtd->oops_panic_write)
+ /* switch to interrupt polling and PIO mode */
+ disable_ctrl_irqs(ctrl);
+
if (use_dma(ctrl) && (has_edu(ctrl) || !oob) && flash_dma_buf_ok(buf)) {
if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,
CMD_PROGRAM_PAGE))
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 232/491] mtd: rawnand: brcmnand: skip DMA during panic write
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 231/491] mtd: rawnand: brcmnand: move to polling in pio mode on oops write Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 233/491] tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure Greg Kroah-Hartman
` (263 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kamal Dasu, William Zhang,
Florian Fainelli, Miquel Raynal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Dasu <kamal.dasu@broadcom.com>
[ Upstream commit da9ba4dcc01e7cf52b7676f0ee9607b8358c2171 ]
When oops_panic_write is set, the driver disables interrupts and
switches to PIO polling mode but still falls through into the DMA
path. DMA cannot be used reliably in panic context, so make the
DMA path an else branch to ensure only PIO is used during panic
writes.
Fixes: c1ac2dc34b51 ("mtd: rawnand: brcmnand: When oops in progress use pio and interrupt polling")
Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index 669c332d37ee8..e4739d843f7b8 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -2399,14 +2399,12 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
for (i = 0; i < ctrl->max_oob; i += 4)
oob_reg_write(ctrl, i, 0xffffffff);
- if (mtd->oops_panic_write)
+ if (mtd->oops_panic_write) {
/* switch to interrupt polling and PIO mode */
disable_ctrl_irqs(ctrl);
-
- if (use_dma(ctrl) && (has_edu(ctrl) || !oob) && flash_dma_buf_ok(buf)) {
+ } else if (use_dma(ctrl) && (has_edu(ctrl) || !oob) && flash_dma_buf_ok(buf)) {
if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,
CMD_PROGRAM_PAGE))
-
ret = -EIO;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 233/491] tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 232/491] mtd: rawnand: brcmnand: skip DMA during panic write Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 234/491] netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Greg Kroah-Hartman
` (262 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Law, Masami Hiramatsu (Google),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Law <objecting@objecting.org>
[ Upstream commit 3b2c2ab4ceb82af484310c3087541eab00ea288b ]
If fstat() fails after open() succeeds, the function returns without
closing the file descriptor. Also preserve errno across close(), since
close() may overwrite it before the error is returned.
Link: https://lore.kernel.org/all/20260318155847.78065-3-objecting@objecting.org/
Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command")
Signed-off-by: Josh Law <objecting@objecting.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bootconfig/main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
index 365c022fb7cdd..387cb91862dfc 100644
--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -138,8 +138,11 @@ static int load_xbc_file(const char *path, char **buf)
if (fd < 0)
return -errno;
ret = fstat(fd, &stat);
- if (ret < 0)
- return -errno;
+ if (ret < 0) {
+ ret = -errno;
+ close(fd);
+ return ret;
+ }
ret = load_xbc_fd(fd, buf, stat.st_size);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 234/491] netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 233/491] tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure Greg Kroah-Hartman
@ 2026-04-13 15:57 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 235/491] xen/privcmd: restrict usage in unprivileged domU Greg Kroah-Hartman
` (261 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Florian Westphal,
David Krehwinkel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 9df95785d3d8302f7c066050117b04cd3c2048c2 upstream.
Yiming Qian reports Use-after-free in the pipapo set type:
Under a large number of expired elements, commit-time GC can run for a very
long time in a non-preemptible context, triggering soft lockup warnings and
RCU stall reports (local denial of service).
We must split GC in an unlink and a reclaim phase.
We cannot queue elements for freeing until pointers have been swapped.
Expired elements are still exposed to both the packet path and userspace
dumpers via the live copy of the data structure.
call_rcu() does not protect us: dump operations or element lookups starting
after call_rcu has fired can still observe the free'd element, unless the
commit phase has made enough progress to swap the clone and live pointers
before any new reader has picked up the old version.
This a similar approach as done recently for the rbtree backend in commit
35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David Krehwinkel <davidkrehwinkel@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/netfilter/nf_tables.h | 5 ++++
net/netfilter/nf_tables_api.c | 5 ----
net/netfilter/nft_set_pipapo.c | 43 +++++++++++++++++++++++++++++---------
net/netfilter/nft_set_pipapo.h | 2 +
4 files changed, 40 insertions(+), 15 deletions(-)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1570,6 +1570,11 @@ struct nft_trans_gc {
struct rcu_head rcu;
};
+static inline int nft_trans_gc_space(const struct nft_trans_gc *trans)
+{
+ return NFT_TRANS_GC_BATCHCOUNT - trans->count;
+}
+
struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,
unsigned int gc_seq, gfp_t gfp);
void nft_trans_gc_destroy(struct nft_trans_gc *trans);
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8334,11 +8334,6 @@ static void nft_trans_gc_queue_work(stru
schedule_work(&trans_gc_work);
}
-static int nft_trans_gc_space(struct nft_trans_gc *trans)
-{
- return NFT_TRANS_GC_BATCHCOUNT - trans->count;
-}
-
struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,
unsigned int gc_seq, gfp_t gfp)
{
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1583,11 +1583,11 @@ static void nft_pipapo_gc_deactivate(str
}
/**
- * pipapo_gc() - Drop expired entries from set, destroy start and end elements
+ * pipapo_gc_scan() - Drop expired entries from set and link them to gc list
* @_set: nftables API set representation
* @m: Matching data
*/
-static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m)
+static void pipapo_gc_scan(const struct nft_set *_set, struct nft_pipapo_match *m)
{
struct nft_set *set = (struct nft_set *) _set;
struct nft_pipapo *priv = nft_set_priv(set);
@@ -1600,6 +1600,8 @@ static void pipapo_gc(const struct nft_s
if (!gc)
return;
+ list_add(&gc->list, &priv->gc_head);
+
while ((rules_f0 = pipapo_rules_same_key(m->f, first_rule))) {
union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS];
struct nft_pipapo_field *f;
@@ -1629,9 +1631,13 @@ static void pipapo_gc(const struct nft_s
if (__nft_set_elem_expired(&e->ext, tstamp)) {
priv->dirty = true;
- gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC);
- if (!gc)
- return;
+ if (!nft_trans_gc_space(gc)) {
+ gc = nft_trans_gc_alloc(set, 0, GFP_KERNEL);
+ if (!gc)
+ return;
+
+ list_add(&gc->list, &priv->gc_head);
+ }
nft_pipapo_gc_deactivate(net, set, e);
pipapo_drop(m, rulemap);
@@ -1645,9 +1651,21 @@ static void pipapo_gc(const struct nft_s
}
}
- if (gc) {
+ priv->last_gc = jiffies;
+}
+
+/**
+ * pipapo_gc_queue() - Free expired elements after pointer swap
+ * @_set: nftables API set representation
+ */
+static void pipapo_gc_queue(const struct nft_set *_set)
+{
+ struct nft_pipapo *priv = nft_set_priv(_set);
+ struct nft_trans_gc *gc, *next;
+
+ list_for_each_entry_safe(gc, next, &priv->gc_head, list) {
+ list_del(&gc->list);
nft_trans_gc_queue_sync_done(gc);
- priv->last_gc = jiffies;
}
}
@@ -1708,14 +1726,14 @@ static void nft_pipapo_commit(const stru
struct nft_pipapo_match *new_clone, *old;
if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set)))
- pipapo_gc(set, priv->clone);
+ pipapo_gc_scan(set, priv->clone);
if (!priv->dirty)
- return;
+ goto out;
new_clone = pipapo_clone(priv->clone);
if (IS_ERR(new_clone))
- return;
+ goto out;
priv->dirty = false;
@@ -1725,6 +1743,8 @@ static void nft_pipapo_commit(const stru
call_rcu(&old->rcu, pipapo_reclaim_match);
priv->clone = new_clone;
+out:
+ pipapo_gc_queue(set);
}
static void nft_pipapo_abort(const struct nft_set *set)
@@ -2189,6 +2209,7 @@ static int nft_pipapo_init(const struct
priv->dirty = false;
+ INIT_LIST_HEAD(&priv->gc_head);
rcu_assign_pointer(priv->match, m);
return 0;
@@ -2241,6 +2262,8 @@ static void nft_pipapo_destroy(const str
struct nft_pipapo_match *m;
int cpu;
+ WARN_ON_ONCE(!list_empty(&priv->gc_head));
+
m = rcu_dereference_protected(priv->match, true);
if (m) {
rcu_barrier();
--- a/net/netfilter/nft_set_pipapo.h
+++ b/net/netfilter/nft_set_pipapo.h
@@ -165,6 +165,7 @@ struct nft_pipapo_match {
* @width: Total bytes to be matched for one packet, including padding
* @dirty: Working copy has pending insertions or deletions
* @last_gc: Timestamp of last garbage collection run, jiffies
+ * @gc_head: list of nft_trans_gc to queue for deferred reclaim
*/
struct nft_pipapo {
struct nft_pipapo_match __rcu *match;
@@ -172,6 +173,7 @@ struct nft_pipapo {
int width;
bool dirty;
unsigned long last_gc;
+ struct list_head gc_head;
};
struct nft_pipapo_elem;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 235/491] xen/privcmd: restrict usage in unprivileged domU
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-04-13 15:57 ` [PATCH 5.10 234/491] netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 236/491] xen/privcmd: add boot control for restricted usage in domU Greg Kroah-Hartman
` (260 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Teddy Astie, Juergen Gross
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8 upstream.
The Xen privcmd driver allows to issue arbitrary hypercalls from
user space processes. This is normally no problem, as access is
usually limited to root and the hypervisor will deny any hypercalls
affecting other domains.
In case the guest is booted using secure boot, however, the privcmd
driver would be enabling a root user process to modify e.g. kernel
memory contents, thus breaking the secure boot feature.
The only known case where an unprivileged domU is really needing to
use the privcmd driver is the case when it is acting as the device
model for another guest. In this case all hypercalls issued via the
privcmd driver will target that other guest.
Fortunately the privcmd driver can already be locked down to allow
only hypercalls targeting a specific domain, but this mode can be
activated from user land only today.
The target domain can be obtained from Xenstore, so when not running
in dom0 restrict the privcmd driver to that target domain from the
beginning, resolving the potential problem of breaking secure boot.
This is XSA-482
Reported-by: Teddy Astie <teddy.astie@vates.tech>
Fixes: 1c5de1939c20 ("xen: add privcmd driver")
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/privcmd.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 57 insertions(+), 3 deletions(-)
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -10,6 +10,7 @@
#define pr_fmt(fmt) "xen:" KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
+#include <linux/kstrtox.h>
#include <linux/module.h>
#include <linux/sched.h>
#include <linux/slab.h>
@@ -24,6 +25,8 @@
#include <linux/seq_file.h>
#include <linux/miscdevice.h>
#include <linux/moduleparam.h>
+#include <linux/notifier.h>
+#include <linux/wait.h>
#include <asm/xen/hypervisor.h>
#include <asm/xen/hypercall.h>
@@ -37,6 +40,7 @@
#include <xen/page.h>
#include <xen/xen-ops.h>
#include <xen/balloon.h>
+#include <xen/xenbus.h>
#include "privcmd.h"
@@ -59,6 +63,11 @@ struct privcmd_data {
domid_t domid;
};
+/* DOMID_INVALID implies no restriction */
+static domid_t target_domain = DOMID_INVALID;
+static bool restrict_wait;
+static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq);
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
@@ -878,13 +887,16 @@ static long privcmd_ioctl(struct file *f
static int privcmd_open(struct inode *ino, struct file *file)
{
- struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ struct privcmd_data *data;
+
+ if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0)
+ return -EINTR;
+ data = kzalloc(sizeof(*data), GFP_KERNEL);
if (!data)
return -ENOMEM;
- /* DOMID_INVALID implies no restriction */
- data->domid = DOMID_INVALID;
+ data->domid = target_domain;
file->private_data = data;
return 0;
@@ -977,6 +989,45 @@ static struct miscdevice privcmd_dev = {
.fops = &xen_privcmd_fops,
};
+static int init_restrict(struct notifier_block *notifier,
+ unsigned long event,
+ void *data)
+{
+ char *target;
+ unsigned int domid;
+
+ /* Default to an guaranteed unused domain-id. */
+ target_domain = DOMID_IDLE;
+
+ target = xenbus_read(XBT_NIL, "target", "", NULL);
+ if (IS_ERR(target) || kstrtouint(target, 10, &domid)) {
+ pr_err("No target domain found, blocking all hypercalls\n");
+ goto out;
+ }
+
+ target_domain = domid;
+
+ out:
+ if (!IS_ERR(target))
+ kfree(target);
+
+ restrict_wait = false;
+ wake_up_all(&restrict_wait_wq);
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block xenstore_notifier = {
+ .notifier_call = init_restrict,
+};
+
+static void __init restrict_driver(void)
+{
+ restrict_wait = true;
+
+ register_xenstore_notifier(&xenstore_notifier);
+}
+
static int __init privcmd_init(void)
{
int err;
@@ -984,6 +1035,9 @@ static int __init privcmd_init(void)
if (!xen_domain())
return -ENODEV;
+ if (!xen_initial_domain())
+ restrict_driver();
+
err = misc_register(&privcmd_dev);
if (err != 0) {
pr_err("Could not register Xen privcmd device\n");
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 236/491] xen/privcmd: add boot control for restricted usage in domU
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 235/491] xen/privcmd: restrict usage in unprivileged domU Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 237/491] sh: platform_early: remove pdev->driver_override check Greg Kroah-Hartman
` (259 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Juergen Gross
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 1613462be621ad5103ec338a7b0ca0746ec4e5f1 upstream.
When running in an unprivileged domU under Xen, the privcmd driver
is restricted to allow only hypercalls against a target domain, for
which the current domU is acting as a device model.
Add a boot parameter "unrestricted" to allow all hypercalls (the
hypervisor will still refuse destructive hypercalls affecting other
guests).
Make this new parameter effective only in case the domU wasn't started
using secure boot, as otherwise hypercalls targeting the domU itself
might result in violating the secure boot functionality.
This is achieved by adding another lockdown reason, which can be
tested to not being set when applying the "unrestricted" option.
This is part of XSA-482
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/privcmd.c | 13 +++++++++++++
include/linux/security.h | 1 +
security/security.c | 1 +
3 files changed, 15 insertions(+)
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -26,6 +26,7 @@
#include <linux/miscdevice.h>
#include <linux/moduleparam.h>
#include <linux/notifier.h>
+#include <linux/security.h>
#include <linux/wait.h>
#include <asm/xen/hypervisor.h>
@@ -59,6 +60,11 @@ module_param_named(dm_op_buf_max_size, p
MODULE_PARM_DESC(dm_op_buf_max_size,
"Maximum size of a dm_op hypercall buffer");
+static bool unrestricted;
+module_param(unrestricted, bool, 0);
+MODULE_PARM_DESC(unrestricted,
+ "Don't restrict hypercalls to target domain if running in a domU");
+
struct privcmd_data {
domid_t domid;
};
@@ -1023,6 +1029,13 @@ static struct notifier_block xenstore_no
static void __init restrict_driver(void)
{
+ if (unrestricted) {
+ if (security_locked_down(LOCKDOWN_XEN_USER_ACTIONS))
+ pr_warn("Kernel is locked down, parameter \"unrestricted\" ignored\n");
+ else
+ return;
+ }
+
restrict_wait = true;
register_xenstore_notifier(&xenstore_notifier);
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -123,6 +123,7 @@ enum lockdown_reason {
LOCKDOWN_XMON_WR,
LOCKDOWN_BPF_WRITE_USER,
LOCKDOWN_DBG_WRITE_KERNEL,
+ LOCKDOWN_XEN_USER_ACTIONS,
LOCKDOWN_INTEGRITY_MAX,
LOCKDOWN_KCORE,
LOCKDOWN_KPROBES,
--- a/security/security.c
+++ b/security/security.c
@@ -60,6 +60,7 @@ const char *const lockdown_reasons[LOCKD
[LOCKDOWN_XMON_WR] = "xmon write access",
[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
+ [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action",
[LOCKDOWN_INTEGRITY_MAX] = "integrity",
[LOCKDOWN_KCORE] = "/proc/kcore access",
[LOCKDOWN_KPROBES] = "use of kprobes",
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 237/491] sh: platform_early: remove pdev->driver_override check
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 236/491] xen/privcmd: add boot control for restricted usage in domU Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 238/491] HID: asus: avoid memory leak in asus_report_fixup() Greg Kroah-Hartman
` (258 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Danilo Krummrich,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit c5f60e3f07b6609562d21efda878e83ce8860728 ]
In commit 507fd01d5333 ("drivers: move the early platform device support to
arch/sh") platform_match() was copied over to the sh platform_early
code, accidentally including the driver_override check.
This check does not make sense for platform_early, as sysfs is not even
available in first place at this point in the boot process, hence remove
the check.
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: 507fd01d5333 ("drivers: move the early platform device support to arch/sh")
Link: https://lore.kernel.org/all/DH4M3DJ4P58T.1BGVAVXN71Z09@kernel.org/
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/drivers/platform_early.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/arch/sh/drivers/platform_early.c b/arch/sh/drivers/platform_early.c
index 143747c45206f..48ddbc547bd9a 100644
--- a/arch/sh/drivers/platform_early.c
+++ b/arch/sh/drivers/platform_early.c
@@ -26,10 +26,6 @@ static int platform_match(struct device *dev, struct device_driver *drv)
struct platform_device *pdev = to_platform_device(dev);
struct platform_driver *pdrv = to_platform_driver(drv);
- /* When driver_override is set, only bind to the matching driver */
- if (pdev->driver_override)
- return !strcmp(pdev->driver_override, drv->name);
-
/* Then try to match against the id table */
if (pdrv->id_table)
return platform_match_id(pdrv->id_table, pdev) != NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 238/491] HID: asus: avoid memory leak in asus_report_fixup()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 237/491] sh: platform_early: remove pdev->driver_override check Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 239/491] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Greg Kroah-Hartman
` (257 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Günther Noack,
Benjamin Tissoires, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <gnoack@google.com>
[ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]
The asus_report_fixup() function was returning a newly allocated
kmemdup()-allocated buffer, but never freeing it. Switch to
devm_kzalloc() to ensure the memory is managed and freed automatically
when the device is removed.
The caller of report_fixup() does not take ownership of the returned
pointer, but it is permitted to return a pointer whose lifetime is at
least that of the input buffer.
Also fix a harmless out-of-bounds read by copying only the original
descriptor size.
Assisted-by: Gemini-CLI:Google Gemini 3
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-asus.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 2f82946fb36a2..9d425f81d6224 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -1116,14 +1116,21 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
*/
if (*rsize == rsize_orig &&
rdesc[offs] == 0x09 && rdesc[offs + 1] == 0x76) {
- *rsize = rsize_orig + 1;
- rdesc = kmemdup(rdesc, *rsize, GFP_KERNEL);
- if (!rdesc)
- return NULL;
+ __u8 *new_rdesc;
+
+ new_rdesc = devm_kzalloc(&hdev->dev, rsize_orig + 1,
+ GFP_KERNEL);
+ if (!new_rdesc)
+ return rdesc;
hid_info(hdev, "Fixing up %s keyb report descriptor\n",
drvdata->quirks & QUIRK_T100CHI ?
"T100CHI" : "T90CHI");
+
+ memcpy(new_rdesc, rdesc, rsize_orig);
+ *rsize = rsize_orig + 1;
+ rdesc = new_rdesc;
+
memmove(rdesc + offs + 4, rdesc + offs + 2, 12);
rdesc[offs] = 0x19;
rdesc[offs + 1] = 0x00;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 239/491] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 238/491] HID: asus: avoid memory leak in asus_report_fixup() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 240/491] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Greg Kroah-Hartman
` (256 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leif Skunberg, Hans de Goede,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leif Skunberg <diamondback@cohunt.app>
[ Upstream commit b38d478dad79e61e8a65931021bdfd7a71741212 ]
The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down
buttons that are handled through the intel-hid 5-button array
interface. The firmware does not advertise 5-button array support via
HEBC, so the driver relies on a DMI allowlist to enable it.
Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the
volume buttons work out of the box.
Signed-off-by: Leif Skunberg <diamondback@cohunt.app>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260210085625.34380-1-diamondback@cohunt.app
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel-hid.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index 9bc2652b15e71..12d695adf3f74 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -93,6 +93,13 @@ static const struct dmi_system_id button_array_table[] = {
DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"),
},
},
+ {
+ .ident = "Lenovo ThinkPad X1 Fold 16 Gen 1",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Fold 16 Gen 1"),
+ },
+ },
{
.ident = "Microsoft Surface Go 3",
.matches = {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 240/491] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 239/491] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 241/491] nvme-pci: ensure were polling a polled queue Greg Kroah-Hartman
` (255 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yajat Kumar, Hans de Goede,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 7d87ed70fc95482c12edf9493c249b6413be485e ]
The touchscreen on the SUPI S10 tablet reports inverted Y coordinates,
causing touch input to be mirrored vertically relative to the display.
Add a quirk to set the "touchscreen-inverted-y" boolean device-property
on the touchscreen device, so that the goodix_ts driver will fixup
the coordinates.
Reported-by: Yajat Kumar <yajatapps3@gmail.com>
Closes: https://lore.kernel.org/linux-input/20251230221639.582406-1-yajatapps3@gmail.com/
Tested-by: Yajat Kumar <yajatapps3@gmail.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260217132346.34535-1-johannes.goede@oss.qualcomm.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/touchscreen_dmi.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index eff29dc7e2c6c..13ba93e7ed8f0 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -402,6 +402,16 @@ static const struct ts_dmi_data gdix1002_00_upside_down_data = {
.properties = gdix1001_upside_down_props,
};
+static const struct property_entry gdix1001_y_inverted_props[] = {
+ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
+ { }
+};
+
+static const struct ts_dmi_data gdix1001_y_inverted_data = {
+ .acpi_name = "GDIX1001",
+ .properties = gdix1001_y_inverted_props,
+};
+
static const struct property_entry gp_electronic_t701_props[] = {
PROPERTY_ENTRY_U32("touchscreen-size-x", 960),
PROPERTY_ENTRY_U32("touchscreen-size-y", 640),
@@ -1552,6 +1562,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"),
},
},
+ {
+ /* SUPI S10 */
+ .driver_data = (void *)&gdix1001_y_inverted_data,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "SUPI"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "S10"),
+ },
+ },
{
/* Techbite Arc 11.6 */
.driver_data = (void *)&techbite_arc_11_6_data,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 241/491] nvme-pci: ensure were polling a polled queue
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 240/491] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 242/491] HID: mcp2221: cancel last I2C command on read error Greg Kroah-Hartman
` (254 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Kanchan Joshi,
Keith Busch, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief
window during a reset where a hipri task may try to poll that queue
before the block layer has updated the queue maps, which would race with
the now interrupt driven queue and may cause double completions.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fbf8961f69efa..03df42e613f0f 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1097,7 +1097,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx)
struct nvme_queue *nvmeq = hctx->driver_data;
bool found;
- if (!nvme_cqe_pending(nvmeq))
+ if (!test_bit(NVMEQ_POLLED, &nvmeq->flags) ||
+ !nvme_cqe_pending(nvmeq))
return 0;
spin_lock(&nvmeq->cq_poll_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 242/491] HID: mcp2221: cancel last I2C command on read error
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 241/491] nvme-pci: ensure were polling a polled queue Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 243/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Greg Kroah-Hartman
` (253 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Romain Sioen, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Sioen <romain.sioen@microchip.com>
[ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]
When an I2C SMBus read operation fails, the MCP2221 internal state machine
may not reset correctly, causing subsequent transactions to fail.
By adding a short delay and explicitly cancelling the last command,
we ensure the device is ready for the next operation.
Fix an issue where i2cdetect was not able to detect all devices correctly
on the bus.
Signed-off-by: Romain Sioen <romain.sioen@microchip.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-mcp2221.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index 589f13ff0b606..9fb98c8e1ffb7 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -319,6 +319,8 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp,
usleep_range(90, 100);
retries++;
} else {
+ usleep_range(980, 1000);
+ mcp_cancel_last_cmd(mcp);
return ret;
}
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 243/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 242/491] HID: mcp2221: cancel last I2C command on read error Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 244/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Greg Kroah-Hartman
` (252 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da ]
ALSA controls should return 1 if the value in the control changed but the
control put operation fsl_easrc_set_reg() only returns 0 or a negative
error code, causing ALSA to not generate any change events. Add a suitable
check by using regmap_update_bits_check() with the underlying regmap, this
is more clearly and simply correct than trying to verify that one of the
generic ops is exactly equivalent to this one.
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-2-39d4c766918b@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_easrc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
index acd500c3b9d04..52b3f2d44f681 100644
--- a/sound/soc/fsl/fsl_easrc.c
+++ b/sound/soc/fsl/fsl_easrc.c
@@ -93,14 +93,17 @@ static int fsl_easrc_set_reg(struct snd_kcontrol *kcontrol,
struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
struct soc_mreg_control *mc =
(struct soc_mreg_control *)kcontrol->private_value;
+ struct fsl_asrc *easrc = snd_soc_component_get_drvdata(component);
unsigned int regval = ucontrol->value.integer.value[0];
+ bool changed;
int ret;
- ret = snd_soc_component_write(component, mc->regbase, regval);
- if (ret < 0)
+ ret = regmap_update_bits_check(easrc->regmap, mc->regbase,
+ GENMASK(31, 0), regval, &changed);
+ if (ret != 0)
return ret;
- return 0;
+ return changed;
}
#define SOC_SINGLE_REG_RW(xname, xreg) \
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 244/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 243/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 245/491] dma-buf: Include ioctl.h in UAPI header Greg Kroah-Hartman
` (251 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 ]
ALSA controls should return 1 if the value in the control changed but the
control put operation fsl_easrc_iec958_put_bits() unconditionally returns
0, causing ALSA to not generate any change events. This is detected by
mixer-test with large numbers of messages in the form:
No event generated for Context 3 IEC958 CS5
Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0
Add a suitable check.
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-1-39d4c766918b@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_easrc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
index 52b3f2d44f681..6af5c1735e2ed 100644
--- a/sound/soc/fsl/fsl_easrc.c
+++ b/sound/soc/fsl/fsl_easrc.c
@@ -52,10 +52,13 @@ static int fsl_easrc_iec958_put_bits(struct snd_kcontrol *kcontrol,
struct soc_mreg_control *mc =
(struct soc_mreg_control *)kcontrol->private_value;
unsigned int regval = ucontrol->value.integer.value[0];
+ int ret;
+
+ ret = (easrc_priv->bps_iec958[mc->regbase] != regval);
easrc_priv->bps_iec958[mc->regbase] = regval;
- return 0;
+ return ret;
}
static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 245/491] dma-buf: Include ioctl.h in UAPI header
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 244/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 246/491] ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Greg Kroah-Hartman
` (250 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Isaac J. Manjarres, T.J. Mercier,
Christian König, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <isaacmanjarres@google.com>
[ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]
include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define
its ioctl commands. However, it does not include ioctl.h itself. So,
if userspace source code tries to include the dma-buf.h file without
including ioctl.h, it can result in build failures.
Therefore, include ioctl.h in the dma-buf UAPI header.
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260303002309.1401849-1-isaacmanjarres@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/dma-buf.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h
index f76d11725c6c6..dd9fa80184f3e 100644
--- a/include/uapi/linux/dma-buf.h
+++ b/include/uapi/linux/dma-buf.h
@@ -20,6 +20,7 @@
#ifndef _DMA_BUF_UAPI_H_
#define _DMA_BUF_UAPI_H_
+#include <linux/ioctl.h>
#include <linux/types.h>
/* begin/end dma-buf functions used for userspace mmap. */
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 246/491] ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 245/491] dma-buf: Include ioctl.h in UAPI header Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 247/491] xfrm: call xdo_dev_state_delete during state update Greg Kroah-Hartman
` (249 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uzair Mughal, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uzair Mughal <contact@uzair.is-a.dev>
[ Upstream commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 ]
The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288)
does not report headset button press events. Headphone insertion is
detected (SW_HEADPHONE_INSERT), but pressing the inline microphone
button on a headset produces no input events.
Add a SND_PCI_QUIRK entry that maps this subsystem ID to
ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables
headset jack button detection through alc_fixup_headset_jack()
and ThinkPad ACPI integration. This is the same fixup used by
similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3).
Signed-off-by: Uzair Mughal <contact@uzair.is-a.dev>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260307012906.20093-1-contact@uzair.is-a.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b8c7f4c8593ba..7ea036f820f54 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9527,6 +9527,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x2288, "Thinkpad X390", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
SND_PCI_QUIRK(0x17aa, 0x22be, "Thinkpad X1 Carbon 8th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 247/491] xfrm: call xdo_dev_state_delete during state update
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 246/491] ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 248/491] xfrm: Fix the usage of skb->sk Greg Kroah-Hartman
` (248 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Simon Horman,
Steffen Klassert, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 ]
When we update an SA, we construct a new state and call
xdo_dev_state_add, but never insert it. The existing state is updated,
then we immediately destroy the new state. Since we haven't added it,
we don't go through the standard state delete code, and we're skipping
removing it from the device (but xdo_dev_state_free will get called
when we destroy the temporary state).
This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of
offloaded SAs on failure.").
Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_state.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b1243edf7f3a0..02d1d8d1fdea4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1736,6 +1736,7 @@ int xfrm_state_update(struct xfrm_state *x)
err = 0;
x->km.state = XFRM_STATE_DEAD;
+ xfrm_dev_state_delete(x);
__xfrm_state_put(x);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 248/491] xfrm: Fix the usage of skb->sk
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 247/491] xfrm: call xdo_dev_state_delete during state update Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 249/491] esp: fix skb leak with espintcp and async crypto Greg Kroah-Hartman
` (247 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steffen Klassert, Eric Dumazet,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
[ Upstream commit 1620c88887b16940e00dbe57dd38c74eda9bad9e ]
xfrm assumed to always have a full socket at skb->sk.
This is not always true, so fix it by converting to a
full socket before it is used.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Stable-dep-of: 0c0eef8ccd24 ("esp: fix skb leak with espintcp and async crypto")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/esp4.c | 2 +-
net/ipv6/esp6.c | 2 +-
net/ipv6/xfrm6_output.c | 4 ++--
net/xfrm/xfrm_interface_core.c | 2 +-
net/xfrm/xfrm_output.c | 7 ++++---
net/xfrm/xfrm_policy.c | 2 +-
6 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index adfefcd88bbcc..295bc1799002a 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -278,7 +278,7 @@ static void esp_output_done(struct crypto_async_request *base, int err)
x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
esp_output_tail_tcp(x, skb);
else
- xfrm_output_resume(skb->sk, skb, err);
+ xfrm_output_resume(skb_to_full_sk(skb), skb, err);
}
}
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 39154531d4559..9df910dfc348a 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -313,7 +313,7 @@ static void esp_output_done(struct crypto_async_request *base, int err)
x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
esp_output_tail_tcp(x, skb);
else
- xfrm_output_resume(skb->sk, skb, err);
+ xfrm_output_resume(skb_to_full_sk(skb), skb, err);
}
}
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ee349c2438782..a8fc778ce465c 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -89,14 +89,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
toobig = skb->len > mtu && !skb_is_gso(skb);
- if (toobig && xfrm6_local_dontfrag(skb->sk)) {
+ if (toobig && xfrm6_local_dontfrag(sk)) {
xfrm6_local_rxpmtu(skb, mtu);
kfree_skb(skb);
return -EMSGSIZE;
} else if (toobig && xfrm6_noneed_fragment(skb)) {
skb->ignore_df = 1;
goto skip_frag;
- } else if (!skb->ignore_df && toobig && skb->sk) {
+ } else if (!skb->ignore_df && toobig && sk) {
xfrm_local_error(skb, mtu);
kfree_skb(skb);
return -EMSGSIZE;
diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 9eaf0174d9981..fc5967ccaddca 100644
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -368,7 +368,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
skb_dst_set(skb, dst);
skb->dev = tdev;
- err = dst_output(xi->net, skb->sk, skb);
+ err = dst_output(xi->net, skb_to_full_sk(skb), skb);
if (net_xmit_eval(err) == 0) {
struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 40f7a98abdd1c..7c588973cfa1b 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -645,7 +645,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
!skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {
skb->protocol = htons(ETH_P_IP);
- if (skb->sk)
+ if (skb->sk && sk_fullsock(skb->sk))
xfrm_local_error(skb, mtu);
else
icmp_send(skb, ICMP_DEST_UNREACH,
@@ -681,6 +681,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
{
int mtu, ret = 0;
struct dst_entry *dst = skb_dst(skb);
+ struct sock *sk = skb_to_full_sk(skb);
if (skb->ignore_df)
goto out;
@@ -695,9 +696,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
skb->dev = dst->dev;
skb->protocol = htons(ETH_P_IPV6);
- if (xfrm6_local_dontfrag(skb->sk))
+ if (xfrm6_local_dontfrag(sk))
ipv6_stub->xfrm6_local_rxpmtu(skb, mtu);
- else if (skb->sk)
+ else if (sk)
xfrm_local_error(skb, mtu);
else
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 64b971bb1d36a..c4ebfaa0b2ed0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2858,7 +2858,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
skb_dst_drop(skb);
skb_dst_set(skb, dst);
- dst_output(net, skb->sk, skb);
+ dst_output(net, skb_to_full_sk(skb), skb);
}
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 249/491] esp: fix skb leak with espintcp and async crypto
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 248/491] xfrm: Fix the usage of skb->sk Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 250/491] af_key: validate families in pfkey_send_migrate() Greg Kroah-Hartman
` (246 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Simon Horman,
Steffen Klassert, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 ]
When the TX queue for espintcp is full, esp_output_tail_tcp will
return an error and not free the skb, because with synchronous crypto,
the common xfrm output code will drop the packet for us.
With async crypto (esp_output_done), we need to drop the skb when
esp_output_tail_tcp returns an error.
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/esp4.c | 9 ++++++---
net/ipv6/esp6.c | 9 ++++++---
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 295bc1799002a..0d5fc4f8c6adb 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -275,10 +275,13 @@ static void esp_output_done(struct crypto_async_request *base, int err)
xfrm_dev_resume(skb);
} else {
if (!err &&
- x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
- esp_output_tail_tcp(x, skb);
- else
+ x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {
+ err = esp_output_tail_tcp(x, skb);
+ if (err != -EINPROGRESS)
+ kfree_skb(skb);
+ } else {
xfrm_output_resume(skb_to_full_sk(skb), skb, err);
+ }
}
}
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9df910dfc348a..a1d20dd4be3c7 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -310,10 +310,13 @@ static void esp_output_done(struct crypto_async_request *base, int err)
xfrm_dev_resume(skb);
} else {
if (!err &&
- x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
- esp_output_tail_tcp(x, skb);
- else
+ x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {
+ err = esp_output_tail_tcp(x, skb);
+ if (err != -EINPROGRESS)
+ kfree_skb(skb);
+ } else {
xfrm_output_resume(skb_to_full_sk(skb), skb, err);
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 250/491] af_key: validate families in pfkey_send_migrate()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 249/491] esp: fix skb leak with espintcp and async crypto Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 251/491] can: statistics: add missing atomic access in hot path Greg Kroah-Hartman
` (245 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b518dfc8e021988fbd55,
Eric Dumazet, Steffen Klassert, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit eb2d16a7d599dc9d4df391b5e660df9949963786 ]
syzbot was able to trigger a crash in skb_put() [1]
Issue is that pfkey_send_migrate() does not check old/new families,
and that set_ipsecrequest() @family argument was truncated,
thus possibly overfilling the skb.
Validate families early, do not wait set_ipsecrequest().
[1]
skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
kernel BUG at net/core/skbuff.c:214 !
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:219 [inline]
skb_put+0x159/0x210 net/core/skbuff.c:2655
skb_put_zero include/linux/skbuff.h:2788 [inline]
set_ipsecrequest net/key/af_key.c:3532 [inline]
pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636
km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848
xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705
xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
Fixes: 08de61beab8a ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)")
Reported-by: syzbot+b518dfc8e021988fbd55@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69b5933c.050a0220.248e02.00f2.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/key/af_key.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index de4606d2eb643..95f7e363c2f6a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3522,7 +3522,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *
static int set_ipsecrequest(struct sk_buff *skb,
uint8_t proto, uint8_t mode, int level,
- uint32_t reqid, uint8_t family,
+ uint32_t reqid, sa_family_t family,
const xfrm_address_t *src, const xfrm_address_t *dst)
{
struct sadb_x_ipsecrequest *rq;
@@ -3587,12 +3587,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
/* ipsecrequests */
for (i = 0, mp = m; i < num_bundles; i++, mp++) {
- /* old locator pair */
- size_pol += sizeof(struct sadb_x_ipsecrequest) +
- pfkey_sockaddr_pair_size(mp->old_family);
- /* new locator pair */
- size_pol += sizeof(struct sadb_x_ipsecrequest) +
- pfkey_sockaddr_pair_size(mp->new_family);
+ int pair_size;
+
+ pair_size = pfkey_sockaddr_pair_size(mp->old_family);
+ if (!pair_size)
+ return -EINVAL;
+ size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;
+
+ pair_size = pfkey_sockaddr_pair_size(mp->new_family);
+ if (!pair_size)
+ return -EINVAL;
+ size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;
}
size += sizeof(struct sadb_msg) + size_pol;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 251/491] can: statistics: add missing atomic access in hot path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 250/491] af_key: validate families in pfkey_send_migrate() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 252/491] Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Greg Kroah-Hartman
` (244 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Hartkopp, Marc Kleine-Budde,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
[ Upstream commit 46eee1661aa9b49966e6c43d07126fe408edda57 ]
Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path")
fixed a KCSAN issue in can_receive() but missed to convert the 'matches'
variable used in can_rcv_filter().
Fixes: 80b5f90158d1 ("can: statistics: use atomic access in hot path")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260318173413.28235-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/af_can.c | 4 ++--
net/can/af_can.h | 2 +-
net/can/proc.c | 3 ++-
3 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 3e77a52709aaa..97c48f350ce0b 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -469,7 +469,7 @@ int can_rx_register(struct net *net, struct net_device *dev, canid_t can_id,
rcv->can_id = can_id;
rcv->mask = mask;
- rcv->matches = 0;
+ atomic_long_set(&rcv->matches, 0);
rcv->func = func;
rcv->data = data;
rcv->ident = ident;
@@ -573,7 +573,7 @@ EXPORT_SYMBOL(can_rx_unregister);
static inline void deliver(struct sk_buff *skb, struct receiver *rcv)
{
rcv->func(skb, rcv->data);
- rcv->matches++;
+ atomic_long_inc(&rcv->matches);
}
static int can_rcv_filter(struct can_dev_rcv_lists *dev_rcv_lists, struct sk_buff *skb)
diff --git a/net/can/af_can.h b/net/can/af_can.h
index 22f3352c77fec..87887014f5628 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -52,7 +52,7 @@ struct receiver {
struct hlist_node list;
canid_t can_id;
canid_t mask;
- unsigned long matches;
+ atomic_long_t matches;
void (*func)(struct sk_buff *skb, void *data);
void *data;
char *ident;
diff --git a/net/can/proc.c b/net/can/proc.c
index 2be4a239f31e4..550d46d1c60a4 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -200,7 +200,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
" %-5s %03x %08x %pK %pK %8ld %s\n";
seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
- r->func, r->data, r->matches, r->ident);
+ r->func, r->data, atomic_long_read(&r->matches),
+ r->ident);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 252/491] Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 251/491] can: statistics: add missing atomic access in hot path Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 253/491] Bluetooth: hci_ll: Fix firmware leak on error path Greg Kroah-Hartman
` (243 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using
get_unaligned_le16() without first verifying that skb contains at least
L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads
past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading
the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the
same validation to the Enhanced Credit Based Flow Control data path.
Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ed113cfdce23b..bca96302e59e5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7660,6 +7660,11 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
if (!chan->sdu) {
u16 sdu_len;
+ if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
+ err = -EINVAL;
+ goto failed;
+ }
+
sdu_len = get_unaligned_le16(skb->data);
skb_pull(skb, L2CAP_SDULEN_SIZE);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 253/491] Bluetooth: hci_ll: Fix firmware leak on error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 252/491] Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 254/491] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Greg Kroah-Hartman
` (242 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Anas Iqbal,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anas Iqbal <mohd.abd.6602@gmail.com>
[ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ]
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned
firmware content is invalid (no data or zero size), the function returns
without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when
request_firmware() succeeded but the firmware content is invalid.
Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_ll.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c
index 7495ca34c9e7e..ee107360e3bc2 100644
--- a/drivers/bluetooth/hci_ll.c
+++ b/drivers/bluetooth/hci_ll.c
@@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev)
if (err || !fw->data || !fw->size) {
bt_dev_err(lldev->hu.hdev, "request_firmware failed(errno %d) for %s",
err, bts_scr_name);
+ if (!err)
+ release_firmware(fw);
return -EINVAL;
}
ptr = (void *)fw->data;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 254/491] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 253/491] Bluetooth: hci_ll: Fix firmware leak on error path Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 255/491] pinctrl: mediatek: common: Fix probe failure for devices without EINT Greg Kroah-Hartman
` (241 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Helen Koike, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <koike@igalia.com>
[ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
veth0_macvtap: entered promiscuous mode
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40
lock_acquire+0x79/0x2e0
lock_sock_nested+0x48/0x100
? l2cap_sock_ready_cb+0x46/0x160
l2cap_sock_ready_cb+0x46/0x160
l2cap_conn_start+0x779/0xff0
? __pfx_l2cap_conn_start+0x10/0x10
? l2cap_info_timeout+0x60/0xa0
? __pfx___mutex_lock+0x10/0x10
l2cap_info_timeout+0x68/0xa0
? process_scheduled_works+0xa8d/0x18c0
process_scheduled_works+0xb6e/0x18c0
? __pfx_process_scheduled_works+0x10/0x10
? assign_work+0x3d5/0x5e0
worker_thread+0xa53/0xfc0
kthread+0x388/0x470
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x51e/0xb90
? __pfx_ret_from_fork+0x10/0x10
veth1_macvtap: entered promiscuous mode
? __switch_to+0xc7d/0x1450
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Fixes: 54a59aa2b562 ("Bluetooth: Add l2cap_chan->ops->ready()")
Signed-off-by: Helen Koike <koike@igalia.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 5465b537f0e72..9e071db3b649f 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1637,6 +1637,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
struct sock *sk = chan->data;
struct sock *parent;
+ if (!sk)
+ return;
+
lock_sock(sk);
parent = bt_sk(sk)->parent;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 255/491] pinctrl: mediatek: common: Fix probe failure for devices without EINT
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 254/491] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 256/491] nfc: nci: fix circular locking dependency in nci_close_device Greg Kroah-Hartman
` (240 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Leonardo Scorcia,
AngeloGioacchino Del Regno, Linus Walleij, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <l.scorcia@gmail.com>
[ Upstream commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd ]
Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but
the mtk_eint_init function is always called and returns -ENODEV, which
then bubbles up and causes probe failure.
To address this only call mtk_eint_init if EINT pins are present.
Tested on Xiaomi Mi Smart Clock x04g (mt6392).
Fixes: e46df235b4e6 ("pinctrl: mediatek: refactor EINT related code for all MediaTek pinctrl can fit")
Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index 730581d130649..8045475583186 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -1111,9 +1111,12 @@ int mtk_pctrl_init(struct platform_device *pdev,
goto chip_error;
}
- ret = mtk_eint_init(pctl, pdev);
- if (ret)
- goto chip_error;
+ /* Only initialize EINT if we have EINT pins */
+ if (data->eint_hw.ap_num > 0) {
+ ret = mtk_eint_init(pctl, pdev);
+ if (ret)
+ goto chip_error;
+ }
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 256/491] nfc: nci: fix circular locking dependency in nci_close_device
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 255/491] pinctrl: mediatek: common: Fix probe failure for devices without EINT Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 257/491] net: openvswitch: Avoid releasing netdev before teardown completes Greg Kroah-Hartman
` (239 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Ray, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 4527025d440ce84bf56e75ce1df2e84cb8178616 ]
nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)
Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Reviewed-by: Ian Ray <ian.ray@gehealthcare.com>
Link: https://patch.msgid.link/20260317193334.988609-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/core.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 873c9073e4111..78472b1929705 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -562,8 +562,7 @@ static int nci_close_device(struct nci_dev *ndev)
skb_queue_purge(&ndev->rx_q);
skb_queue_purge(&ndev->tx_q);
- /* Flush RX and TX wq */
- flush_workqueue(ndev->rx_wq);
+ /* Flush TX wq, RX wq flush can't be under the lock */
flush_workqueue(ndev->tx_wq);
/* Reset device */
@@ -575,13 +574,13 @@ static int nci_close_device(struct nci_dev *ndev)
msecs_to_jiffies(NCI_RESET_TIMEOUT));
/* After this point our queues are empty
- * and no works are scheduled.
+ * rx work may be running but will see that NCI_UP was cleared
*/
ndev->ops->close(ndev);
clear_bit(NCI_INIT, &ndev->flags);
- /* Flush cmd wq */
+ /* Flush cmd and tx wq */
flush_workqueue(ndev->cmd_wq);
del_timer_sync(&ndev->cmd_timer);
@@ -591,6 +590,9 @@ static int nci_close_device(struct nci_dev *ndev)
mutex_unlock(&ndev->req_lock);
+ /* rx_work may take req_lock via nci_deactivate_target */
+ flush_workqueue(ndev->rx_wq);
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 257/491] net: openvswitch: Avoid releasing netdev before teardown completes
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 256/491] nfc: nci: fix circular locking dependency in nci_close_device Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 258/491] openvswitch: validate MPLS set/set_masked payload length Greg Kroah-Hartman
` (238 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Minxi Hou,
Toke Høiland-Jørgensen, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <toke@redhat.com>
[ Upstream commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 ]
The patch cited in the Fixes tag below changed the teardown code for
OVS ports to no longer unconditionally take the RTNL. After this change,
the netdev_destroy() callback can proceed immediately to the call_rcu()
invocation if the IFF_OVS_DATAPATH flag is already cleared on the
netdev.
The ovs_netdev_detach_dev() function clears the flag before completing
the unregistration, and if it gets preempted after clearing the flag (as
can happen on an -rt kernel), netdev_destroy() can complete and the
device can be freed before the unregistration completes. This leads to a
splat like:
[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI
[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT
[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025
[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0
[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90
[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246
[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000
[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05
[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000
[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006
[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000
[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000
[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0
[ 998.393944] PKRU: 55555554
[ 998.393946] Call Trace:
[ 998.393949] <TASK>
[ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0
[ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0
[ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch]
[ 998.394009] ? __die_body.cold+0x8/0x12
[ 998.394016] ? die_addr+0x3c/0x60
[ 998.394027] ? exc_general_protection+0x16d/0x390
[ 998.394042] ? asm_exc_general_protection+0x26/0x30
[ 998.394058] ? dev_set_promiscuity+0x8d/0xa0
[ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch]
[ 998.394092] dp_device_event+0x41/0x80 [openvswitch]
[ 998.394102] notifier_call_chain+0x5a/0xd0
[ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60
[ 998.394110] rtnl_dellink+0x169/0x3e0
[ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0
[ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0
[ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0
[ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 998.394132] netlink_rcv_skb+0x50/0x100
[ 998.394138] netlink_unicast+0x292/0x3f0
[ 998.394141] netlink_sendmsg+0x21b/0x470
[ 998.394145] ____sys_sendmsg+0x39d/0x3d0
[ 998.394149] ___sys_sendmsg+0x9a/0xe0
[ 998.394156] __sys_sendmsg+0x7a/0xd0
[ 998.394160] do_syscall_64+0x7f/0x170
[ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 998.394165] RIP: 0033:0x7fad61bf4724
[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89
[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724
[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003
[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f
[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380
[ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000
[ 998.394200] </TASK>
To fix this, reorder the operations in ovs_netdev_detach_dev() to only
clear the flag after completing the other operations, and introduce an
smp_wmb() to make the ordering requirement explicit. The smp_wmb() is
paired with a full smp_mb() in netdev_destroy() to make sure the
call_rcu() invocation does not happen before the unregister operations
are visible.
Reported-by: Minxi Hou <mhou@redhat.com>
Tested-by: Minxi Hou <mhou@redhat.com>
Fixes: 549822767630 ("net: openvswitch: Avoid needlessly taking the RTNL on vport destroy")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://patch.msgid.link/20260318155554.1133405-1-toke@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/vport-netdev.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 72cf13bbf3dd3..70cc8854b8d53 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -146,11 +146,15 @@ static void vport_netdev_free(struct rcu_head *rcu)
void ovs_netdev_detach_dev(struct vport *vport)
{
ASSERT_RTNL();
- vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
netdev_rx_handler_unregister(vport->dev);
netdev_upper_dev_unlink(vport->dev,
netdev_master_upper_dev_get(vport->dev));
dev_set_promiscuity(vport->dev, -1);
+
+ /* paired with smp_mb() in netdev_destroy() */
+ smp_wmb();
+
+ vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
}
static void netdev_destroy(struct vport *vport)
@@ -169,6 +173,9 @@ static void netdev_destroy(struct vport *vport)
rtnl_unlock();
}
+ /* paired with smp_wmb() in ovs_netdev_detach_dev() */
+ smp_mb();
+
call_rcu(&vport->rcu, vport_netdev_free);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 258/491] openvswitch: validate MPLS set/set_masked payload length
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 257/491] net: openvswitch: Avoid releasing netdev before teardown completes Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 259/491] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Greg Kroah-Hartman
` (237 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Ao Zhou,
Yuan Tan, Xin Liu, Ilya Maximets, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <n05ec@lzu.edu.cn>
[ Upstream commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 ]
validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for
SET/SET_MASKED actions. In action handling, OVS expects fixed-size
MPLS key data (struct ovs_key_mpls).
Use the already normalized key_len (masked case included) and reject
non-matching MPLS action key sizes.
Reject invalid MPLS action payload lengths early.
Fixes: fbdcdd78da7c ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260319080228.3423307-1-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/flow_netlink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 54f952620b214..2185fd5596fc7 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2911,6 +2911,8 @@ static int validate_set(const struct nlattr *a,
case OVS_KEY_ATTR_MPLS:
if (!eth_p_mpls(eth_type))
return -EINVAL;
+ if (key_len != sizeof(struct ovs_key_mpls))
+ return -EINVAL;
break;
case OVS_KEY_ATTR_SCTP:
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 259/491] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 258/491] openvswitch: validate MPLS set/set_masked payload length Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 260/491] rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Greg Kroah-Hartman
` (236 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qi Tang, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <tpluszz77@gmail.com>
[ Upstream commit 24dd586bb4cbba1889a50abe74143817a095c1c9 ]
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
the pointer in pipe_buffer.private. The pipe_buf_operations for these
buffers used .get = generic_pipe_buf_get, which only increments the page
reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv
pointer itself was not handled, so after tee() both the original and the
cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is
called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]
2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which
then escalates to a NULL-pointer dereference and kernel panic via
smc_rx_update_consumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0
Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x650
kasan_report+0xc6/0x100
smc_rx_pipe_buf_release+0x78/0x2a0
free_pipe_info+0xd4/0x130
pipe_release+0x142/0x160
__fput+0x1c6/0x490
__x64_sys_close+0x4f/0x90
do_syscall_64+0xa6/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
BUG: kernel NULL pointer dereference, address: 0000000000000020
RIP: 0010:smc_rx_update_consumer+0x8d/0x350
Call Trace:
<TASK>
smc_rx_pipe_buf_release+0x121/0x2a0
free_pipe_info+0xd4/0x130
pipe_release+0x142/0x160
__fput+0x1c6/0x490
__x64_sys_close+0x4f/0x90
do_syscall_64+0xa6/0x1a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is
semantically questionable: smc_rx_update_cons() would advance the
consumer cursor twice for the same data, corrupting receive-window
accounting. A refcount on smc_spd_priv could fix the double-free, but
the cursor-accounting issue would still need to be addressed separately.
The .get callback is invoked by both tee(2) and splice_pipe_to_pipe()
for partial transfers; both will now return -EFAULT. Users who need
to duplicate SMC socket data must use a copy-based read path.
Fixes: 9014db202cb7 ("smc: add support for splice()")
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Link: https://patch.msgid.link/20260318064847.23341-1-tpluszz77@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_rx.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
index 5f20538cbf990..0845905520f8c 100644
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -129,9 +129,16 @@ static void smc_rx_pipe_buf_release(struct pipe_inode_info *pipe,
sock_put(sk);
}
+static bool smc_rx_pipe_buf_get(struct pipe_inode_info *pipe,
+ struct pipe_buffer *buf)
+{
+ /* smc_spd_priv in buf->private is not shareable; disallow cloning. */
+ return false;
+}
+
static const struct pipe_buf_operations smc_pipe_ops = {
.release = smc_rx_pipe_buf_release,
- .get = generic_pipe_buf_get
+ .get = smc_rx_pipe_buf_get,
};
static void smc_rx_spd_release(struct splice_pipe_desc *spd,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 260/491] rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 259/491] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 261/491] platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Greg Kroah-Hartman
` (235 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Pirko, Sabrina Dubroca,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit ee00a12593ffb69db4dd1a1c00ecb0253376874a ]
rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but
rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and
IFLA_INFO_SLAVE_KIND.
Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave info")
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/049843b532e23cde7ddba263c0bbe35ba6f0d26d.1773919462.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 99337557408b5..c58510d7ea0d8 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -501,11 +501,14 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev)
goto out;
ops = master_dev->rtnl_link_ops;
- if (!ops || !ops->get_slave_size)
+ if (!ops)
+ goto out;
+ size += nla_total_size(strlen(ops->kind) + 1); /* IFLA_INFO_SLAVE_KIND */
+ if (!ops->get_slave_size)
goto out;
/* IFLA_INFO_SLAVE_DATA + nested data */
- size = nla_total_size(sizeof(struct nlattr)) +
- ops->get_slave_size(master_dev, dev);
+ size += nla_total_size(sizeof(struct nlattr)) +
+ ops->get_slave_size(master_dev, dev);
out:
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 261/491] platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 260/491] rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 262/491] net: fix fanout UAF in packet_release() via NETDEV_UP race Greg Kroah-Hartman
` (234 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Lubomir Rintel,
Randy Dunlap, Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit 2061f7b042f88d372cca79615f8425f3564c0b40 ]
The command length check validates inlen (> 5), but the error message
incorrectly printed resp_len. Print inlen so the log reflects the
actual command length.
Fixes: 0c3d931b3ab9e ("Platform: OLPC: Add XO-1.75 EC driver")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Acked-by: Lubomir Rintel <lkundrak@v3.sk>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260310130138.700687-1-alok.a.tiwari@oracle.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/olpc/olpc-xo175-ec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/olpc/olpc-xo175-ec.c b/drivers/platform/olpc/olpc-xo175-ec.c
index 0d46706afd2da..d8a9a215a14cd 100644
--- a/drivers/platform/olpc/olpc-xo175-ec.c
+++ b/drivers/platform/olpc/olpc-xo175-ec.c
@@ -482,7 +482,7 @@ static int olpc_xo175_ec_cmd(u8 cmd, u8 *inbuf, size_t inlen, u8 *resp,
dev_dbg(dev, "CMD %x, %zd bytes expected\n", cmd, resp_len);
if (inlen > 5) {
- dev_err(dev, "command len %zd too big!\n", resp_len);
+ dev_err(dev, "command len %zd too big!\n", inlen);
return -EOVERFLOW;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 262/491] net: fix fanout UAF in packet_release() via NETDEV_UP race
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 261/491] platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 263/491] net: enetc: fix the output issue of ethtool --show-ring Greg Kroah-Hartman
` (233 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yochai Eisenrich, Willem de Bruijn,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <echelonh@gmail.com>
[ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
`packet_release()` has a race window where `NETDEV_UP` can re-register a
socket into a fanout group's `arr[]` array. The re-registration is not
cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout
array.
`packet_release()` does NOT zero `po->num` in its `bind_lock` section.
After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`
still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`
that already found the socket in `sklist` can re-register the hook.
For fanout sockets, this re-registration calls `__fanout_link(sk, po)`
which adds the socket back into `f->arr[]` and increments `f->num_members`,
but does NOT increment `f->sk_ref`.
The fix sets `po->num` to zero in `packet_release` while `bind_lock` is
held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based
on CVE-2025-38617.
Fixes: ce06b03e60fc ("packet: Add helpers to register/unregister ->prot_hook")
Link: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260319200610.25101-1-echelonh@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/packet/af_packet.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4614fae54ed7f..1c9b2d67c3ed4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3147,6 +3147,7 @@ static int packet_release(struct socket *sock)
spin_lock(&po->bind_lock);
unregister_prot_hook(sk, false);
+ WRITE_ONCE(po->num, 0);
packet_cached_dev_reset(po);
if (po->prot_hook.dev) {
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 263/491] net: enetc: fix the output issue of ethtool --show-ring
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 262/491] net: fix fanout UAF in packet_release() via NETDEV_UP race Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 264/491] dma-mapping: add missing `inline` for `dma_free_attrs` Greg Kroah-Hartman
` (232 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wei Fang, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit 70b439bf06f6a12e491f827fa81a9887a11501f9 ]
Currently, enetc_get_ringparam() only provides rx_pending and tx_pending,
but 'ethtool --show-ring' no longer displays these fields. Because the
ringparam retrieval path has moved to the new netlink interface, where
rings_fill_reply() emits the *x_pending only if the *x_max_pending values
are non-zero. So rx_max_pending and tx_max_pending to are added to
enetc_get_ringparam() to fix the issue.
Note that the maximum tx/rx ring size of hardware is 64K, but we haven't
added set_ringparam() to make the ring size configurable. To avoid users
mistakenly believing that the ring size can be increased, so set
the *x_max_pending to priv->*x_bd_count.
Fixes: e4a1717b677c ("ethtool: provide ring sizes with RINGS_GET request")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20260320094222.706339-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
index cf98a00296edf..c934cae9f0d41 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
@@ -549,6 +549,8 @@ static void enetc_get_ringparam(struct net_device *ndev,
{
struct enetc_ndev_priv *priv = netdev_priv(ndev);
+ ring->rx_max_pending = priv->rx_bd_count;
+ ring->tx_max_pending = priv->tx_bd_count;
ring->rx_pending = priv->rx_bd_count;
ring->tx_pending = priv->tx_bd_count;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 264/491] dma-mapping: add missing `inline` for `dma_free_attrs`
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 263/491] net: enetc: fix the output issue of ethtool --show-ring Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 265/491] Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Greg Kroah-Hartman
` (231 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miguel Ojeda, Marek Szyprowski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
[ Upstream commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 ]
Under an UML build for an upcoming series [1], I got `-Wstatic-in-inline`
for `dma_free_attrs`:
BINDGEN rust/bindings/bindings_generated.rs - due to target missing
In file included from rust/helpers/helpers.c:59:
rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline]
17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs);
| ^
rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage
12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size,
| ^
| static
The issue is that `dma_free_attrs` was not marked `inline` when it was
introduced alongside the rest of the stubs.
Thus mark it.
Fixes: ed6ccf10f24b ("dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA")
Closes: https://lore.kernel.org/rust-for-linux/20260322194616.89847-1-ojeda@kernel.org/ [1]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260325015548.70912-1-ojeda@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/dma-mapping.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index fb48f8ba5dcc8..d79acecd50dfe 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -200,8 +200,8 @@ static inline void *dma_alloc_attrs(struct device *dev, size_t size,
{
return NULL;
}
-static void dma_free_attrs(struct device *dev, size_t size, void *cpu_addr,
- dma_addr_t dma_handle, unsigned long attrs)
+static inline void dma_free_attrs(struct device *dev, size_t size,
+ void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
{
}
static inline void *dmam_alloc_attrs(struct device *dev, size_t size,
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 265/491] Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 264/491] dma-mapping: add missing `inline` for `dma_free_attrs` Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 266/491] Bluetooth: btusb: clamp SCO altsetting table indices Greg Kroah-Hartman
` (230 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED
state to support L2CAP reconfiguration (e.g. MTU changes). However,
since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from
the initial configuration, the reconfiguration path falls through to
l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and
retrans_list without freeing the previous allocations and sets
chan->sdu to NULL without freeing the existing skb. This leaks all
previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum
value of remote_mps derived from the RFC max_pdu_size option. A zero
value propagates to l2cap_segment_sdu() where pdu_len becomes zero,
causing the while loop to never terminate since len is never
decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and
l2cap_chan_ready() when the channel is already in BT_CONNECTED state,
while still allowing the reconfiguration parameters to be updated
through l2cap_parse_conf_req(). Also add a pdu_len zero check in
l2cap_segment_sdu() as a safeguard.
Fixes: 96298f640104 ("Bluetooth: L2CAP: handle l2cap config request during open state")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index bca96302e59e5..e7af7faf558e8 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2543,6 +2543,9 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,
/* Remote device may have requested smaller PDUs */
pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
+ if (!pdu_len)
+ return -EINVAL;
+
if (len <= pdu_len) {
sar = L2CAP_SAR_UNSEGMENTED;
sdu_len = 0;
@@ -4526,14 +4529,16 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
set_default_fcs(chan);
- if (chan->mode == L2CAP_MODE_ERTM ||
- chan->mode == L2CAP_MODE_STREAMING)
- err = l2cap_ertm_init(chan);
+ if (chan->state != BT_CONNECTED) {
+ if (chan->mode == L2CAP_MODE_ERTM ||
+ chan->mode == L2CAP_MODE_STREAMING)
+ err = l2cap_ertm_init(chan);
- if (err < 0)
- l2cap_send_disconn_req(chan, -err);
- else
- l2cap_chan_ready(chan);
+ if (err < 0)
+ l2cap_send_disconn_req(chan, -err);
+ else
+ l2cap_chan_ready(chan);
+ }
goto unlock;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 266/491] Bluetooth: btusb: clamp SCO altsetting table indices
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 265/491] Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 267/491] netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Greg Kroah-Hartman
` (229 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc ]
btusb_work() maps the number of active SCO links to USB alternate
settings through a three-entry lookup table when CVSD traffic uses
transparent voice settings. The lookup currently indexes alts[] with
data->sco_num - 1 without first constraining sco_num to the number of
available table entries.
While the table only defines alternate settings for up to three SCO
links, data->sco_num comes from hci_conn_num() and is used directly.
Cap the lookup to the last table entry before indexing it so the
driver keeps selecting the highest supported alternate setting without
reading past alts[].
Fixes: baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3010044f0810b..a27a6ab6c2b61 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1780,8 +1780,11 @@ static void btusb_work(struct work_struct *work)
if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
if (hdev->voice_setting & 0x0020) {
static const int alts[3] = { 2, 4, 5 };
+ unsigned int sco_idx;
- new_alts = alts[data->sco_num - 1];
+ sco_idx = min_t(unsigned int, data->sco_num - 1,
+ ARRAY_SIZE(alts) - 1);
+ new_alts = alts[sco_idx];
} else {
new_alts = data->sco_num;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 267/491] netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 266/491] Bluetooth: btusb: clamp SCO altsetting table indices Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 268/491] netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Greg Kroah-Hartman
` (228 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Florian Westphal, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 ]
__build_packet_message() manually constructs the NFULA_PAYLOAD netlink
attribute using skb_put() and skb_copy_bits(), bypassing the standard
nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes
are allocated (including NLA alignment padding), only data_len bytes
of actual packet data are copied. The trailing nla_padlen(data_len)
bytes (1-3 when data_len is not 4-byte aligned) are never initialized,
leaking stale heap contents to userspace via the NFLOG netlink socket.
Replace the manual attribute construction with nla_reserve(), which
handles the tailroom check, header setup, and padding zeroing via
__nla_reserve(). The subsequent skb_copy_bits() fills in the payload
data on top of the properly initialized attribute.
Fixes: df6fb868d611 ("[NETFILTER]: nfnetlink: convert to generic netlink attribute functions")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_log.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 80c09070ea9fa..3a71ba47224c4 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -632,15 +632,11 @@ __build_packet_message(struct nfnl_log_net *log,
if (data_len) {
struct nlattr *nla;
- int size = nla_attr_size(data_len);
- if (skb_tailroom(inst->skb) < nla_total_size(data_len))
+ nla = nla_reserve(inst->skb, NFULA_PAYLOAD, data_len);
+ if (!nla)
goto nla_put_failure;
- nla = skb_put(inst->skb, nla_total_size(data_len));
- nla->nla_type = NFULA_PAYLOAD;
- nla->nla_len = size;
-
if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
BUG();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 268/491] netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 267/491] netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 269/491] netfilter: nf_conntrack_expect: skip expectations in other netns via proc Greg Kroah-Hartman
` (227 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Yuan Tan,
Xin Liu, Yuhang Zheng, Ren Wei, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Wei <n05ec@lzu.edu.cn>
[ Upstream commit 9d3f027327c2fa265f7f85ead41294792c3296ed ]
Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].
Validate addrnr during rule installation so malformed rules are rejected
before the match logic can use an out-of-range value.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/netfilter/ip6t_rt.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 4ad8b2032f1f9..5561bd9cea818 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -157,6 +157,10 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)
pr_debug("unknown flags %X\n", rtinfo->invflags);
return -EINVAL;
}
+ if (rtinfo->addrnr > IP6T_RT_HOPS) {
+ pr_debug("too many addresses specified\n");
+ return -EINVAL;
+ }
if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
(!(rtinfo->flags & IP6T_RT_TYP) ||
(rtinfo->rt_type != 0) ||
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 269/491] netfilter: nf_conntrack_expect: skip expectations in other netns via proc
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 268/491] netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 270/491] netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Greg Kroah-Hartman
` (226 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
Skip expectations that do not reside in this netns.
Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's
conntrack entries via proc").
Fixes: 9b03f38d0487 ("netfilter: netns nf_conntrack: per-netns expectations")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_expect.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 516a9f05a87a7..e53e225d9489f 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -607,11 +607,15 @@ static int exp_seq_show(struct seq_file *s, void *v)
{
struct nf_conntrack_expect *expect;
struct nf_conntrack_helper *helper;
+ struct net *net = seq_file_net(s);
struct hlist_node *n = v;
char *delim = "";
expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
+ if (!net_eq(nf_ct_exp_net(expect), net))
+ return 0;
+
if (expect->timeout.function)
seq_printf(s, "%ld ", timer_pending(&expect->timeout)
? (long)(expect->timeout.expires - jiffies)/HZ : 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 270/491] netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 269/491] netfilter: nf_conntrack_expect: skip expectations in other netns via proc Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 271/491] netlink: introduce NLA_POLICY_MAX_BE Greg Kroah-Hartman
` (225 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Florian Westphal, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 ]
process_sdp() declares union nf_inet_addr rtp_addr on the stack and
passes it to the nf_nat_sip sdp_session hook after walking the SDP
media descriptions. However rtp_addr is only initialized inside the
media loop when a recognized media type with a non-zero port is found.
If the SDP body contains no m= lines, only inactive media sections
(m=audio 0 ...) or only unrecognized media types, rtp_addr is never
assigned. Despite that, the function still calls hooks->sdp_session()
with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack
value as an IP address and rewrite the SDP session owner and connection
lines with it.
With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this
results in the session-level o= and c= addresses being rewritten to
0.0.0.0 for inactive SDP sessions. Without stack auto-init the
rewritten address is whatever happened to be on the stack.
Fix this by pre-initializing rtp_addr from the session-level connection
address (caddr) when available, and tracking via a have_rtp_addr flag
whether any valid address was established. Skip the sdp_session hook
entirely when no valid address exists.
Fixes: 4ab9e64e5e3c ("[NETFILTER]: nf_nat_sip: split up SDP mangling")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_sip.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 5db17768ec2ad..dcb0a5e592775 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1040,6 +1040,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,
unsigned int port;
const struct sdp_media_type *t;
int ret = NF_ACCEPT;
+ bool have_rtp_addr = false;
hooks = rcu_dereference(nf_nat_sip_hooks);
@@ -1056,8 +1057,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,
caddr_len = 0;
if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
- &matchoff, &matchlen, &caddr) > 0)
+ &matchoff, &matchlen, &caddr) > 0) {
caddr_len = matchlen;
+ memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
+ have_rtp_addr = true;
+ }
mediaoff = sdpoff;
for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
@@ -1091,9 +1095,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,
&matchoff, &matchlen, &maddr) > 0) {
maddr_len = matchlen;
memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
- } else if (caddr_len)
+ have_rtp_addr = true;
+ } else if (caddr_len) {
memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
- else {
+ have_rtp_addr = true;
+ } else {
nf_ct_helper_log(skb, ct, "cannot parse SDP message");
return NF_DROP;
}
@@ -1125,7 +1131,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,
/* Update session connection and owner addresses */
hooks = rcu_dereference(nf_nat_sip_hooks);
- if (hooks && ct->status & IPS_NAT_MASK)
+ if (hooks && ct->status & IPS_NAT_MASK && have_rtp_addr)
ret = hooks->sdp_session(skb, protoff, dataoff,
dptr, datalen, sdpoff,
&rtp_addr);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 271/491] netlink: introduce NLA_POLICY_MAX_BE
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 270/491] netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 272/491] netfilter: nft_payload: reject out-of-range attributes via policy Greg Kroah-Hartman
` (224 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 08724ef69907214ce622344fe4945412e38368f0 ]
netlink allows to specify allowed ranges for integer types.
Unfortunately, nfnetlink passes integers in big endian, so the existing
NLA_POLICY_MAX() cannot be used.
At the moment, nfnetlink users, such as nf_tables, need to resort to
programmatic checking via helpers such as nft_parse_u32_check().
This is both cumbersome and error prone. This adds NLA_POLICY_MAX_BE
which adds range check support for BE16, BE32 and BE64 integers.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netlink.h | 9 +++++++++
lib/nlattr.c | 31 +++++++++++++++++++++++++++----
2 files changed, 36 insertions(+), 4 deletions(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 7356f41d23bac..45370f84d6442 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -325,6 +325,7 @@ struct nla_policy {
struct netlink_range_validation_signed *range_signed;
struct {
s16 min, max;
+ u8 network_byte_order:1;
};
int (*validate)(const struct nlattr *attr,
struct netlink_ext_ack *extack);
@@ -418,6 +419,14 @@ struct nla_policy {
.type = NLA_ENSURE_INT_OR_BINARY_TYPE(tp), \
.validation_type = NLA_VALIDATE_MAX, \
.max = _max, \
+ .network_byte_order = 0, \
+}
+
+#define NLA_POLICY_MAX_BE(tp, _max) { \
+ .type = NLA_ENSURE_UINT_TYPE(tp), \
+ .validation_type = NLA_VALIDATE_MAX, \
+ .max = _max, \
+ .network_byte_order = 1, \
}
#define NLA_POLICY_MASK(tp, _mask) { \
diff --git a/lib/nlattr.c b/lib/nlattr.c
index aa8fc4371e930..8825ad4f45bfe 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -160,6 +160,31 @@ void nla_get_range_unsigned(const struct nla_policy *pt,
}
}
+static u64 nla_get_attr_bo(const struct nla_policy *pt,
+ const struct nlattr *nla)
+{
+ switch (pt->type) {
+ case NLA_U16:
+ if (pt->network_byte_order)
+ return ntohs(nla_get_be16(nla));
+
+ return nla_get_u16(nla);
+ case NLA_U32:
+ if (pt->network_byte_order)
+ return ntohl(nla_get_be32(nla));
+
+ return nla_get_u32(nla);
+ case NLA_U64:
+ if (pt->network_byte_order)
+ return be64_to_cpu(nla_get_be64(nla));
+
+ return nla_get_u64(nla);
+ }
+
+ WARN_ON_ONCE(1);
+ return 0;
+}
+
static int nla_validate_range_unsigned(const struct nla_policy *pt,
const struct nlattr *nla,
struct netlink_ext_ack *extack,
@@ -173,12 +198,10 @@ static int nla_validate_range_unsigned(const struct nla_policy *pt,
value = nla_get_u8(nla);
break;
case NLA_U16:
- value = nla_get_u16(nla);
- break;
case NLA_U32:
- value = nla_get_u32(nla);
- break;
case NLA_U64:
+ value = nla_get_attr_bo(pt, nla);
+ break;
case NLA_MSECS:
value = nla_get_u64(nla);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 272/491] netfilter: nft_payload: reject out-of-range attributes via policy
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 271/491] netlink: introduce NLA_POLICY_MAX_BE Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 273/491] netlink: hide validation union fields from kdoc Greg Kroah-Hartman
` (223 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit e7af210e6dd0de633d3f4850383310cf57473bc8 ]
Now that nla_policy allows range checks for bigendian data make use of
this to reject such attributes. At this time, reject happens later
from the init or select_ops callbacks, but its prone to errors.
In the future, new attributes can be handled via NLA_POLICY_MAX_BE
and exiting ones can be converted one by one.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_payload.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index f607cd7f203ad..f59ad5fb42575 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -119,10 +119,10 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
[NFTA_PAYLOAD_SREG] = { .type = NLA_U32 },
[NFTA_PAYLOAD_DREG] = { .type = NLA_U32 },
[NFTA_PAYLOAD_BASE] = { .type = NLA_U32 },
- [NFTA_PAYLOAD_OFFSET] = { .type = NLA_U32 },
- [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 },
+ [NFTA_PAYLOAD_OFFSET] = NLA_POLICY_MAX_BE(NLA_U32, 255),
+ [NFTA_PAYLOAD_LEN] = NLA_POLICY_MAX_BE(NLA_U32, 255),
[NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 },
- [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 },
+ [NFTA_PAYLOAD_CSUM_OFFSET] = NLA_POLICY_MAX_BE(NLA_U32, 255),
[NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 273/491] netlink: hide validation union fields from kdoc
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 272/491] netfilter: nft_payload: reject out-of-range attributes via policy Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 274/491] netlink: introduce bigendian integer types Greg Kroah-Hartman
` (222 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 7354c9024f2835f6122ed9612e21ab379df050f9 ]
Mark the validation fields as private, users shouldn't set
them directly and they are too complicated to explain in
a more succinct way (there's already a long explanation
in the comment above).
The strict_start_type field is set directly and has a dedicated
comment so move that above the "private" section.
Link: https://lore.kernel.org/r/20221027212107.2639255-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netlink.h | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 45370f84d6442..9d5d6aa690c56 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -317,19 +317,10 @@ struct nla_policy {
u8 validation_type;
u16 len;
union {
- const u32 bitfield32_valid;
- const u32 mask;
- const char *reject_message;
- const struct nla_policy *nested_policy;
- struct netlink_range_validation *range;
- struct netlink_range_validation_signed *range_signed;
- struct {
- s16 min, max;
- u8 network_byte_order:1;
- };
- int (*validate)(const struct nlattr *attr,
- struct netlink_ext_ack *extack);
- /* This entry is special, and used for the attribute at index 0
+ /**
+ * @strict_start_type: first attribute to validate strictly
+ *
+ * This entry is special, and used for the attribute at index 0
* only, and specifies special data about the policy, namely it
* specifies the "boundary type" where strict length validation
* starts for any attribute types >= this value, also, strict
@@ -348,6 +339,20 @@ struct nla_policy {
* was added to enforce strict validation from thereon.
*/
u16 strict_start_type;
+
+ /* private: use NLA_POLICY_*() to set */
+ const u32 bitfield32_valid;
+ const u32 mask;
+ const char *reject_message;
+ const struct nla_policy *nested_policy;
+ struct netlink_range_validation *range;
+ struct netlink_range_validation_signed *range_signed;
+ struct {
+ s16 min, max;
+ u8 network_byte_order:1;
+ };
+ int (*validate)(const struct nlattr *attr,
+ struct netlink_ext_ack *extack);
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 274/491] netlink: introduce bigendian integer types
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 273/491] netlink: hide validation union fields from kdoc Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 275/491] netlink: allow be16 and be32 types in all uint policy checks Greg Kroah-Hartman
` (221 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Johannes Berg,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit ecaf75ffd5f5db320d8b1da0198eef5a5ce64a3f ]
Jakub reported that the addition of the "network_byte_order"
member in struct nla_policy increases size of 32bit platforms.
Instead of scraping the bit from elsewhere Johannes suggested
to add explicit NLA_BE types instead, so do this here.
NLA_POLICY_MAX_BE() macro is removed again, there is no need
for it: NLA_POLICY_MAX(NLA_BE.., ..) will do the right thing.
NLA_BE64 can be added later.
Fixes: 08724ef69907 ("netlink: introduce NLA_POLICY_MAX_BE")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20221031123407.9158-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netlink.h | 19 +++++++++--------
lib/nlattr.c | 41 ++++++++++++++-----------------------
net/netfilter/nft_payload.c | 6 +++---
3 files changed, 28 insertions(+), 38 deletions(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 9d5d6aa690c56..fed93bd3424ff 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -181,6 +181,8 @@ enum {
NLA_S64,
NLA_BITFIELD32,
NLA_REJECT,
+ NLA_BE16,
+ NLA_BE32,
__NLA_TYPE_MAX,
};
@@ -231,6 +233,7 @@ enum nla_policy_validation {
* NLA_U32, NLA_U64,
* NLA_S8, NLA_S16,
* NLA_S32, NLA_S64,
+ * NLA_BE16, NLA_BE32,
* NLA_MSECS Leaving the length field zero will verify the
* given type fits, using it verifies minimum length
* just like "All other"
@@ -261,6 +264,8 @@ enum nla_policy_validation {
* NLA_U16,
* NLA_U32,
* NLA_U64,
+ * NLA_BE16,
+ * NLA_BE32,
* NLA_S8,
* NLA_S16,
* NLA_S32,
@@ -349,7 +354,6 @@ struct nla_policy {
struct netlink_range_validation_signed *range_signed;
struct {
s16 min, max;
- u8 network_byte_order:1;
};
int (*validate)(const struct nlattr *attr,
struct netlink_ext_ack *extack);
@@ -374,6 +378,8 @@ struct nla_policy {
(tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || tp == NLA_U64)
#define __NLA_IS_SINT_TYPE(tp) \
(tp == NLA_S8 || tp == NLA_S16 || tp == NLA_S32 || tp == NLA_S64)
+#define __NLA_IS_BEINT_TYPE(tp) \
+ (tp == NLA_BE16 || tp == NLA_BE32)
#define __NLA_ENSURE(condition) BUILD_BUG_ON_ZERO(!(condition))
#define NLA_ENSURE_UINT_TYPE(tp) \
@@ -387,6 +393,7 @@ struct nla_policy {
#define NLA_ENSURE_INT_OR_BINARY_TYPE(tp) \
(__NLA_ENSURE(__NLA_IS_UINT_TYPE(tp) || \
__NLA_IS_SINT_TYPE(tp) || \
+ __NLA_IS_BEINT_TYPE(tp) || \
tp == NLA_MSECS || \
tp == NLA_BINARY) + tp)
#define NLA_ENSURE_NO_VALIDATION_PTR(tp) \
@@ -394,6 +401,8 @@ struct nla_policy {
tp != NLA_REJECT && \
tp != NLA_NESTED && \
tp != NLA_NESTED_ARRAY) + tp)
+#define NLA_ENSURE_BEINT_TYPE(tp) \
+ (__NLA_ENSURE(__NLA_IS_BEINT_TYPE(tp)) + tp)
#define NLA_POLICY_RANGE(tp, _min, _max) { \
.type = NLA_ENSURE_INT_OR_BINARY_TYPE(tp), \
@@ -424,14 +433,6 @@ struct nla_policy {
.type = NLA_ENSURE_INT_OR_BINARY_TYPE(tp), \
.validation_type = NLA_VALIDATE_MAX, \
.max = _max, \
- .network_byte_order = 0, \
-}
-
-#define NLA_POLICY_MAX_BE(tp, _max) { \
- .type = NLA_ENSURE_UINT_TYPE(tp), \
- .validation_type = NLA_VALIDATE_MAX, \
- .max = _max, \
- .network_byte_order = 1, \
}
#define NLA_POLICY_MASK(tp, _mask) { \
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 8825ad4f45bfe..440beb1626be3 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -125,10 +125,12 @@ void nla_get_range_unsigned(const struct nla_policy *pt,
range->max = U8_MAX;
break;
case NLA_U16:
+ case NLA_BE16:
case NLA_BINARY:
range->max = U16_MAX;
break;
case NLA_U32:
+ case NLA_BE32:
range->max = U32_MAX;
break;
case NLA_U64:
@@ -160,31 +162,6 @@ void nla_get_range_unsigned(const struct nla_policy *pt,
}
}
-static u64 nla_get_attr_bo(const struct nla_policy *pt,
- const struct nlattr *nla)
-{
- switch (pt->type) {
- case NLA_U16:
- if (pt->network_byte_order)
- return ntohs(nla_get_be16(nla));
-
- return nla_get_u16(nla);
- case NLA_U32:
- if (pt->network_byte_order)
- return ntohl(nla_get_be32(nla));
-
- return nla_get_u32(nla);
- case NLA_U64:
- if (pt->network_byte_order)
- return be64_to_cpu(nla_get_be64(nla));
-
- return nla_get_u64(nla);
- }
-
- WARN_ON_ONCE(1);
- return 0;
-}
-
static int nla_validate_range_unsigned(const struct nla_policy *pt,
const struct nlattr *nla,
struct netlink_ext_ack *extack,
@@ -198,9 +175,13 @@ static int nla_validate_range_unsigned(const struct nla_policy *pt,
value = nla_get_u8(nla);
break;
case NLA_U16:
+ value = nla_get_u16(nla);
+ break;
case NLA_U32:
+ value = nla_get_u32(nla);
+ break;
case NLA_U64:
- value = nla_get_attr_bo(pt, nla);
+ value = nla_get_u64(nla);
break;
case NLA_MSECS:
value = nla_get_u64(nla);
@@ -208,6 +189,12 @@ static int nla_validate_range_unsigned(const struct nla_policy *pt,
case NLA_BINARY:
value = nla_len(nla);
break;
+ case NLA_BE16:
+ value = ntohs(nla_get_be16(nla));
+ break;
+ case NLA_BE32:
+ value = ntohl(nla_get_be32(nla));
+ break;
default:
return -EINVAL;
}
@@ -335,6 +322,8 @@ static int nla_validate_int_range(const struct nla_policy *pt,
case NLA_U64:
case NLA_MSECS:
case NLA_BINARY:
+ case NLA_BE16:
+ case NLA_BE32:
return nla_validate_range_unsigned(pt, nla, extack, validate);
case NLA_S8:
case NLA_S16:
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index f59ad5fb42575..ae0c4cd2dd1c5 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -119,10 +119,10 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
[NFTA_PAYLOAD_SREG] = { .type = NLA_U32 },
[NFTA_PAYLOAD_DREG] = { .type = NLA_U32 },
[NFTA_PAYLOAD_BASE] = { .type = NLA_U32 },
- [NFTA_PAYLOAD_OFFSET] = NLA_POLICY_MAX_BE(NLA_U32, 255),
- [NFTA_PAYLOAD_LEN] = NLA_POLICY_MAX_BE(NLA_U32, 255),
+ [NFTA_PAYLOAD_OFFSET] = NLA_POLICY_MAX(NLA_BE32, 255),
+ [NFTA_PAYLOAD_LEN] = NLA_POLICY_MAX(NLA_BE32, 255),
[NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 },
- [NFTA_PAYLOAD_CSUM_OFFSET] = NLA_POLICY_MAX_BE(NLA_U32, 255),
+ [NFTA_PAYLOAD_CSUM_OFFSET] = NLA_POLICY_MAX(NLA_BE32, 255),
[NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 275/491] netlink: allow be16 and be32 types in all uint policy checks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 274/491] netlink: introduce bigendian integer types Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 276/491] netfilter: ctnetlink: use netlink policy range checks Greg Kroah-Hartman
` (220 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 5fac9b7c16c50c6c7699517f582b56e3743f453a ]
__NLA_IS_BEINT_TYPE(tp) isn't useful. NLA_BE16/32 are identical to
NLA_U16/32, the only difference is that it tells the netlink validation
functions that byteorder conversion might be needed before comparing
the value to the policy min/max ones.
After this change all policy macros that can be used with UINT types,
such as NLA_POLICY_MASK() can also be used with NLA_BE16/32.
This will be used to validate nf_tables flag attributes which
are in bigendian byte order.
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netlink.h | 10 +++-------
lib/nlattr.c | 6 ++++++
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index fed93bd3424ff..d3d088dc0ae80 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -374,12 +374,11 @@ struct nla_policy {
#define NLA_POLICY_BITFIELD32(valid) \
{ .type = NLA_BITFIELD32, .bitfield32_valid = valid }
-#define __NLA_IS_UINT_TYPE(tp) \
- (tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || tp == NLA_U64)
+#define __NLA_IS_UINT_TYPE(tp) \
+ (tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || \
+ tp == NLA_U64 || tp == NLA_BE16 || tp == NLA_BE32)
#define __NLA_IS_SINT_TYPE(tp) \
(tp == NLA_S8 || tp == NLA_S16 || tp == NLA_S32 || tp == NLA_S64)
-#define __NLA_IS_BEINT_TYPE(tp) \
- (tp == NLA_BE16 || tp == NLA_BE32)
#define __NLA_ENSURE(condition) BUILD_BUG_ON_ZERO(!(condition))
#define NLA_ENSURE_UINT_TYPE(tp) \
@@ -393,7 +392,6 @@ struct nla_policy {
#define NLA_ENSURE_INT_OR_BINARY_TYPE(tp) \
(__NLA_ENSURE(__NLA_IS_UINT_TYPE(tp) || \
__NLA_IS_SINT_TYPE(tp) || \
- __NLA_IS_BEINT_TYPE(tp) || \
tp == NLA_MSECS || \
tp == NLA_BINARY) + tp)
#define NLA_ENSURE_NO_VALIDATION_PTR(tp) \
@@ -401,8 +399,6 @@ struct nla_policy {
tp != NLA_REJECT && \
tp != NLA_NESTED && \
tp != NLA_NESTED_ARRAY) + tp)
-#define NLA_ENSURE_BEINT_TYPE(tp) \
- (__NLA_ENSURE(__NLA_IS_BEINT_TYPE(tp)) + tp)
#define NLA_POLICY_RANGE(tp, _min, _max) { \
.type = NLA_ENSURE_INT_OR_BINARY_TYPE(tp), \
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 440beb1626be3..d88ba6feb8c3d 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -355,6 +355,12 @@ static int nla_validate_mask(const struct nla_policy *pt,
case NLA_U64:
value = nla_get_u64(nla);
break;
+ case NLA_BE16:
+ value = ntohs(nla_get_be16(nla));
+ break;
+ case NLA_BE32:
+ value = ntohl(nla_get_be32(nla));
+ break;
default:
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 276/491] netfilter: ctnetlink: use netlink policy range checks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 275/491] netlink: allow be16 and be32 types in all uint policy checks Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 277/491] net: macb: use the current queue number for stats Greg Kroah-Hartman
` (219 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Carlier, Pablo Neira Ayuso,
Sasha Levin, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 ]
Replace manual range and mask validations with netlink policy
annotations in ctnetlink code paths, so that the netlink core rejects
invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
(14). The normal TCP option parsing path already clamps to this value,
but the ctnetlink path accepted 0-255, causing undefined behavior when
used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to
ctnetlink for the fixes tree.
Fixes: c8e2078cfe41 ("[NETFILTER]: ctnetlink: add support for internal tcp connection tracking flags handling")
Signed-off-by: David Carlier <devnexen@gmail.com>
Co-developed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../uapi/linux/netfilter/nf_conntrack_common.h | 4 ++++
net/netfilter/nf_conntrack_netlink.c | 16 +++++-----------
net/netfilter/nf_conntrack_proto_tcp.c | 10 +++-------
3 files changed, 12 insertions(+), 18 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index 26071021e986f..56b6b60a814f5 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -159,5 +159,9 @@ enum ip_conntrack_expect_events {
#define NF_CT_EXPECT_INACTIVE 0x2
#define NF_CT_EXPECT_USERSPACE 0x4
+#ifdef __KERNEL__
+#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \
+ NF_CT_EXPECT_USERSPACE)
+#endif
#endif /* _UAPI_NF_CONNTRACK_COMMON_H */
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9fe2c5b3523c5..8d35e17a0f7e7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -860,8 +860,8 @@ struct ctnetlink_filter {
};
static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = {
- [CTA_FILTER_ORIG_FLAGS] = { .type = NLA_U32 },
- [CTA_FILTER_REPLY_FLAGS] = { .type = NLA_U32 },
+ [CTA_FILTER_ORIG_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
+ [CTA_FILTER_REPLY_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
};
static int ctnetlink_parse_filter(const struct nlattr *attr,
@@ -875,17 +875,11 @@ static int ctnetlink_parse_filter(const struct nlattr *attr,
if (ret)
return ret;
- if (tb[CTA_FILTER_ORIG_FLAGS]) {
+ if (tb[CTA_FILTER_ORIG_FLAGS])
filter->orig_flags = nla_get_u32(tb[CTA_FILTER_ORIG_FLAGS]);
- if (filter->orig_flags & ~CTA_FILTER_F_ALL)
- return -EOPNOTSUPP;
- }
- if (tb[CTA_FILTER_REPLY_FLAGS]) {
+ if (tb[CTA_FILTER_REPLY_FLAGS])
filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]);
- if (filter->reply_flags & ~CTA_FILTER_F_ALL)
- return -EOPNOTSUPP;
- }
return 0;
}
@@ -2618,7 +2612,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,
.len = NF_CT_HELPER_NAME_LEN - 1 },
[CTA_EXPECT_ZONE] = { .type = NLA_U16 },
- [CTA_EXPECT_FLAGS] = { .type = NLA_U32 },
+ [CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK),
[CTA_EXPECT_CLASS] = { .type = NLA_U32 },
[CTA_EXPECT_NAT] = { .type = NLA_NESTED },
[CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index c1d02c0b4f005..c43d9819df067 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1249,9 +1249,9 @@ static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
}
static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
- [CTA_PROTOINFO_TCP_STATE] = { .type = NLA_U8 },
- [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
- [CTA_PROTOINFO_TCP_WSCALE_REPLY] = { .type = NLA_U8 },
+ [CTA_PROTOINFO_TCP_STATE] = NLA_POLICY_MAX(NLA_U8, TCP_CONNTRACK_SYN_SENT2),
+ [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
+ [CTA_PROTOINFO_TCP_WSCALE_REPLY] = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL] = { .len = sizeof(struct nf_ct_tcp_flags) },
[CTA_PROTOINFO_TCP_FLAGS_REPLY] = { .len = sizeof(struct nf_ct_tcp_flags) },
};
@@ -1278,10 +1278,6 @@ static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
if (err < 0)
return err;
- if (tb[CTA_PROTOINFO_TCP_STATE] &&
- nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
- return -EINVAL;
-
spin_lock_bh(&ct->lock);
if (tb[CTA_PROTOINFO_TCP_STATE])
ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 277/491] net: macb: use the current queue number for stats
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 276/491] netfilter: ctnetlink: use netlink policy range checks Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 278/491] regmap: Synchronize cache for the page selector Greg Kroah-Hartman
` (218 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Valerio, Nicolai Buchwitz,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Valerio <pvalerio@redhat.com>
[ Upstream commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 ]
There's a potential mismatch between the memory reserved for statistics
and the amount of memory written.
gem_get_sset_count() correctly computes the number of stats based on the
active queues, whereas gem_get_ethtool_stats() indiscriminately copies
data using the maximum number of queues, and in the case the number of
active queues is less than MACB_MAX_QUEUES, this results in a OOB write
as observed in the KASAN splat.
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78
[macb]
Write of size 760 at addr ffff80008080b000 by task ethtool/1027
CPU: [...]
Tainted: [E]=UNSIGNED_MODULE
Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x80/0xf8
print_report+0x384/0x5e0
kasan_report+0xa0/0xf0
kasan_check_range+0xe8/0x190
__asan_memcpy+0x54/0x98
gem_get_ethtool_stats+0x54/0x78 [macb
926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
dev_ethtool+0x1220/0x38c0
dev_ioctl+0x4ac/0xca8
sock_do_ioctl+0x170/0x1d8
sock_ioctl+0x484/0x5d8
__arm64_sys_ioctl+0x12c/0x1b8
invoke_syscall+0xd4/0x258
el0_svc_common.constprop.0+0xb4/0x240
do_el0_svc+0x48/0x68
el0_svc+0x40/0xf8
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
The buggy address belongs to a 1-page vmalloc region starting at
0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff00000a333000 pfn:0xa333
flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Fix it by making sure the copied size only considers the active number of
queues.
Fixes: 512286bbd4b7 ("net: macb: Added some queue statistics")
Signed-off-by: Paolo Valerio <pvalerio@redhat.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260323191634.2185840-1-pvalerio@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index f49e4e0494db3..bdbb05a95519b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -2786,7 +2786,7 @@ static void gem_get_ethtool_stats(struct net_device *dev,
spin_lock_irq(&bp->stats_lock);
gem_update_stats(bp);
memcpy(data, &bp->ethtool_stats, sizeof(u64)
- * (GEM_STATS_LEN + QUEUE_STATS_LEN * MACB_MAX_QUEUES));
+ * (GEM_STATS_LEN + QUEUE_STATS_LEN * bp->num_queues));
spin_unlock_irq(&bp->stats_lock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 278/491] regmap: Synchronize cache for the page selector
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 277/491] net: macb: use the current queue number for stats Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 279/491] RDMA/rw: Fall back to direct SGE on MR pool exhaustion Greg Kroah-Hartman
` (217 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Marek Szyprowski,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 ]
If the selector register is represented in each page, its value
according to the debugfs is stale because it gets synchronized
only after the real page switch happens. Hence the regmap cache
initialisation from the HW inherits outdated data in the selector
register.
Synchronize cache for the page selector just in time.
Before (offset followed by hexdump, the first byte is selector):
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 01 ff 00 00 ff ff 00 00 00 00 00 00
70: 02 ff 00 00 cf f3 00 00 00 00 00 0c
80: 03 ff 00 00 00 00 00 00 00 00 00 ff
90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00
After:
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 02 ff 00 00 ff ff 00 00 00 00 00 00
70: 03 ff 00 00 cf f3 00 00 00 00 00 0c
80: 04 ff 00 00 00 00 00 00 00 00 00 ff
90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
Fixes: 6863ca622759 ("regmap: Add support for register indirect addressing.")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260302184753.2693803-1-andriy.shevchenko@linux.intel.com
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regmap.c | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index e86d069894c06..3ad37e5615ea4 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1587,6 +1587,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,
unsigned int val_num)
{
void *orig_work_buf;
+ unsigned int selector_reg;
unsigned int win_offset;
unsigned int win_page;
bool page_chg;
@@ -1605,10 +1606,31 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,
return -EINVAL;
}
- /* It is possible to have selector register inside data window.
- In that case, selector register is located on every page and
- it needs no page switching, when accessed alone. */
+ /*
+ * Calculate the address of the selector register in the corresponding
+ * data window if it is located on every page.
+ */
+ page_chg = in_range(range->selector_reg, range->window_start, range->window_len);
+ if (page_chg)
+ selector_reg = range->range_min + win_page * range->window_len +
+ range->selector_reg - range->window_start;
+
+ /*
+ * It is possible to have selector register inside data window.
+ * In that case, selector register is located on every page and it
+ * needs no page switching, when accessed alone.
+ *
+ * Nevertheless we should synchronize the cache values for it.
+ * This can't be properly achieved if the selector register is
+ * the first and the only one to be read inside the data window.
+ * That's why we update it in that case as well.
+ *
+ * However, we specifically avoid updating it for the default page,
+ * when it's overlapped with the real data window, to prevent from
+ * infinite looping.
+ */
if (val_num > 1 ||
+ (page_chg && selector_reg != range->selector_reg) ||
range->window_start + win_offset != range->selector_reg) {
/* Use separate work_buf during page switching */
orig_work_buf = map->work_buf;
@@ -1617,7 +1639,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,
ret = _regmap_update_bits(map, range->selector_reg,
range->selector_mask,
win_page << range->selector_shift,
- &page_chg, false);
+ NULL, false);
map->work_buf = orig_work_buf;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 279/491] RDMA/rw: Fall back to direct SGE on MR pool exhaustion
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 278/491] regmap: Synchronize cache for the page selector Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 280/491] scsi: scsi_transport_sas: Fix the maximum channel scanning issue Greg Kroah-Hartman
` (216 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Christoph Hellwig,
Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 ]
When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs()
produces no coalescing: each scatterlist page maps 1:1 to a DMA
entry, so sgt.nents equals the raw page count. A 1 MB transfer
yields 256 DMA entries. If that count exceeds the device's
max_sgl_rd threshold (an optimization hint from mlx5 firmware),
rdma_rw_io_needs_mr() steers the operation into the MR
registration path. Each such operation consumes one or more MRs
from a pool sized at max_rdma_ctxs -- roughly one MR per
concurrent context. Under write-intensive workloads that issue
many concurrent RDMA READs, the pool is rapidly exhausted,
ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns
-EAGAIN. Upper layer protocols treat this as a fatal DMA mapping
failure and tear down the connection.
The max_sgl_rd check is a performance optimization, not a
correctness requirement: the device can handle large SGE counts
via direct posting, just less efficiently than with MR
registration. When the MR pool cannot satisfy a request, falling
back to the direct SGE (map_wrs) path avoids the connection
reset while preserving the MR optimization for the common case
where pool resources are available.
Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from
rdma_rw_init_mr_wrs() triggers direct SGE posting instead of
propagating the error. iWARP devices, which mandate MR
registration for RDMA READs, and force_mr debug mode continue
to treat -EAGAIN as terminal.
Fixes: 00bd1439f464 ("RDMA/rw: Support threshold for registration vs scattering to local pages")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260313194201.5818-2-cel@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/rw.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
index d479408a2cf73..58ce6c7eec4ef 100644
--- a/drivers/infiniband/core/rw.c
+++ b/drivers/infiniband/core/rw.c
@@ -341,14 +341,29 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx *ctx, struct ib_qp *qp, u8 port_num,
if (rdma_rw_io_needs_mr(qp->device, port_num, dir, sg_cnt)) {
ret = rdma_rw_init_mr_wrs(ctx, qp, port_num, sg, sg_cnt,
sg_offset, remote_addr, rkey, dir);
- } else if (sg_cnt > 1) {
+ /*
+ * If MR init succeeded or failed for a reason other
+ * than pool exhaustion, that result is final.
+ *
+ * Pool exhaustion (-EAGAIN) from the max_sgl_rd
+ * optimization is recoverable: fall back to
+ * direct SGE posting. iWARP and force_mr require
+ * MRs unconditionally, so -EAGAIN is terminal.
+ */
+ if (ret != -EAGAIN ||
+ rdma_protocol_iwarp(qp->device, port_num) ||
+ unlikely(rdma_rw_force_mr))
+ goto out;
+ }
+
+ if (sg_cnt > 1)
ret = rdma_rw_init_map_wrs(ctx, qp, sg, sg_cnt, sg_offset,
remote_addr, rkey, dir);
- } else {
+ else
ret = rdma_rw_init_single_wr(ctx, qp, sg, sg_offset,
remote_addr, rkey, dir);
- }
+out:
if (ret < 0)
goto out_unmap_sg;
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 280/491] scsi: scsi_transport_sas: Fix the maximum channel scanning issue
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 279/491] RDMA/rw: Fall back to direct SGE on MR pool exhaustion Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 281/491] x86/fault: Fold mm_fault_error() into do_user_addr_fault() Greg Kroah-Hartman
` (215 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yihang Li, John Garry,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <liyihang9@huawei.com>
[ Upstream commit d71afa9deb4d413232ba16d693f7d43b321931b4 ]
After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard
and multi-channel scans"), if the device supports multiple channels (0 to
shost->max_channel), user_scan() invokes updated sas_user_scan() to perform
the scan behavior for a specific transfer. However, when the user
specifies shost->max_channel, it will return -EINVAL, which is not
expected.
Fix and support specifying the scan shost->max_channel for scanning.
Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans")
Signed-off-by: Yihang Li <liyihang9@huawei.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Link: https://patch.msgid.link/20260317063147.2182562-1-liyihang9@huawei.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_sas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 1eb58f8765e22..8766ec93652ca 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -1703,7 +1703,7 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
break;
default:
- if (channel < shost->max_channel) {
+ if (channel <= shost->max_channel) {
res = scsi_scan_host_selected(shost, channel, id, lun,
SCSI_SCAN_MANUAL);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 281/491] x86/fault: Fold mm_fault_error() into do_user_addr_fault()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 280/491] scsi: scsi_transport_sas: Fix the maximum channel scanning issue Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 282/491] x86/fault: Improve kernel-executing-user-memory handling Greg Kroah-Hartman
` (214 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Lutomirski, Borislav Petkov,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit ec352711ceba890ea3a0c182c2d49c86c1a5e30e ]
mm_fault_error() is logically just the end of do_user_addr_fault().
Combine the functions. This makes the code easier to read.
Most of the churn here is from renaming hw_error_code to error_code in
do_user_addr_fault().
This makes no difference at all to the generated code (objdump -dr) as
compared to changing noinline to __always_inline in the definition of
mm_fault_error().
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/dedc4d9c9b047e51ce38b991bd23971a28af4e7b.1612924255.git.luto@kernel.org
Stable-dep-of: 217c0a5c177a ("x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/fault.c | 97 +++++++++++++++++++++------------------------
1 file changed, 45 insertions(+), 52 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 98a5924d98b72..07983b6208f52 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -925,40 +925,6 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address);
}
-static noinline void
-mm_fault_error(struct pt_regs *regs, unsigned long error_code,
- unsigned long address, vm_fault_t fault)
-{
- if (fatal_signal_pending(current) && !(error_code & X86_PF_USER)) {
- no_context(regs, error_code, address, 0, 0);
- return;
- }
-
- if (fault & VM_FAULT_OOM) {
- /* Kernel mode? Handle exceptions or die: */
- if (!(error_code & X86_PF_USER)) {
- no_context(regs, error_code, address,
- SIGSEGV, SEGV_MAPERR);
- return;
- }
-
- /*
- * We ran out of memory, call the OOM killer, and return the
- * userspace (which will retry the fault, or kill us if we got
- * oom-killed):
- */
- pagefault_out_of_memory();
- } else {
- if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
- VM_FAULT_HWPOISON_LARGE))
- do_sigbus(regs, error_code, address, fault);
- else if (fault & VM_FAULT_SIGSEGV)
- bad_area_nosemaphore(regs, error_code, address);
- else
- BUG();
- }
-}
-
static int spurious_kernel_fault_check(unsigned long error_code, pte_t *pte)
{
if ((error_code & X86_PF_WRITE) && !pte_write(*pte))
@@ -1184,7 +1150,7 @@ NOKPROBE_SYMBOL(do_kern_addr_fault);
/* Handle faults in the user portion of the address space */
static inline
void do_user_addr_fault(struct pt_regs *regs,
- unsigned long hw_error_code,
+ unsigned long error_code,
unsigned long address)
{
struct vm_area_struct *vma;
@@ -1204,8 +1170,8 @@ void do_user_addr_fault(struct pt_regs *regs,
* Reserved bits are never expected to be set on
* entries in the user portion of the page tables.
*/
- if (unlikely(hw_error_code & X86_PF_RSVD))
- pgtable_bad(regs, hw_error_code, address);
+ if (unlikely(error_code & X86_PF_RSVD))
+ pgtable_bad(regs, error_code, address);
/*
* If SMAP is on, check for invalid kernel (supervisor) access to user
@@ -1215,10 +1181,10 @@ void do_user_addr_fault(struct pt_regs *regs,
* enforcement appears to be consistent with the USER bit.
*/
if (unlikely(cpu_feature_enabled(X86_FEATURE_SMAP) &&
- !(hw_error_code & X86_PF_USER) &&
+ !(error_code & X86_PF_USER) &&
!(regs->flags & X86_EFLAGS_AC)))
{
- bad_area_nosemaphore(regs, hw_error_code, address);
+ bad_area_nosemaphore(regs, error_code, address);
return;
}
@@ -1227,7 +1193,7 @@ void do_user_addr_fault(struct pt_regs *regs,
* in a region with pagefaults disabled then we must not take the fault
*/
if (unlikely(faulthandler_disabled() || !mm)) {
- bad_area_nosemaphore(regs, hw_error_code, address);
+ bad_area_nosemaphore(regs, error_code, address);
return;
}
@@ -1248,9 +1214,9 @@ void do_user_addr_fault(struct pt_regs *regs,
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
- if (hw_error_code & X86_PF_WRITE)
+ if (error_code & X86_PF_WRITE)
flags |= FAULT_FLAG_WRITE;
- if (hw_error_code & X86_PF_INSTR)
+ if (error_code & X86_PF_INSTR)
flags |= FAULT_FLAG_INSTRUCTION;
#ifdef CONFIG_X86_64
@@ -1266,7 +1232,7 @@ void do_user_addr_fault(struct pt_regs *regs,
* to consider the PF_PK bit.
*/
if (is_vsyscall_vaddr(address)) {
- if (emulate_vsyscall(hw_error_code, regs, address))
+ if (emulate_vsyscall(error_code, regs, address))
return;
}
#endif
@@ -1289,7 +1255,7 @@ void do_user_addr_fault(struct pt_regs *regs,
* Fault from code in kernel from
* which we do not expect faults.
*/
- bad_area_nosemaphore(regs, hw_error_code, address);
+ bad_area_nosemaphore(regs, error_code, address);
return;
}
retry:
@@ -1305,17 +1271,17 @@ void do_user_addr_fault(struct pt_regs *regs,
vma = find_vma(mm, address);
if (unlikely(!vma)) {
- bad_area(regs, hw_error_code, address);
+ bad_area(regs, error_code, address);
return;
}
if (likely(vma->vm_start <= address))
goto good_area;
if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) {
- bad_area(regs, hw_error_code, address);
+ bad_area(regs, error_code, address);
return;
}
if (unlikely(expand_stack(vma, address))) {
- bad_area(regs, hw_error_code, address);
+ bad_area(regs, error_code, address);
return;
}
@@ -1324,8 +1290,8 @@ void do_user_addr_fault(struct pt_regs *regs,
* we can handle it..
*/
good_area:
- if (unlikely(access_error(hw_error_code, vma))) {
- bad_area_access_error(regs, hw_error_code, address, vma);
+ if (unlikely(access_error(error_code, vma))) {
+ bad_area_access_error(regs, error_code, address, vma);
return;
}
@@ -1347,7 +1313,7 @@ void do_user_addr_fault(struct pt_regs *regs,
/* Quick path to respond to signals */
if (fault_signal_pending(fault, regs)) {
if (!user_mode(regs))
- no_context(regs, hw_error_code, address, SIGBUS,
+ no_context(regs, error_code, address, SIGBUS,
BUS_ADRERR);
return;
}
@@ -1364,11 +1330,38 @@ void do_user_addr_fault(struct pt_regs *regs,
}
mmap_read_unlock(mm);
- if (unlikely(fault & VM_FAULT_ERROR)) {
- mm_fault_error(regs, hw_error_code, address, fault);
+ if (likely(!(fault & VM_FAULT_ERROR)))
+ return;
+
+ if (fatal_signal_pending(current) && !(error_code & X86_PF_USER)) {
+ no_context(regs, error_code, address, 0, 0);
return;
}
+ if (fault & VM_FAULT_OOM) {
+ /* Kernel mode? Handle exceptions or die: */
+ if (!(error_code & X86_PF_USER)) {
+ no_context(regs, error_code, address,
+ SIGSEGV, SEGV_MAPERR);
+ return;
+ }
+
+ /*
+ * We ran out of memory, call the OOM killer, and return the
+ * userspace (which will retry the fault, or kill us if we got
+ * oom-killed):
+ */
+ pagefault_out_of_memory();
+ } else {
+ if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
+ VM_FAULT_HWPOISON_LARGE))
+ do_sigbus(regs, error_code, address, fault);
+ else if (fault & VM_FAULT_SIGSEGV)
+ bad_area_nosemaphore(regs, error_code, address);
+ else
+ BUG();
+ }
+
check_v8086_mode(regs, address, tsk);
}
NOKPROBE_SYMBOL(do_user_addr_fault);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 282/491] x86/fault: Improve kernel-executing-user-memory handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 281/491] x86/fault: Fold mm_fault_error() into do_user_addr_fault() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 283/491] x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Greg Kroah-Hartman
` (213 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Lutomirski, Borislav Petkov,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit 03c81ea3331658f613bb2913d33764a4e0410cbd ]
Right now, the case of the kernel trying to execute from user memory
is treated more or less just like the kernel getting a page fault on a
user access. In the failure path, it checks for erratum #93, tries to
otherwise fix up the error, and then oopses.
If it manages to jump to the user address space, with or without SMEP,
it should not try to resolve the page fault. This is an error, pure and
simple. Rearrange the code so that this case is caught early, check for
erratum #93, and bail out.
[ bp: Massage commit message. ]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/ab8719c7afb8bd501c4eee0e36493150fbbe5f6a.1612924255.git.luto@kernel.org
Stable-dep-of: 217c0a5c177a ("x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/fault.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 07983b6208f52..e06182127e1c8 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -433,6 +433,9 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
|| boot_cpu_data.x86 != 0xf)
return 0;
+ if (user_mode(regs))
+ return 0;
+
if (address != regs->ip)
return 0;
@@ -697,9 +700,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
if (is_prefetch(regs, error_code, address))
return;
- if (is_errata93(regs, address))
- return;
-
/*
* Buggy firmware could access regions which might page fault, try to
* recover from such faults.
@@ -1162,6 +1162,21 @@ void do_user_addr_fault(struct pt_regs *regs,
tsk = current;
mm = tsk->mm;
+ if (unlikely((error_code & (X86_PF_USER | X86_PF_INSTR)) == X86_PF_INSTR)) {
+ /*
+ * Whoops, this is kernel mode code trying to execute from
+ * user memory. Unless this is AMD erratum #93, which
+ * corrupts RIP such that it looks like a user address,
+ * this is unrecoverable. Don't even try to look up the
+ * VMA.
+ */
+ if (is_errata93(regs, address))
+ return;
+
+ bad_area_nosemaphore(regs, error_code, address);
+ return;
+ }
+
/* kprobes don't want to hook the spurious faults: */
if (unlikely(kprobe_page_fault(regs, X86_TRAP_PF)))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 283/491] x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 282/491] x86/fault: Improve kernel-executing-user-memory handling Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 284/491] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Greg Kroah-Hartman
` (212 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck,
Mike Rapoport (Microsoft), Ard Biesheuvel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
[ Upstream commit 217c0a5c177a3d4f7c8497950cbf5c36756e8bbb ]
ranges_to_free array should have enough room to store the entire EFI
memmap plus an extra element for NULL entry.
The calculation of this array size wrongly adds 1 to the overall size
instead of adding 1 to the number of elements.
Add parentheses to properly size the array.
Reported-by: Guenter Roeck <linux@roeck-us.net>
Fixes: a4b0bf6a40f3 ("x86/efi: defer freeing of boot services memory")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/platform/efi/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index a152d57624004..99b282d6c1302 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -416,7 +416,7 @@ void __init efi_unmap_boot_services(void)
if (efi_enabled(EFI_DBG))
return;
- sz = sizeof(*ranges_to_free) * efi.memmap.nr_map + 1;
+ sz = sizeof(*ranges_to_free) * (efi.memmap.nr_map + 1);
ranges_to_free = kzalloc(sz, GFP_KERNEL);
if (!ranges_to_free) {
pr_err("Failed to allocate storage for freeable EFI regions\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 284/491] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 283/491] x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 285/491] ASoC: Intel: catpt: Fix the device initialization Greg Kroah-Hartman
` (211 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samasth Norway Ananda, Jani Nikula,
Joonas Lahtinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
[ Upstream commit 08441f10f4dc09fdeb64529953ac308abc79dd38 ]
When reading exactly 512 bytes with burst read enabled, the
extra_byte_added path breaks out of the inner do-while without
decrementing len. The outer while(len) then re-enters and gmbus_wait()
times out since all data has been delivered. Decrement len before the
break so the outer loop terminates correctly.
Fixes: d5dc0f43f268 ("drm/i915/gmbus: Enable burst read")
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260316231920.135438-2-samasth.norway.ananda@oracle.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
(cherry picked from commit 4ab0f09ee73fc853d00466682635f67c531f909c)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_gmbus.c b/drivers/gpu/drm/i915/display/intel_gmbus.c
index e6b8d6dfb598e..831e99c56ecb0 100644
--- a/drivers/gpu/drm/i915/display/intel_gmbus.c
+++ b/drivers/gpu/drm/i915/display/intel_gmbus.c
@@ -420,8 +420,10 @@ gmbus_xfer_read_chunk(struct drm_i915_private *dev_priv,
val = intel_de_read_fw(dev_priv, GMBUS3);
do {
- if (extra_byte_added && len == 1)
+ if (extra_byte_added && len == 1) {
+ len--;
break;
+ }
*buf++ = val & 0xff;
val >>= 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 285/491] ASoC: Intel: catpt: Fix the device initialization
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 284/491] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 286/491] ACPICA: include/acpi/acpixf.h: Fix indentation Greg Kroah-Hartman
` (210 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Cezary Rojewski,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit 5a184f1cb43a8e035251c635f5c47da5dc3e3049 ]
The DMA mask shall be coerced before any buffer allocations for the
device are done. At the same time explain why DMA mask of 31 bits is
used in the first place.
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Fixes: 7a10b66a5df9 ("ASoC: Intel: catpt: Device driver lifecycle")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260320101217.1243688-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/catpt/device.c | 10 +++++++++-
sound/soc/intel/catpt/dsp.c | 3 ---
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/sound/soc/intel/catpt/device.c b/sound/soc/intel/catpt/device.c
index a701799597956..db67509f051ad 100644
--- a/sound/soc/intel/catpt/device.c
+++ b/sound/soc/intel/catpt/device.c
@@ -263,7 +263,15 @@ static int catpt_acpi_probe(struct platform_device *pdev)
if (IS_ERR(cdev->pci_ba))
return PTR_ERR(cdev->pci_ba);
- /* alloc buffer for storing DRAM context during dx transitions */
+ /*
+ * As per design HOST is responsible for preserving firmware's runtime
+ * context during D0 -> D3 -> D0 transitions. Addresses used for DMA
+ * to/from HOST memory shall be outside the reserved range of 0xFFFxxxxx.
+ */
+ ret = dma_coerce_mask_and_coherent(cdev->dev, DMA_BIT_MASK(31));
+ if (ret)
+ return ret;
+
cdev->dxbuf_vaddr = dmam_alloc_coherent(dev, catpt_dram_size(cdev),
&cdev->dxbuf_paddr, GFP_KERNEL);
if (!cdev->dxbuf_vaddr)
diff --git a/sound/soc/intel/catpt/dsp.c b/sound/soc/intel/catpt/dsp.c
index 38a92bbc1ed56..2c67d2d35cdae 100644
--- a/sound/soc/intel/catpt/dsp.c
+++ b/sound/soc/intel/catpt/dsp.c
@@ -125,9 +125,6 @@ int catpt_dmac_probe(struct catpt_dev *cdev)
dmac->dev = cdev->dev;
dmac->irq = cdev->irq;
- ret = dma_coerce_mask_and_coherent(cdev->dev, DMA_BIT_MASK(31));
- if (ret)
- return ret;
/*
* Caller is responsible for putting device in D0 to allow
* for I/O and memory access before probing DW.
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 286/491] ACPICA: include/acpi/acpixf.h: Fix indentation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 285/491] ASoC: Intel: catpt: Fix the device initialization Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 287/491] ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Greg Kroah-Hartman
` (209 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 7a9d74e7e403cb2e60d4d00c05f2f3ab2a33d0c3 ]
A bunch of the functions declared in include/acpi/acpixf.h have their
name aligned a space after the '(' of e.g. the
`ACPI_EXTERNAL_RETURN_STATUS(acpi_status` line above rather then being
directly aligned after the '('.
This breaks applying patches generated from the ACPICA upstream git,
remove the extra space before the function-names and all the arguments
to fix this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/acpi/acpixf.h | 120 +++++++++++++++++++++---------------------
1 file changed, 60 insertions(+), 60 deletions(-)
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index be7de305a6220..f9a86e3329715 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -587,82 +587,82 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
acpi_install_initialization_handler
(acpi_init_handler handler, u32 function))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_install_sci_handler(acpi_sci_handler
- address,
- void *context))
-ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_remove_sci_handler(acpi_sci_handler
- address))
+ acpi_install_sci_handler(acpi_sci_handler
+ address,
+ void *context))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_install_global_event_handler
- (acpi_gbl_event_handler handler,
- void *context))
+ acpi_remove_sci_handler(acpi_sci_handler
+ address))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_install_fixed_event_handler(u32
- acpi_event,
- acpi_event_handler
- handler,
- void
- *context))
+ acpi_install_global_event_handler
+ (acpi_gbl_event_handler handler,
+ void *context))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_remove_fixed_event_handler(u32 acpi_event,
+ acpi_install_fixed_event_handler(u32
+ acpi_event,
acpi_event_handler
- handler))
-ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_install_gpe_handler(acpi_handle
- gpe_device,
- u32 gpe_number,
- u32 type,
- acpi_gpe_handler
- address,
- void *context))
+ handler,
+ void
+ *context))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_install_gpe_raw_handler(acpi_handle
- gpe_device,
- u32 gpe_number,
- u32 type,
- acpi_gpe_handler
- address,
- void *context))
+ acpi_remove_fixed_event_handler(u32 acpi_event,
+ acpi_event_handler
+ handler))
ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
- acpi_remove_gpe_handler(acpi_handle gpe_device,
+ acpi_install_gpe_handler(acpi_handle
+ gpe_device,
u32 gpe_number,
+ u32 type,
acpi_gpe_handler
- address))
-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_install_notify_handler(acpi_handle device,
- u32 handler_type,
- acpi_notify_handler
- handler,
+ address,
void *context))
+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
+ acpi_install_gpe_raw_handler(acpi_handle
+ gpe_device,
+ u32 gpe_number,
+ u32 type,
+ acpi_gpe_handler
+ address,
+ void *context))
+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
+ acpi_remove_gpe_handler(acpi_handle gpe_device,
+ u32 gpe_number,
+ acpi_gpe_handler
+ address))
ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_remove_notify_handler(acpi_handle device,
+ acpi_install_notify_handler(acpi_handle device,
u32 handler_type,
acpi_notify_handler
- handler))
-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_install_address_space_handler(acpi_handle
- device,
- acpi_adr_space_type
- space_id,
- acpi_adr_space_handler
- handler,
- acpi_adr_space_setup
- setup,
- void *context))
-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_remove_address_space_handler(acpi_handle
+ handler,
+ void *context))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_remove_notify_handler(acpi_handle device,
+ u32 handler_type,
+ acpi_notify_handler
+ handler))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_install_address_space_handler(acpi_handle
device,
acpi_adr_space_type
space_id,
acpi_adr_space_handler
- handler))
-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_install_exception_handler
- (acpi_exception_handler handler))
-ACPI_EXTERNAL_RETURN_STATUS(acpi_status
- acpi_install_interface_handler
- (acpi_interface_handler handler))
+ handler,
+ acpi_adr_space_setup
+ setup,
+ void *context))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_remove_address_space_handler(acpi_handle
+ device,
+ acpi_adr_space_type
+ space_id,
+ acpi_adr_space_handler
+ handler))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_install_exception_handler
+ (acpi_exception_handler handler))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_install_interface_handler
+ (acpi_interface_handler handler))
/*
* Global Lock interfaces
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 287/491] ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 286/491] ACPICA: include/acpi/acpixf.h: Fix indentation Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 288/491] ACPI: EC: Fix EC address space handler unregistration Greg Kroah-Hartman
` (208 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin, Johannes Penßel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 54c516aeb8b39eeae6450b7d8076d381568dca46 ]
ACPI-2.0 says that the EC op_region handler must be available immediately
(like the standard default op_region handlers):
Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
2. OSPM must make Embedded Controller operation regions, accessed via
the Embedded Controllers described in ECDT, available before executing
any control method. These operation regions may become inaccessible
after OSPM runs _REG(EmbeddedControl, 0)."
So the OS must probe the ECDT described EC and install the OpRegion handler
before calling acpi_enable_subsystem() and acpi_initialize_objects().
This is a problem because calling acpi_install_address_space_handler()
does not just install the op_region handler, it also runs the EC's _REG
method. This _REG method may rely on initialization done by the _INI
methods of one of the PCI / _SB root devices.
For the other early/default op_region handlers the op_region handler
install and the _REG execution is split into 2 separate steps:
1. acpi_ev_install_region_handlers(), called early from acpi_load_tables()
2. acpi_ev_initialize_op_regions(), called from acpi_initialize_objects()
To fix the EC op_region issue, add 2 bew functions:
1. acpi_install_address_space_handler_no_reg()
2. acpi_execute_reg_methods()
to allow doing things in 2 steps for other op_region handlers,
like the EC handler, too.
Note that the comment describing acpi_ev_install_region_handlers() even has
an alinea describing this problem. Using the new methods allows users
to avoid this problem.
Link: https://github.com/acpica/acpica/pull/786
Link: https://bugzilla.kernel.org/show_bug.cgi?id=214899
Reported-and-tested-by: Johannes Penßel <johannespenssel@posteo.net>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/evxfregn.c | 92 +++++++++++++++++++++++++++++++---
include/acpi/acpixf.h | 10 ++++
2 files changed, 95 insertions(+), 7 deletions(-)
diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c
index da97fd0c6b51e..12384b3cdd6ed 100644
--- a/drivers/acpi/acpica/evxfregn.c
+++ b/drivers/acpi/acpica/evxfregn.c
@@ -20,13 +20,14 @@ ACPI_MODULE_NAME("evxfregn")
/*******************************************************************************
*
- * FUNCTION: acpi_install_address_space_handler
+ * FUNCTION: acpi_install_address_space_handler_internal
*
* PARAMETERS: device - Handle for the device
* space_id - The address space ID
* handler - Address of the handler
* setup - Address of the setup function
* context - Value passed to the handler on each access
+ * Run_reg - Run _REG methods for this address space?
*
* RETURN: Status
*
@@ -37,13 +38,16 @@ ACPI_MODULE_NAME("evxfregn")
* are executed here, and these methods can only be safely executed after
* the default handlers have been installed and the hardware has been
* initialized (via acpi_enable_subsystem.)
+ * To avoid this problem pass FALSE for Run_Reg and later on call
+ * acpi_execute_reg_methods() to execute _REG.
*
******************************************************************************/
-acpi_status
-acpi_install_address_space_handler(acpi_handle device,
- acpi_adr_space_type space_id,
- acpi_adr_space_handler handler,
- acpi_adr_space_setup setup, void *context)
+static acpi_status
+acpi_install_address_space_handler_internal(acpi_handle device,
+ acpi_adr_space_type space_id,
+ acpi_adr_space_handler handler,
+ acpi_adr_space_setup setup,
+ void *context, u8 run_reg)
{
struct acpi_namespace_node *node;
acpi_status status;
@@ -80,14 +84,40 @@ acpi_install_address_space_handler(acpi_handle device,
/* Run all _REG methods for this address space */
- acpi_ev_execute_reg_methods(node, space_id, ACPI_REG_CONNECT);
+ if (run_reg) {
+ acpi_ev_execute_reg_methods(node, space_id, ACPI_REG_CONNECT);
+ }
unlock_and_exit:
(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
return_ACPI_STATUS(status);
}
+acpi_status
+acpi_install_address_space_handler(acpi_handle device,
+ acpi_adr_space_type space_id,
+ acpi_adr_space_handler handler,
+ acpi_adr_space_setup setup, void *context)
+{
+ return acpi_install_address_space_handler_internal(device, space_id,
+ handler, setup,
+ context, TRUE);
+}
+
ACPI_EXPORT_SYMBOL(acpi_install_address_space_handler)
+acpi_status
+acpi_install_address_space_handler_no_reg(acpi_handle device,
+ acpi_adr_space_type space_id,
+ acpi_adr_space_handler handler,
+ acpi_adr_space_setup setup,
+ void *context)
+{
+ return acpi_install_address_space_handler_internal(device, space_id,
+ handler, setup,
+ context, FALSE);
+}
+
+ACPI_EXPORT_SYMBOL(acpi_install_address_space_handler_no_reg)
/*******************************************************************************
*
@@ -226,3 +256,51 @@ acpi_remove_address_space_handler(acpi_handle device,
}
ACPI_EXPORT_SYMBOL(acpi_remove_address_space_handler)
+/*******************************************************************************
+ *
+ * FUNCTION: acpi_execute_reg_methods
+ *
+ * PARAMETERS: device - Handle for the device
+ * space_id - The address space ID
+ *
+ * RETURN: Status
+ *
+ * DESCRIPTION: Execute _REG for all op_regions of a given space_id.
+ *
+ ******************************************************************************/
+acpi_status
+acpi_execute_reg_methods(acpi_handle device, acpi_adr_space_type space_id)
+{
+ struct acpi_namespace_node *node;
+ acpi_status status;
+
+ ACPI_FUNCTION_TRACE(acpi_execute_reg_methods);
+
+ /* Parameter validation */
+
+ if (!device) {
+ return_ACPI_STATUS(AE_BAD_PARAMETER);
+ }
+
+ status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+ if (ACPI_FAILURE(status)) {
+ return_ACPI_STATUS(status);
+ }
+
+ /* Convert and validate the device handle */
+
+ node = acpi_ns_validate_handle(device);
+ if (node) {
+
+ /* Run all _REG methods for this address space */
+
+ acpi_ev_execute_reg_methods(node, space_id, ACPI_REG_CONNECT);
+ } else {
+ status = AE_BAD_PARAMETER;
+ }
+
+ (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+ return_ACPI_STATUS(status);
+}
+
+ACPI_EXPORT_SYMBOL(acpi_execute_reg_methods)
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index f9a86e3329715..890dbb8cc806a 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -650,6 +650,16 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
acpi_adr_space_setup
setup,
void *context))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_install_address_space_handler_no_reg
+ (acpi_handle device, acpi_adr_space_type space_id,
+ acpi_adr_space_handler handler,
+ acpi_adr_space_setup setup,
+ void *context))
+ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ acpi_execute_reg_methods(acpi_handle device,
+ acpi_adr_space_type
+ space_id))
ACPI_EXTERNAL_RETURN_STATUS(acpi_status
acpi_remove_address_space_handler(acpi_handle
device,
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 288/491] ACPI: EC: Fix EC address space handler unregistration
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 287/491] ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 289/491] ACPI: EC: Fix ECDT probe ordering issues Greg Kroah-Hartman
` (207 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Hans de Goede,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit a5072078dbfaa9d70130805766dfa34bbb7bf2a7 ]
When an ECDT table is present the EC address space handler gets registered
on the root node. So to unregister it properly the unregister call also
must be done on the root node.
Store the ACPI handle used for the acpi_install_address_space_handler()
call and use te same handle for the acpi_remove_address_space_handler()
call.
Reported-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/ec.c | 4 +++-
drivers/acpi/internal.h | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index b20206316fbe4..bf829ebc9afee 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1526,6 +1526,7 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)
return -ENODEV;
}
set_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
+ ec->address_space_handler_holder = ec->handle;
}
if (!device)
@@ -1577,7 +1578,8 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)
static void ec_remove_handlers(struct acpi_ec *ec)
{
if (test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
- if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
+ if (ACPI_FAILURE(acpi_remove_address_space_handler(
+ ec->address_space_handler_holder,
ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
pr_err("failed to remove space handler\n");
clear_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index f6c929787c9e6..4edf591f8a3a5 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -169,6 +169,7 @@ static inline void acpi_early_processor_osc(void) {}
-------------------------------------------------------------------------- */
struct acpi_ec {
acpi_handle handle;
+ acpi_handle address_space_handler_holder;
int gpe;
int irq;
unsigned long command_addr;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 289/491] ACPI: EC: Fix ECDT probe ordering issues
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 288/491] ACPI: EC: Fix EC address space handler unregistration Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root Greg Kroah-Hartman
` (206 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin, Johannes Penßel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit ab4620f58d38206687b9f99d9d2cc1d5a2640985 ]
ACPI-2.0 says that the EC OpRegion handler must be available immediately
(like the standard default OpRegion handlers):
Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
2. OSPM must make Embedded Controller operation regions, accessed via
the Embedded Controllers described in ECDT, available before executing
any control method. These operation regions may become inaccessible
after OSPM runs _REG(EmbeddedControl, 0)."
So acpi_bus_init() calls acpi_ec_ecdt_probe(), which calls
acpi_install_address_space_handler() to install the EC's OpRegion
handler, early on.
This not only installs the OpRegion handler, but also calls the EC's
_REG method. The _REG method call is a problem because it may rely on
initialization done by the _INI methods of one of the PCI / _SB root devs,
see for example: https://bugzilla.kernel.org/show_bug.cgi?id=214899 .
Generally speaking _REG methods are executed when the ACPI-device they
are part of has a driver bound to it. Where as _INI methods must be
executed at table load time (according to the spec). The problem here
is that the early acpi_install_address_space_handler() call causes
the _REG handler to run too early.
To allow fixing this the ACPICA code now allows to split the OpRegion
handler installation and the executing of _REG into 2 separate steps.
This commit uses this ACPICA functionality to fix the EC probe ordering
by delaying the executing of _REG for ECDT described ECs till the matching
EC device in the DSDT gets parsed and acpi_ec_add() for it gets called.
This moves the calling of _REG for the EC on devices with an ECDT to
the same point in time where it is called on devices without an ECDT table.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214899
Reported-and-tested-by: Johannes Penßel <johannespenssel@posteo.net>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/ec.c | 28 ++++++++++++++++++----------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index bf829ebc9afee..10f7e3ef58791 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -96,6 +96,7 @@ enum {
EC_FLAGS_QUERY_GUARDING, /* Guard for SCI_EVT check */
EC_FLAGS_EVENT_HANDLER_INSTALLED, /* Event handler installed */
EC_FLAGS_EC_HANDLER_INSTALLED, /* OpReg handler installed */
+ EC_FLAGS_EC_REG_CALLED, /* OpReg ACPI _REG method called */
EC_FLAGS_QUERY_METHODS_INSTALLED, /* _Qxx handlers installed */
EC_FLAGS_STARTED, /* Driver is started */
EC_FLAGS_STOPPED, /* Driver is stopped */
@@ -1497,6 +1498,7 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
* ec_install_handlers - Install service callbacks and register query methods.
* @ec: Target EC.
* @device: ACPI device object corresponding to @ec.
+ * @call_reg: If _REG should be called to notify OpRegion availability
*
* Install a handler for the EC address space type unless it has been installed
* already. If @device is not NULL, also look for EC query methods in the
@@ -1509,7 +1511,8 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
* -EPROBE_DEFER if GPIO IRQ acquisition needs to be deferred,
* or 0 (success) otherwise.
*/
-static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)
+static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
+ bool call_reg)
{
acpi_status status;
@@ -1517,10 +1520,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)
if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
acpi_ec_enter_noirq(ec);
- status = acpi_install_address_space_handler(ec->handle,
- ACPI_ADR_SPACE_EC,
- &acpi_ec_space_handler,
- NULL, ec);
+ status = acpi_install_address_space_handler_no_reg(ec->handle,
+ ACPI_ADR_SPACE_EC,
+ &acpi_ec_space_handler,
+ NULL, ec);
if (ACPI_FAILURE(status)) {
acpi_ec_stop(ec, false);
return -ENODEV;
@@ -1529,6 +1532,11 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)
ec->address_space_handler_holder = ec->handle;
}
+ if (call_reg && !test_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags)) {
+ acpi_execute_reg_methods(ec->handle, ACPI_ADR_SPACE_EC);
+ set_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags);
+ }
+
if (!device)
return 0;
@@ -1615,11 +1623,11 @@ static void ec_remove_handlers(struct acpi_ec *ec)
}
}
-static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device)
+static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool call_reg)
{
int ret;
- ret = ec_install_handlers(ec, device);
+ ret = ec_install_handlers(ec, device, call_reg);
if (ret)
return ret;
@@ -1681,7 +1689,7 @@ static int acpi_ec_add(struct acpi_device *device)
}
}
- ret = acpi_ec_setup(ec, device);
+ ret = acpi_ec_setup(ec, device, true);
if (ret)
goto err;
@@ -1801,7 +1809,7 @@ void __init acpi_ec_dsdt_probe(void)
* At this point, the GPE is not fully initialized, so do not to
* handle the events.
*/
- ret = acpi_ec_setup(ec, NULL);
+ ret = acpi_ec_setup(ec, NULL, true);
if (ret) {
acpi_ec_free(ec);
return;
@@ -1965,7 +1973,7 @@ void __init acpi_ec_ecdt_probe(void)
* At this point, the namespace is not initialized, so do not find
* the namespace objects, or handle the events.
*/
- ret = acpi_ec_setup(ec, NULL);
+ ret = acpi_ec_setup(ec, NULL, false);
if (ret) {
acpi_ec_free(ec);
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 289/491] ACPI: EC: Fix ECDT probe ordering issues Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 20:17 ` Ben Hutchings
2026-04-13 15:58 ` [PATCH 5.10 291/491] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Greg Kroah-Hartman
` (205 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, webcaptcha, Heikki Krogerus,
Rafael J. Wysocki, Hans de Goede, Mario Limonciello,
Andy Shevchenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 60fa6ae6e6d09e377fce6f8d9b6f6a4d88769f63 ]
It is reported that _DSM evaluation fails in ucsi_acpi_dsm() on Lenovo
IdeaPad Pro 5 due to a missing address space handler for the EC address
space:
ACPI Error: No handler for Region [ECSI] (000000007b8176ee) [EmbeddedControl] (20230628/evregion-130)
This happens because if there is no ECDT, the EC driver only registers
the EC address space handler for operation regions defined in the EC
device scope of the ACPI namespace while the operation region being
accessed by the _DSM in question is located beyond that scope.
To address this, modify the ACPI EC driver to install the EC address
space handler at the root of the ACPI namespace for the first EC that
can be found regardless of whether or not an ECDT is present.
Note that this change is consistent with some examples in the ACPI
specification in which EC operation regions located outside the EC
device scope are used (for example, see Section 9.17.15 in ACPI 6.5),
so the current behavior of the EC driver is arguably questionable.
Reported-by: webcaptcha <webcapcha@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218789
Link: https://uefi.org/specs/ACPI/6.5/09_ACPI_Defined_Devices_and_Device_Specific_Objects.html#example-asl-code
Link: https://lore.kernel.org/linux-acpi/Zi+0whTvDbAdveHq@kuha.fi.intel.com
Suggested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/ec.c | 25 ++++++++++++++++---------
drivers/acpi/internal.h | 1 -
2 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 10f7e3ef58791..1d7e7e47ea0e4 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1514,13 +1514,14 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
bool call_reg)
{
+ acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
acpi_status status;
acpi_ec_start(ec, false);
if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
acpi_ec_enter_noirq(ec);
- status = acpi_install_address_space_handler_no_reg(ec->handle,
+ status = acpi_install_address_space_handler_no_reg(scope_handle,
ACPI_ADR_SPACE_EC,
&acpi_ec_space_handler,
NULL, ec);
@@ -1529,11 +1530,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
return -ENODEV;
}
set_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
- ec->address_space_handler_holder = ec->handle;
}
if (call_reg && !test_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags)) {
- acpi_execute_reg_methods(ec->handle, ACPI_ADR_SPACE_EC);
+ acpi_execute_reg_methods(scope_handle, ACPI_ADR_SPACE_EC);
set_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags);
}
@@ -1585,10 +1585,13 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
static void ec_remove_handlers(struct acpi_ec *ec)
{
+ acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
+
if (test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
if (ACPI_FAILURE(acpi_remove_address_space_handler(
- ec->address_space_handler_holder,
- ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
+ scope_handle,
+ ACPI_ADR_SPACE_EC,
+ &acpi_ec_space_handler)))
pr_err("failed to remove space handler\n");
clear_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
}
@@ -1627,14 +1630,18 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca
{
int ret;
- ret = ec_install_handlers(ec, device, call_reg);
- if (ret)
- return ret;
-
/* First EC capable of handling transactions */
if (!first_ec)
first_ec = ec;
+ ret = ec_install_handlers(ec, device, call_reg);
+ if (ret) {
+ if (ec == first_ec)
+ first_ec = NULL;
+
+ return ret;
+ }
+
pr_info("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", ec->command_addr,
ec->data_addr);
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 4edf591f8a3a5..f6c929787c9e6 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -169,7 +169,6 @@ static inline void acpi_early_processor_osc(void) {}
-------------------------------------------------------------------------- */
struct acpi_ec {
acpi_handle handle;
- acpi_handle address_space_handler_holder;
int gpe;
int irq;
unsigned long command_addr;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 291/491] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 292/491] hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Greg Kroah-Hartman
` (204 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit f6484cadbcaf26b5844b51bd7307a663dda48ef6 ]
When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware
platforms, it has already started the EC and installed the address
space handler with the struct acpi_ec pointer as handler context.
However, acpi_ec_setup() propagates the error without any cleanup.
The caller acpi_ec_add() then frees the struct acpi_ec for non-boot
instances, leaving a dangling handler context in ACPICA.
Any subsequent AML evaluation that accesses an EC OpRegion field
dispatches into acpi_ec_space_handler() with the freed pointer,
causing a use-after-free:
BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)
Write of size 8 at addr ffff88800721de38 by task init/1
Call Trace:
<TASK>
mutex_lock (kernel/locking/mutex.c:289)
acpi_ec_space_handler (drivers/acpi/ec.c:1362)
acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)
acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)
acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)
acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)
acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)
acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)
</TASK>
Allocated by task 1:
acpi_ec_alloc (drivers/acpi/ec.c:1424)
acpi_ec_add (drivers/acpi/ec.c:1692)
Freed by task 1:
kfree (mm/slub.c:6876)
acpi_ec_add (drivers/acpi/ec.c:1751)
The bug triggers on reduced-hardware EC platforms (ec->gpe < 0)
when the GPIO IRQ provider defers probing. Once the stale handler
exists, any unprivileged sysfs read that causes AML to touch an
EC OpRegion (battery, thermal, backlight) exercises the dangling
pointer.
Fix this by calling ec_remove_handlers() in the error path of
acpi_ec_setup() before clearing first_ec. ec_remove_handlers()
checks each EC_FLAGS_* bit before acting, so it is safe to call
regardless of how far ec_install_handlers() progressed:
-ENODEV (handler not installed): only calls acpi_ec_stop()
-EPROBE_DEFER (handler installed): removes handler, stops EC
Fixes: 03e9a0e05739 ("ACPI: EC: Consolidate event handler installation code")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260324165458.1337233-2-bestswngs@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/ec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 1d7e7e47ea0e4..aaf0add0dc081 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1636,6 +1636,8 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca
ret = ec_install_handlers(ec, device, call_reg);
if (ret) {
+ ec_remove_handlers(ec);
+
if (ec == first_ec)
first_ec = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 292/491] hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 291/491] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 293/491] sysctl: fix uninitialized variable in proc_do_large_bitmap Greg Kroah-Hartman
` (203 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Nuno Sá,
Guenter Roeck, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
[ Upstream commit bf08749a6abb6d1959bfdc0edc32c640df407558 ]
The adm1177 driver exposes the current alert threshold through
hwmon_curr_max_alarm. This violates the hwmon sysfs ABI, where
*_alarm attributes are read-only status flags and writable thresholds
must use currN_max.
The driver also stores the threshold internally in microamps, while
currN_max is defined in milliamps. Convert the threshold accordingly
on both the read and write paths.
Widen the cached threshold and related calculations to 64 bits so
that small shunt resistor values do not cause truncation or overflow.
Also use 64-bit arithmetic for the mA/uA conversions, clamp writes
to the range the hardware can represent, and propagate failures from
adm1177_write_alert_thr() instead of silently ignoring them.
Update the hwmon documentation to reflect the attribute rename and
the correct units returned by the driver.
Fixes: 09b08ac9e8d5 ("hwmon: (adm1177) Add ADM1177 Hot Swap Controller and Digital Power Monitor driver")
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260325051246.28262-1-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/adm1177.rst | 8 ++---
drivers/hwmon/adm1177.c | 54 +++++++++++++++++++--------------
2 files changed, 35 insertions(+), 27 deletions(-)
diff --git a/Documentation/hwmon/adm1177.rst b/Documentation/hwmon/adm1177.rst
index 471be1e98d6f6..fc0c3390c302a 100644
--- a/Documentation/hwmon/adm1177.rst
+++ b/Documentation/hwmon/adm1177.rst
@@ -26,10 +26,10 @@ devices explicitly. Please see :doc:`/i2c/instantiating-devices` for details.
Sysfs entries
-------------
-The following attributes are supported. Current maxim attribute
+The following attributes are supported. Current maximum attribute
is read-write, all other attributes are read-only.
-in0_input Measured voltage in microvolts.
+in0_input Measured voltage in millivolts.
-curr1_input Measured current in microamperes.
-curr1_max_alarm Overcurrent alarm in microamperes.
+curr1_input Measured current in milliamperes.
+curr1_max Overcurrent shutdown threshold in milliamperes.
diff --git a/drivers/hwmon/adm1177.c b/drivers/hwmon/adm1177.c
index 6e8bb661894b9..1ddc95646f19a 100644
--- a/drivers/hwmon/adm1177.c
+++ b/drivers/hwmon/adm1177.c
@@ -10,6 +10,8 @@
#include <linux/hwmon.h>
#include <linux/i2c.h>
#include <linux/init.h>
+#include <linux/math64.h>
+#include <linux/minmax.h>
#include <linux/module.h>
#include <linux/regulator/consumer.h>
@@ -35,7 +37,7 @@ struct adm1177_state {
struct i2c_client *client;
struct regulator *reg;
u32 r_sense_uohm;
- u32 alert_threshold_ua;
+ u64 alert_threshold_ua;
bool vrange_high;
};
@@ -50,7 +52,7 @@ static int adm1177_write_cmd(struct adm1177_state *st, u8 cmd)
}
static int adm1177_write_alert_thr(struct adm1177_state *st,
- u32 alert_threshold_ua)
+ u64 alert_threshold_ua)
{
u64 val;
int ret;
@@ -93,8 +95,8 @@ static int adm1177_read(struct device *dev, enum hwmon_sensor_types type,
*val = div_u64((105840000ull * dummy),
4096 * st->r_sense_uohm);
return 0;
- case hwmon_curr_max_alarm:
- *val = st->alert_threshold_ua;
+ case hwmon_curr_max:
+ *val = div_u64(st->alert_threshold_ua, 1000);
return 0;
default:
return -EOPNOTSUPP;
@@ -128,9 +130,10 @@ static int adm1177_write(struct device *dev, enum hwmon_sensor_types type,
switch (type) {
case hwmon_curr:
switch (attr) {
- case hwmon_curr_max_alarm:
- adm1177_write_alert_thr(st, val);
- return 0;
+ case hwmon_curr_max:
+ val = clamp_val(val, 0,
+ div_u64(105840000ULL, st->r_sense_uohm));
+ return adm1177_write_alert_thr(st, (u64)val * 1000);
default:
return -EOPNOTSUPP;
}
@@ -158,7 +161,7 @@ static umode_t adm1177_is_visible(const void *data,
if (st->r_sense_uohm)
return 0444;
return 0;
- case hwmon_curr_max_alarm:
+ case hwmon_curr_max:
if (st->r_sense_uohm)
return 0644;
return 0;
@@ -172,7 +175,7 @@ static umode_t adm1177_is_visible(const void *data,
static const struct hwmon_channel_info *adm1177_info[] = {
HWMON_CHANNEL_INFO(curr,
- HWMON_C_INPUT | HWMON_C_MAX_ALARM),
+ HWMON_C_INPUT | HWMON_C_MAX),
HWMON_CHANNEL_INFO(in,
HWMON_I_INPUT),
NULL
@@ -201,7 +204,8 @@ static int adm1177_probe(struct i2c_client *client)
struct device *dev = &client->dev;
struct device *hwmon_dev;
struct adm1177_state *st;
- u32 alert_threshold_ua;
+ u64 alert_threshold_ua;
+ u32 prop;
int ret;
st = devm_kzalloc(dev, sizeof(*st), GFP_KERNEL);
@@ -229,22 +233,26 @@ static int adm1177_probe(struct i2c_client *client)
if (device_property_read_u32(dev, "shunt-resistor-micro-ohms",
&st->r_sense_uohm))
st->r_sense_uohm = 0;
- if (device_property_read_u32(dev, "adi,shutdown-threshold-microamp",
- &alert_threshold_ua)) {
- if (st->r_sense_uohm)
- /*
- * set maximum default value from datasheet based on
- * shunt-resistor
- */
- alert_threshold_ua = div_u64(105840000000,
- st->r_sense_uohm);
- else
- alert_threshold_ua = 0;
+ if (!device_property_read_u32(dev, "adi,shutdown-threshold-microamp",
+ &prop)) {
+ alert_threshold_ua = prop;
+ } else if (st->r_sense_uohm) {
+ /*
+ * set maximum default value from datasheet based on
+ * shunt-resistor
+ */
+ alert_threshold_ua = div_u64(105840000000ULL,
+ st->r_sense_uohm);
+ } else {
+ alert_threshold_ua = 0;
}
st->vrange_high = device_property_read_bool(dev,
"adi,vrange-high-enable");
- if (alert_threshold_ua && st->r_sense_uohm)
- adm1177_write_alert_thr(st, alert_threshold_ua);
+ if (alert_threshold_ua && st->r_sense_uohm) {
+ ret = adm1177_write_alert_thr(st, alert_threshold_ua);
+ if (ret)
+ return ret;
+ }
ret = adm1177_write_cmd(st, ADM1177_CMD_V_CONT |
ADM1177_CMD_I_CONT |
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 293/491] sysctl: fix uninitialized variable in proc_do_large_bitmap
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 292/491] hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 294/491] spi: spi-fsl-lpspi: fix teardown order issue (UAF) Greg Kroah-Hartman
` (202 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Buerg, Joel Granados,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Buerg <buermarc@googlemail.com>
[ Upstream commit f63a9df7e3f9f842945d292a19d9938924f066f9 ]
proc_do_large_bitmap() does not initialize variable c, which is expected
to be set to a trailing character by proc_get_long().
However, proc_get_long() only sets c when the input buffer contains a
trailing character after the parsed value.
If c is not initialized it may happen to contain a '-'. If this is the
case proc_do_large_bitmap() expects to be able to parse a second part of
the input buffer. If there is no second part an unjustified -EINVAL will
be returned.
Initialize c to 0 to prevent returning -EINVAL on valid input.
Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap")
Signed-off-by: Marc Buerg <buermarc@googlemail.com>
Reviewed-by: Joel Granados <joel.granados@kernel.org>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sysctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index abe0f16d53641..c2870c9cae14a 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1549,7 +1549,7 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,
unsigned long bitmap_len = table->maxlen;
unsigned long *bitmap = *(unsigned long **) table->data;
unsigned long *tmp_bitmap = NULL;
- char tr_a[] = { '-', ',', '\n' }, tr_b[] = { ',', '\n', 0 }, c;
+ char tr_a[] = { '-', ',', '\n' }, tr_b[] = { ',', '\n', 0 }, c = 0;
if (!bitmap || !bitmap_len || !left || (*ppos && !write)) {
*lenp = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 294/491] spi: spi-fsl-lpspi: fix teardown order issue (UAF)
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 293/491] sysctl: fix uninitialized variable in proc_do_large_bitmap Greg Kroah-Hartman
@ 2026-04-13 15:58 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 295/491] s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman
` (201 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit b341c1176f2e001b3adf0b47154fc31589f7410e ]
There is a teardown order issue in the driver. The SPI controller is
registered using devm_spi_register_controller(), which delays
unregistration of the SPI controller until after the fsl_lpspi_remove()
function returns.
As the fsl_lpspi_remove() function synchronously tears down the DMA
channels, a running SPI transfer triggers the following NULL pointer
dereference due to use after free:
| fsl_lpspi 42550000.spi: I/O Error in DMA RX
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[...]
| Call trace:
| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]
| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]
| spi_transfer_one_message+0x49c/0x7c8
| __spi_pump_transfer_message+0x120/0x420
| __spi_sync+0x2c4/0x520
| spi_sync+0x34/0x60
| spidev_message+0x20c/0x378 [spidev]
| spidev_ioctl+0x398/0x750 [spidev]
[...]
Switch from devm_spi_register_controller() to spi_register_controller() in
fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in
fsl_lpspi_remove().
Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-fixes-v1-1-b433e435b2d8@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-fsl-lpspi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -914,7 +914,7 @@ static int fsl_lpspi_probe(struct platfo
enable_irq(irq);
}
- ret = devm_spi_register_controller(&pdev->dev, controller);
+ ret = spi_register_controller(controller);
if (ret < 0) {
dev_err_probe(&pdev->dev, ret, "spi_register_controller error\n");
goto free_dma;
@@ -943,6 +943,7 @@ static int fsl_lpspi_remove(struct platf
struct fsl_lpspi_data *fsl_lpspi =
spi_controller_get_devdata(controller);
+ spi_unregister_controller(controller);
fsl_lpspi_dma_exit(controller);
pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 295/491] s390/barrier: Make array_index_mask_nospec() __always_inline
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-04-13 15:58 ` [PATCH 5.10 294/491] spi: spi-fsl-lpspi: fix teardown order issue (UAF) Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 296/491] can: gw: fix OOB heap access in cgw_csum_crc8_rel() Greg Kroah-Hartman
` (200 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ilya Leoshkevich,
Vasily Gorbik
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <gor@linux.ibm.com>
commit c5c0a268b38adffbb2e70e6957017537ff54c157 upstream.
Mark array_index_mask_nospec() as __always_inline to guarantee the
mitigation is emitted inline regardless of compiler inlining decisions.
Fixes: e2dd833389cc ("s390: add optimized array_index_mask_nospec")
Cc: stable@kernel.org
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/barrier.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/include/asm/barrier.h
+++ b/arch/s390/include/asm/barrier.h
@@ -56,8 +56,8 @@ do { \
* @size: number of elements in array
*/
#define array_index_mask_nospec array_index_mask_nospec
-static inline unsigned long array_index_mask_nospec(unsigned long index,
- unsigned long size)
+static __always_inline unsigned long array_index_mask_nospec(unsigned long index,
+ unsigned long size)
{
unsigned long mask;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 296/491] can: gw: fix OOB heap access in cgw_csum_crc8_rel()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 295/491] s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 297/491] cpufreq: conservative: Reset requested_freq on limits change Greg Kroah-Hartman
` (199 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Norouzi, Oliver Hartkopp,
Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Norouzi <ali.norouzi@keysight.com>
commit b9c310d72783cc2f30d103eed83920a5a29c671a upstream.
cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():
int from = calc_idx(crc8->from_idx, cf->len);
int to = calc_idx(crc8->to_idx, cf->len);
int res = calc_idx(crc8->result_idx, cf->len);
if (from < 0 || to < 0 || res < 0)
return;
However, the loop and the result write then use the raw s8 fields directly
instead of the computed variables:
for (i = crc8->from_idx; ...) /* BUG: raw negative index */
cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */
With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,
calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with
i = -64, reading cf->data[-64], and the write goes to cf->data[-64].
This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the
start of the canfd_frame on the heap.
The companion function cgw_csum_xor_rel() uses `from`/`to`/`res`
correctly throughout; fix cgw_csum_crc8_rel() to match.
Confirmed with KASAN on linux-7.0-rc2:
BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0
Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62
To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
Fixes: 456a8a646b25 ("can: gw: add support for CAN FD frames")
Cc: stable@vger.kernel.org
Reported-by: Ali Norouzi <ali.norouzi@keysight.com>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Ali Norouzi <ali.norouzi@keysight.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-1-c45d52c6d2d8@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/gw.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -312,10 +312,10 @@ static void cgw_csum_crc8_rel(struct can
return;
if (from <= to) {
- for (i = crc8->from_idx; i <= crc8->to_idx; i++)
+ for (i = from; i <= to; i++)
crc = crc8->crctab[crc ^ cf->data[i]];
} else {
- for (i = crc8->from_idx; i >= crc8->to_idx; i--)
+ for (i = from; i >= to; i--)
crc = crc8->crctab[crc ^ cf->data[i]];
}
@@ -334,7 +334,7 @@ static void cgw_csum_crc8_rel(struct can
break;
}
- cf->data[crc8->result_idx] = crc ^ crc8->final_xor_val;
+ cf->data[res] = crc ^ crc8->final_xor_val;
}
static void cgw_csum_crc8_pos(struct canfd_frame *cf,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 297/491] cpufreq: conservative: Reset requested_freq on limits change
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 296/491] can: gw: fix OOB heap access in cgw_csum_crc8_rel() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 298/491] media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Greg Kroah-Hartman
` (198 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lifeng Zheng, Viresh Kumar,
Zhongqiu Han, Rafael J. Wysocki
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 upstream.
A recently reported issue highlighted that the cached requested_freq
is not guaranteed to stay in sync with policy->cur. If the platform
changes the actual CPU frequency after the governor sets one (e.g.
due to platform-specific frequency scaling) and a re-sync occurs
later, policy->cur may diverge from requested_freq.
This can lead to incorrect behavior in the conservative governor.
For example, the governor may assume the CPU is already running at
the maximum frequency and skip further increases even though there
is still headroom.
Avoid this by resetting the cached requested_freq to policy->cur on
detecting a change in policy limits.
Reported-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Tested-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://lore.kernel.org/all/20260210115458.3493646-1-zhenglifeng1@huawei.com/
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/d846a141a98ac0482f20560fcd7525c0f0ec2f30.1773999467.git.viresh.kumar@linaro.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq_conservative.c | 12 ++++++++++++
drivers/cpufreq/cpufreq_governor.c | 3 +++
drivers/cpufreq/cpufreq_governor.h | 1 +
3 files changed, 16 insertions(+)
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -311,6 +311,17 @@ static void cs_start(struct cpufreq_poli
dbs_info->requested_freq = policy->cur;
}
+static void cs_limits(struct cpufreq_policy *policy)
+{
+ struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy->governor_data);
+
+ /*
+ * The limits have changed, so may have the current frequency. Reset
+ * requested_freq to avoid any unintended outcomes due to the mismatch.
+ */
+ dbs_info->requested_freq = policy->cur;
+}
+
static struct dbs_governor cs_governor = {
.gov = CPUFREQ_DBS_GOVERNOR_INITIALIZER("conservative"),
.kobj_type = { .default_attrs = cs_attributes },
@@ -320,6 +331,7 @@ static struct dbs_governor cs_governor =
.init = cs_init,
.exit = cs_exit,
.start = cs_start,
+ .limits = cs_limits,
};
#define CPU_FREQ_GOV_CONSERVATIVE (cs_governor.gov)
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -555,6 +555,7 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_s
void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy)
{
+ struct dbs_governor *gov = dbs_governor_of(policy);
struct policy_dbs_info *policy_dbs;
/* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
@@ -566,6 +567,8 @@ void cpufreq_dbs_governor_limits(struct
mutex_lock(&policy_dbs->update_mutex);
cpufreq_policy_apply_limits(policy);
gov_update_sample_delay(policy_dbs, 0);
+ if (gov->limits)
+ gov->limits(policy);
mutex_unlock(&policy_dbs->update_mutex);
out:
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -139,6 +139,7 @@ struct dbs_governor {
int (*init)(struct dbs_data *dbs_data);
void (*exit)(struct dbs_data *dbs_data);
void (*start)(struct cpufreq_policy *policy);
+ void (*limits)(struct cpufreq_policy *policy);
};
static inline struct dbs_governor *dbs_governor_of(struct cpufreq_policy *policy)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 298/491] media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 297/491] cpufreq: conservative: Reset requested_freq on limits change Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 299/491] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Greg Kroah-Hartman
` (197 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuchan Nam, Sakari Ailus,
Mauro Carvalho Chehab
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchan Nam <entropy1110@gmail.com>
commit bef4f4a88b73e4cc550d25f665b8a9952af22773 upstream.
MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)
queue teardown paths. This can race request object cleanup against vb2
queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with
req_queue_mutex. Extend that serialization to REQBUFS, and also take
the same mutex in media_request_ioctl_reinit() so REINIT is in the
same exclusion domain.
This keeps request cleanup and queue cancellation from running in
parallel for request-capable devices.
Fixes: 6093d3002eab ("media: vb2: keep a reference to the request until dqbuf")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchan Nam <entropy1110@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/mc/mc-request.c | 5 +++++
drivers/media/v4l2-core/v4l2-ioctl.c | 5 +++--
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/media/mc/mc-request.c
+++ b/drivers/media/mc/mc-request.c
@@ -190,6 +190,8 @@ static long media_request_ioctl_reinit(s
struct media_device *mdev = req->mdev;
unsigned long flags;
+ mutex_lock(&mdev->req_queue_mutex);
+
spin_lock_irqsave(&req->lock, flags);
if (req->state != MEDIA_REQUEST_STATE_IDLE &&
req->state != MEDIA_REQUEST_STATE_COMPLETE) {
@@ -197,6 +199,7 @@ static long media_request_ioctl_reinit(s
"request: %s not in idle or complete state, cannot reinit\n",
req->debug_str);
spin_unlock_irqrestore(&req->lock, flags);
+ mutex_unlock(&mdev->req_queue_mutex);
return -EBUSY;
}
if (req->access_count) {
@@ -204,6 +207,7 @@ static long media_request_ioctl_reinit(s
"request: %s is being accessed, cannot reinit\n",
req->debug_str);
spin_unlock_irqrestore(&req->lock, flags);
+ mutex_unlock(&mdev->req_queue_mutex);
return -EBUSY;
}
req->state = MEDIA_REQUEST_STATE_CLEANING;
@@ -214,6 +218,7 @@ static long media_request_ioctl_reinit(s
spin_lock_irqsave(&req->lock, flags);
req->state = MEDIA_REQUEST_STATE_IDLE;
spin_unlock_irqrestore(&req->lock, flags);
+ mutex_unlock(&mdev->req_queue_mutex);
return 0;
}
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2963,13 +2963,14 @@ static long __video_do_ioctl(struct file
vfh = file->private_data;
/*
- * We need to serialize streamon/off with queueing new requests.
+ * We need to serialize streamon/off/reqbufs with queueing new requests.
* These ioctls may trigger the cancellation of a streaming
* operation, and that should not be mixed with queueing a new
* request at the same time.
*/
if (v4l2_device_supports_requests(vfd->v4l2_dev) &&
- (cmd == VIDIOC_STREAMON || cmd == VIDIOC_STREAMOFF)) {
+ (cmd == VIDIOC_STREAMON || cmd == VIDIOC_STREAMOFF ||
+ cmd == VIDIOC_REQBUFS)) {
req_queue_lock = &vfd->v4l2_dev->mdev->req_queue_mutex;
if (mutex_lock_interruptible(req_queue_lock))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 299/491] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 298/491] media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 300/491] alarmtimer: Fix argument order in alarm_timer_forward() Greg Kroah-Hartman
` (196 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, xietangxin, Xuan Zhuo,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: xietangxin <xietangxin@yeah.net>
commit ba8bda9a0896746053aa97ac6c3e08168729172c upstream.
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit() is triggered to clean up old skbs.
It then calls dst_release() on the skb associated with the stale dst_entry.
Since the dst_ops (referenced by the dst_entry) has already been freed,
a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
the dst reference before the skb is queued in virtio_net.
Call Trace:
Unable to handle kernel paging request at virtual address ffff80007e150000
CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
...
percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
dst_release+0xe0/0x110 net/core/dst.c:177
skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
__free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add dev $NETDEV parent 1:0 \
protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2
test_ns
Fixes: f2fc6a54585a ("[NETNS][IPV6] route6 - move ip6_dst_ops inside the network namespace")
Cc: stable@vger.kernel.org
Signed-off-by: xietangxin <xietangxin@yeah.net>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Fixes: 0287587884b1 ("net: better IFF_XMIT_DST_RELEASE support")
Link: https://patch.msgid.link/20260312025406.15641-1-xietangxin@yeah.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/virtio_net.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1740,6 +1740,7 @@ static netdev_tx_t start_xmit(struct sk_
/* Don't wait up for transmitted skbs to be freed. */
if (!use_napi) {
skb_orphan(skb);
+ skb_dst_drop(skb);
nf_reset_ct(skb);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 300/491] alarmtimer: Fix argument order in alarm_timer_forward()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 299/491] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 301/491] scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Greg Kroah-Hartman
` (195 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit 5d16467ae56343b9205caedf85e3a131e0914ad8 upstream.
alarm_timer_forward() passes arguments to alarm_forward() in the wrong
order:
alarm_forward(alarm, timr->it_interval, now);
However, alarm_forward() is defined as:
u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
and uses the second argument as the current time:
delta = ktime_sub(now, alarm->node.expires);
Passing the interval as "now" results in incorrect delta computation,
which can lead to missed expirations or incorrect overrun accounting.
This issue has been present since the introduction of
alarm_timer_forward().
Fix this by swapping the arguments.
Fixes: e7561f1633ac ("alarmtimer: Implement forward callback")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260323061130.29991-1-zhanxusheng@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/alarmtimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -606,7 +606,7 @@ static s64 alarm_timer_forward(struct k_
{
struct alarm *alarm = &timr->it.alarm.alarmtimer;
- return alarm_forward(alarm, timr->it_interval, now);
+ return alarm_forward(alarm, now, timr->it_interval);
}
/**
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 301/491] scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 300/491] alarmtimer: Fix argument order in alarm_timer_forward() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 302/491] scsi: ses: Handle positive SCSI error from ses_recv_diag() Greg Kroah-Hartman
` (194 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Tyllis Xu,
Dave Marquardt, Tyrel Datwyler, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyllis Xu <livelycarpet87@gmail.com>
commit 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f upstream.
A malicious or compromised VIO server can return a num_written value in the
discover targets MAD response that exceeds max_targets. This value is
stored directly in vhost->num_targets without validation, and is then used
as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which
is only allocated for max_targets entries. Indices at or beyond max_targets
access kernel memory outside the DMA-coherent allocation. The
out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI
MADs that are sent back to the VIO server, leaking kernel memory.
Fix by clamping num_written to max_targets before storing it.
Fixes: 072b91f9c651 ("[SCSI] ibmvfc: IBM Power Virtual Fibre Channel Adapter Client Driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
Reviewed-by: Dave Marquardt <davemarq@linux.ibm.com>
Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Link: https://patch.msgid.link/20260314170151.548614-1-LivelyCarpet87@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ibmvscsi/ibmvfc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4238,7 +4238,8 @@ static void ibmvfc_discover_targets_done
switch (mad_status) {
case IBMVFC_MAD_SUCCESS:
ibmvfc_dbg(vhost, "Discover Targets succeeded\n");
- vhost->num_targets = be32_to_cpu(rsp->num_written);
+ vhost->num_targets = min_t(u32, be32_to_cpu(rsp->num_written),
+ max_targets);
ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS);
break;
case IBMVFC_MAD_FAILED:
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 302/491] scsi: ses: Handle positive SCSI error from ses_recv_diag()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 301/491] scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 303/491] jbd2: gracefully abort on checkpointing state corruptions Greg Kroah-Hartman
` (193 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James E.J. Bottomley,
Martin K. Petersen, stable, Hannes Reinecke
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7a9f448d44127217fabc4065c5ba070d4e0b5d37 upstream.
ses_recv_diag() can return a positive value, which also means that an
error happened, so do not only test for negative values.
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://patch.msgid.link/2026022301-bony-overstock-a07f@gregkh
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -184,7 +184,7 @@ static unsigned char *ses_get_page2_desc
unsigned char *type_ptr = ses_dev->page1_types;
unsigned char *desc_ptr = ses_dev->page2 + 8;
- if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len) < 0)
+ if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len))
return NULL;
for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 303/491] jbd2: gracefully abort on checkpointing state corruptions
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 302/491] scsi: ses: Handle positive SCSI error from ses_recv_diag() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 304/491] ext4: convert inline data to extents when truncate exceeds inline size Greg Kroah-Hartman
` (192 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Milos Nikic, Andreas Dilger,
Zhang Yi, Baokun Li, Jan Kara, Theodore Tso, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milos Nikic <nikic.milos@gmail.com>
commit bac3190a8e79beff6ed221975e0c9b1b5f2a21da upstream.
This patch targets two internal state machine invariants in checkpoint.c
residing inside functions that natively return integer error codes.
- In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely
corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE
and a graceful journal abort, returning -EFSCORRUPTED.
- In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for
an unexpected buffer_jwrite state. If the warning triggers, we
explicitly drop the just-taken get_bh() reference and call __flush_batch()
to safely clean up any previously queued buffers in the j_chkpt_bhs array,
preventing a memory leak before returning -EFSCORRUPTED.
Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260311041548.159424-1-nikic.milos@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/checkpoint.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -303,7 +303,15 @@ restart:
*/
BUFFER_TRACE(bh, "queue");
get_bh(bh);
- J_ASSERT_BH(bh, !buffer_jwrite(bh));
+ if (WARN_ON_ONCE(buffer_jwrite(bh))) {
+ put_bh(bh); /* drop the ref we just took */
+ spin_unlock(&journal->j_list_lock);
+ /* Clean up any previously batched buffers */
+ if (batch_count)
+ __flush_batch(journal, &batch_count);
+ jbd2_journal_abort(journal, -EFSCORRUPTED);
+ return -EFSCORRUPTED;
+ }
journal->j_chkpt_bhs[batch_count++] = bh;
transaction->t_chp_stats.cs_written++;
transaction->t_checkpoint_list = jh->b_cpnext;
@@ -361,7 +369,10 @@ int jbd2_cleanup_journal_tail(journal_t
if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
return 1;
- J_ASSERT(blocknr != 0);
+ if (WARN_ON_ONCE(blocknr == 0)) {
+ jbd2_journal_abort(journal, -EFSCORRUPTED);
+ return -EFSCORRUPTED;
+ }
/*
* We need to make sure that any blocks that were recently written out
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 304/491] ext4: convert inline data to extents when truncate exceeds inline size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 303/491] jbd2: gracefully abort on checkpointing state corruptions Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 305/491] ext4: make recently_deleted() properly work with lazy itable initialization Greg Kroah-Hartman
` (191 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7de5fe447862fc37576f,
Deepanshu Kartikey, Theodore Tso, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 upstream.
Add a check in ext4_setattr() to convert files from inline data storage
to extent-based storage when truncate() grows the file size beyond the
inline capacity. This prevents the filesystem from entering an
inconsistent state where the inline data flag is set but the file size
exceeds what can be stored inline.
Without this fix, the following sequence causes a kernel BUG_ON():
1. Mount filesystem with inode that has inline flag set and small size
2. truncate(file, 50MB) - grows size but inline flag remains set
3. sendfile() attempts to write data
4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
The crash occurs because ext4_write_inline_data() expects inline storage
to accommodate the write, but the actual inline capacity (~60 bytes for
i_block + ~96 bytes for xattrs) is far smaller than the file size and
write request.
The fix checks if the new size from setattr exceeds the inode's actual
inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to
extent-based storage before proceeding with the size change.
This addresses the root cause by ensuring the inline data flag and file
size remain consistent during truncate operations.
Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f
Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
Link: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5576,6 +5576,18 @@ int ext4_setattr(struct dentry *dentry,
if (IS_I_VERSION(inode) && attr->ia_size != inode->i_size)
inode_inc_iversion(inode);
+ /*
+ * If file has inline data but new size exceeds inline capacity,
+ * convert to extent-based storage first to prevent inconsistent
+ * state (inline flag set but size exceeds inline capacity).
+ */
+ if (ext4_has_inline_data(inode) &&
+ attr->ia_size > EXT4_I(inode)->i_inline_size) {
+ error = ext4_convert_inline_data(inode);
+ if (error)
+ goto err_out;
+ }
+
if (shrink) {
if (ext4_should_order_data(inode)) {
error = ext4_begin_ordered_truncate(inode,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 305/491] ext4: make recently_deleted() properly work with lazy itable initialization
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 304/491] ext4: convert inline data to extents when truncate exceeds inline size Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 306/491] ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
` (190 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Zhang Yi, Theodore Tso,
stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit bd060afa7cc3e0ad30afa9ecc544a78638498555 upstream.
recently_deleted() checks whether inode has been used in the near past.
However this can give false positive result when inode table is not
initialized yet and we are in fact comparing to random garbage (or stale
itable block of a filesystem before mkfs). Ultimately this results in
uninitialized inodes being skipped during inode allocation and possibly
they are never initialized and thus e2fsck complains. Verify if the
inode has been initialized before checking for dtime.
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260216164848.3074-3-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ialloc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -686,6 +686,12 @@ static int recently_deleted(struct super
if (unlikely(!gdp))
return 0;
+ /* Inode was never used in this filesystem? */
+ if (ext4_has_group_desc_csum(sb) &&
+ (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT) ||
+ ino >= EXT4_INODES_PER_GROUP(sb) - ext4_itable_unused_count(sb, gdp)))
+ return 0;
+
bh = sb_find_get_block(sb, ext4_inode_table(sb, gdp) +
(ino / inodes_per_block));
if (!bh || !buffer_uptodate(bh))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 306/491] ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 305/491] ext4: make recently_deleted() properly work with lazy itable initialization Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 307/491] ext4: reject mount if bigalloc with s_first_data_block != 0 Greg Kroah-Hartman
` (189 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ye Bin, Ritesh Harjani (IBM),
Zhang Yi, Andreas Dilger, Jan Kara, Theodore Tso, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <yebin10@huawei.com>
commit 46066e3a06647c5b186cc6334409722622d05c44 upstream.
There's issue as follows:
...
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): error count since last fsck: 1
EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760
EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
...
According to the log analysis, blocks are always requested from the
corrupted block group. This may happen as follows:
ext4_mb_find_by_goal
ext4_mb_load_buddy
ext4_mb_load_buddy_gfp
ext4_mb_init_cache
ext4_read_block_bitmap_nowait
ext4_wait_block_bitmap
ext4_validate_block_bitmap
if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
return -EFSCORRUPTED; // There's no logs.
if (err)
return err; // Will return error
ext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
goto out;
After commit 9008a58e5dce ("ext4: make the bitmap read routines return
real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group
as corrupt on block bitmap error") is no real solution for allocating
blocks from corrupted block groups. This is because if
'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then
'ext4_mb_load_buddy()' may return an error. This means that the block
allocation will fail.
Therefore, check block group if corrupted when ext4_mb_load_buddy()
returns error.
Fixes: 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error")
Fixes: 9008a58e5dce ("ext4: make the bitmap read routines return real error codes")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260302134619.3145520-1-yebin@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1929,8 +1929,12 @@ int ext4_mb_find_by_goal(struct ext4_all
return 0;
err = ext4_mb_load_buddy(ac->ac_sb, group, e4b);
- if (err)
+ if (err) {
+ if (EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info) &&
+ !(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY))
+ return 0;
return err;
+ }
ext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 307/491] ext4: reject mount if bigalloc with s_first_data_block != 0
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 306/491] ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 308/491] phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Greg Kroah-Hartman
` (188 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Helen Koike, Theodore Tso,
syzbot+b73703b873a33d8eb8f6, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <koike@igalia.com>
commit 3822743dc20386d9897e999dbb990befa3a5b3f8 upstream.
bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.
Signed-off-by: Helen Koike <koike@igalia.com>
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: syzbot+b73703b873a33d8eb8f6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b73703b873a33d8eb8f6
Link: https://patch.msgid.link/20260317142325.135074-1-koike@igalia.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3369,6 +3369,13 @@ static int ext4_feature_set_ok(struct su
"extents feature\n");
return 0;
}
+ if (ext4_has_feature_bigalloc(sb) &&
+ le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+ ext4_msg(sb, KERN_WARNING,
+ "bad geometry: bigalloc file system with non-zero "
+ "first_data_block\n");
+ return 0;
+ }
#if !IS_ENABLED(CONFIG_QUOTA) || !IS_ENABLED(CONFIG_QFMT_V2)
if (!readonly && (ext4_has_feature_quota(sb) ||
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 308/491] phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 307/491] ext4: reject mount if bigalloc with s_first_data_block != 0 Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 309/491] dmaengine: xilinx: xilinx_dma: Fix dma_device directions Greg Kroah-Hartman
` (187 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Felix Gu,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 584b457f4166293bdfa50f930228e9fb91a38392 ]
The serdes device_node is obtained using of_get_child_by_name(),
which increments the reference count. However, it is never put,
leading to a reference leak.
Add the missing of_node_put() calls to ensure the reference count is
properly balanced.
Fixes: 7ae14cf581f2 ("phy: ti: j721e-wiz: Implement DisplayPort mode to the wiz driver")
Suggested-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20260212-wiz-v2-1-6e8bd4cc7a4a@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/ti/phy-j721e-wiz.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
index 5536b8f4bfd13..3c0aec368ea9f 100644
--- a/drivers/phy/ti/phy-j721e-wiz.c
+++ b/drivers/phy/ti/phy-j721e-wiz.c
@@ -799,6 +799,7 @@ static int wiz_get_lane_phy_types(struct device *dev, struct wiz *wiz)
dev_err(dev,
"%s: Reading \"reg\" from \"%s\" failed: %d\n",
__func__, subnode->name, ret);
+ of_node_put(serdes);
return ret;
}
of_property_read_u32(subnode, "cdns,num-lanes", &num_lanes);
@@ -811,6 +812,7 @@ static int wiz_get_lane_phy_types(struct device *dev, struct wiz *wiz)
wiz->lane_phy_type[i] = phy_type;
}
+ of_node_put(serdes);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 309/491] dmaengine: xilinx: xilinx_dma: Fix dma_device directions
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 308/491] phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 310/491] dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Greg Kroah-Hartman
` (186 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
[ Upstream commit e9cc95397bb7da13fe8a5b53a2f23cfaf9018ade ]
Unlike chan->direction , struct dma_device .directions field is a
bitfield. Turn chan->direction into a bitfield to make it compatible
with struct dma_device .directions .
Fixes: 7e01511443c3 ("dmaengine: xilinx_dma: Set dma_device directions")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Link: https://patch.msgid.link/20260316221728.160139-1-marex@nabladev.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 12e9ba5b114db..0d0f3df71245d 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -2845,7 +2845,7 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
return -EINVAL;
}
- xdev->common.directions |= chan->direction;
+ xdev->common.directions |= BIT(chan->direction);
/* Request the interrupt */
chan->irq = irq_of_parse_and_map(node, chan->tdest);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 310/491] dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 309/491] dmaengine: xilinx: xilinx_dma: Fix dma_device directions Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Greg Kroah-Hartman
` (185 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
[ Upstream commit f61d145999d61948a23cd436ebbfa4c3b9ab8987 ]
The cyclic DMA calculation is currently entirely broken and reports
residue only for the first segment. The problem is twofold.
First, when the first descriptor finishes, it is moved from active_list
to done_list, but it is never returned back into the active_list. The
xilinx_dma_tx_status() expects the descriptor to be in the active_list
to report any meaningful residue information, which never happens after
the first descriptor finishes. Fix this up in xilinx_dma_start_transfer()
and if the descriptor is cyclic, lift it from done_list and place it back
into active_list list.
Second, the segment .status fields of the descriptor remain dirty. Once
the DMA did one pass on the descriptor, the .status fields are populated
with data by the DMA, but the .status fields are not cleared before reuse
during the next cyclic DMA round. The xilinx_dma_get_residue() recognizes
that as if the descriptor was complete and had 0 residue, which is bogus.
Reinitialize the status field before placing the descriptor back into the
active_list.
Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Link: https://patch.msgid.link/20260316221943.160375-1-marex@nabladev.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 0d0f3df71245d..ca80a1dee8489 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -1514,8 +1514,29 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
if (chan->err)
return;
- if (list_empty(&chan->pending_list))
+ if (list_empty(&chan->pending_list)) {
+ if (chan->cyclic) {
+ struct xilinx_dma_tx_descriptor *desc;
+ struct list_head *entry;
+
+ desc = list_last_entry(&chan->done_list,
+ struct xilinx_dma_tx_descriptor, node);
+ list_for_each(entry, &desc->segments) {
+ struct xilinx_axidma_tx_segment *axidma_seg;
+ struct xilinx_axidma_desc_hw *axidma_hw;
+ axidma_seg = list_entry(entry,
+ struct xilinx_axidma_tx_segment,
+ node);
+ axidma_hw = &axidma_seg->hw;
+ axidma_hw->status = 0;
+ }
+
+ list_splice_tail_init(&chan->done_list, &chan->active_list);
+ chan->desc_pendingcount = 0;
+ chan->idle = false;
+ }
return;
+ }
if (!chan->idle)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 310/491] dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-16 17:58 ` Ben Hutchings
2026-04-13 15:59 ` [PATCH 5.10 312/491] btrfs: fix super block offset in error message in btrfs_validate_super() Greg Kroah-Hartman
` (184 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
[ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
The segment .control and .status fields both contain top bits which are
not part of the buffer size, the buffer size is located only in the bottom
max_buffer_len bits. To avoid interference from those top bits, mask out
the size using max_buffer_len first, and only then subtract the values.
Fixes: a575d0b4e663 ("dmaengine: xilinx_dma: Introduce xilinx_dma_get_residue")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Link: https://patch.msgid.link/20260316222530.163815-1-marex@nabladev.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index ca80a1dee8489..a89a150be3284 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -964,16 +964,16 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
struct xilinx_cdma_tx_segment,
node);
cdma_hw = &cdma_seg->hw;
- residue += (cdma_hw->control - cdma_hw->status) &
- chan->xdev->max_buffer_len;
+ residue += (cdma_hw->control & chan->xdev->max_buffer_len) -
+ (cdma_hw->status & chan->xdev->max_buffer_len);
} else if (chan->xdev->dma_config->dmatype ==
XDMA_TYPE_AXIDMA) {
axidma_seg = list_entry(entry,
struct xilinx_axidma_tx_segment,
node);
axidma_hw = &axidma_seg->hw;
- residue += (axidma_hw->control - axidma_hw->status) &
- chan->xdev->max_buffer_len;
+ residue += (axidma_hw->control & chan->xdev->max_buffer_len) -
+ (axidma_hw->status & chan->xdev->max_buffer_len);
} else {
aximcdma_seg =
list_entry(entry,
@@ -981,8 +981,8 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
node);
aximcdma_hw = &aximcdma_seg->hw;
residue +=
- (aximcdma_hw->control - aximcdma_hw->status) &
- chan->xdev->max_buffer_len;
+ (aximcdma_hw->control & chan->xdev->max_buffer_len) -
+ (aximcdma_hw->status & chan->xdev->max_buffer_len);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 312/491] btrfs: fix super block offset in error message in btrfs_validate_super()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 313/491] btrfs: fix lost error when running device stats on multiple devices fs Greg Kroah-Hartman
` (183 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Mark Harmstone,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <mark@harmstone.com>
[ Upstream commit b52fe51f724385b3ed81e37e510a4a33107e8161 ]
Fix the superblock offset mismatch error message in
btrfs_validate_super(): we changed it so that it considers all the
superblocks, but the message still assumes we're only looking at the
first one.
The change from %u to %llu is because we're changing from a constant to
a u64.
Fixes: 069ec957c35e ("btrfs: Refactor btrfs_check_super_valid")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Mark Harmstone <mark@harmstone.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 29f0ba4adfbce..7a2b91f6cf14e 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2548,8 +2548,8 @@ static int validate_super(struct btrfs_fs_info *fs_info,
if (mirror_num >= 0 &&
btrfs_super_bytenr(sb) != btrfs_sb_offset(mirror_num)) {
- btrfs_err(fs_info, "super offset mismatch %llu != %u",
- btrfs_super_bytenr(sb), BTRFS_SUPER_INFO_OFFSET);
+ btrfs_err(fs_info, "super offset mismatch %llu != %llu",
+ btrfs_super_bytenr(sb), btrfs_sb_offset(mirror_num));
ret = -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 313/491] btrfs: fix lost error when running device stats on multiple devices fs
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 312/491] btrfs: fix super block offset in error message in btrfs_validate_super() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 314/491] dmaengine: xilinx_dma: Program interrupt delay timeout Greg Kroah-Hartman
` (182 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 1c37d896b12dfd0d4c96e310b0033c6676933917 ]
Whenever we get an error updating the device stats item for a device in
btrfs_run_dev_stats() we allow the loop to go to the next device, and if
updating the stats item for the next device succeeds, we end up losing
the error we had from the previous device.
Fix this by breaking out of the loop once we get an error and make sure
it's returned to the caller. Since we are in the transaction commit path
(and in the critical section actually), returning the error will result
in a transaction abort.
Fixes: 733f4fbbc108 ("Btrfs: read device stats on mount, write modified ones during commit")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2bba6e8d43740..da77493f4c17d 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -7553,8 +7553,9 @@ int btrfs_run_dev_stats(struct btrfs_trans_handle *trans)
smp_rmb();
ret = update_dev_stat_item(trans, device);
- if (!ret)
- atomic_sub(stats_cnt, &device->dev_stats_ccnt);
+ if (ret)
+ break;
+ atomic_sub(stats_cnt, &device->dev_stats_ccnt);
}
mutex_unlock(&fs_devices->device_list_mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 314/491] dmaengine: xilinx_dma: Program interrupt delay timeout
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 313/491] btrfs: fix lost error when running device stats on multiple devices fs Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 315/491] dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Greg Kroah-Hartman
` (181 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radhey Shyam Pandey, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
[ Upstream commit 84b798fedf3fa8f0ab0c096593ba817abc454fe5 ]
Program IRQDelay for AXI DMA. The interrupt timeout mechanism causes
the DMA engine to generate an interrupt after the delay time period
has expired. It enables dmaengine to respond in real-time even though
interrupt coalescing is configured. It also remove the placeholder
for delay interrupt and merge it with frame completion interrupt.
Since by default interrupt delay timeout is disabled this feature
addition has no functional impact on VDMA, MCDMA and CDMA IP's.
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1691387509-2113129-8-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Stable-dep-of: a17ce4bc6f4f ("dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index a89a150be3284..7b3c47e442c15 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -174,8 +174,10 @@
#define XILINX_DMA_MAX_TRANS_LEN_MAX 23
#define XILINX_DMA_V2_MAX_TRANS_LEN_MAX 26
#define XILINX_DMA_CR_COALESCE_MAX GENMASK(23, 16)
+#define XILINX_DMA_CR_DELAY_MAX GENMASK(31, 24)
#define XILINX_DMA_CR_CYCLIC_BD_EN_MASK BIT(4)
#define XILINX_DMA_CR_COALESCE_SHIFT 16
+#define XILINX_DMA_CR_DELAY_SHIFT 24
#define XILINX_DMA_BD_SOP BIT(27)
#define XILINX_DMA_BD_EOP BIT(26)
#define XILINX_DMA_COALESCE_MAX 255
@@ -411,6 +413,7 @@ struct xilinx_dma_tx_descriptor {
* @stop_transfer: Differentiate b/w DMA IP's quiesce
* @tdest: TDEST value for mcdma
* @has_vflip: S2MM vertical flip
+ * @irq_delay: Interrupt delay timeout
*/
struct xilinx_dma_chan {
struct xilinx_dma_device *xdev;
@@ -449,6 +452,7 @@ struct xilinx_dma_chan {
int (*stop_transfer)(struct xilinx_dma_chan *chan);
u16 tdest;
bool has_vflip;
+ u8 irq_delay;
};
/**
@@ -1560,6 +1564,9 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
if (chan->has_sg)
xilinx_write(chan, XILINX_DMA_REG_CURDESC,
head_desc->async_tx.phys);
+ reg &= ~XILINX_DMA_CR_DELAY_MAX;
+ reg |= chan->irq_delay << XILINX_DMA_CR_DELAY_SHIFT;
+ dma_ctrl_write(chan, XILINX_DMA_REG_DMACR, reg);
xilinx_dma_start(chan);
@@ -1876,15 +1883,8 @@ static irqreturn_t xilinx_dma_irq_handler(int irq, void *data)
}
}
- if (status & XILINX_DMA_DMASR_DLY_CNT_IRQ) {
- /*
- * Device takes too long to do the transfer when user requires
- * responsiveness.
- */
- dev_dbg(chan->dev, "Inter-packet latency too long\n");
- }
-
- if (status & XILINX_DMA_DMASR_FRM_CNT_IRQ) {
+ if (status & (XILINX_DMA_DMASR_FRM_CNT_IRQ |
+ XILINX_DMA_DMASR_DLY_CNT_IRQ)) {
spin_lock(&chan->lock);
xilinx_dma_complete_descriptor(chan);
chan->idle = true;
@@ -2801,6 +2801,8 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
/* Retrieve the channel properties from the device tree */
has_dre = of_property_read_bool(node, "xlnx,include-dre");
+ of_property_read_u8(node, "xlnx,irq-delay", &chan->irq_delay);
+
chan->genlock = of_property_read_bool(node, "xlnx,genlock-mode");
err = of_property_read_u32(node, "xlnx,datawidth", &value);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 315/491] dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 314/491] dmaengine: xilinx_dma: Program interrupt delay timeout Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 316/491] futex: Clear stale exiting pointer in futex_lock_pi() retry path Greg Kroah-Hartman
` (180 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit a17ce4bc6f4f9acf77ba416c36791a15602e53aa ]
A single AXIDMA controller can have one or two channels. When it has two
channels, the reset for both are tied together: resetting one channel
resets the other as well. This creates a problem where resetting one
channel will reset the registers for both channels, including clearing
interrupt enable bits for the other channel, which can then lead to
timeouts as the driver is waiting for an interrupt which never comes.
The driver currently has a probe-time work around for this: when a
channel is created, the driver also resets and enables the
interrupts. With two channels the reset for the second channel will
clear the interrupt enables for the first one. The work around in the
driver is just to manually enable the interrupts again in
xilinx_dma_alloc_chan_resources().
This workaround only addresses the probe-time issue. When channels are
reset at runtime (e.g., in xilinx_dma_terminate_all() or during error
recovery), there's no corresponding mechanism to restore the other
channel's interrupt enables. This leads to one channel having its
interrupts disabled while the driver expects them to work, causing
timeouts and DMA failures.
A proper fix is a complicated matter, as we should not reset the other
channel when it's operating normally. So, perhaps, there should be some
kind of synchronization for a common reset, which is not trivial to
implement. To add to the complexity, the driver also supports other DMA
types, like VDMA, CDMA and MCDMA, which don't have a shared reset.
However, when the two-channel AXIDMA is used in the (assumably) normal
use case, providing DMA for a single memory-to-memory device, the common
reset is a bit smaller issue: when something bad happens on one channel,
or when one channel is terminated, the assumption is that we also want
to terminate the other channel. And thus resetting both at the same time
is "ok".
With that line of thinking we can implement a bit better work around
than just the current probe time work around: let's enable the
AXIDMA interrupts at xilinx_dma_start_transfer() instead.
This ensures interrupts are enabled whenever a transfer starts,
regardless of any prior resets that may have cleared them.
This approach is also more logical: enable interrupts only when needed
for a transfer, rather than at resource allocation time, and, I think,
all the other DMA types should also use this model, but I'm reluctant to
do such changes as I cannot test them.
The reset function still enables interrupts even though it's not needed
for AXIDMA anymore, but it's common code for all DMA types (VDMA, CDMA,
MCDMA), so leave it unchanged to avoid affecting other variants.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine")
Link: https://patch.msgid.link/20260311-xilinx-dma-fix-v2-1-a725abb66e3c@ideasonboard.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 7b3c47e442c15..ff7fda42b5ca2 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -1190,14 +1190,6 @@ static int xilinx_dma_alloc_chan_resources(struct dma_chan *dchan)
dma_cookie_init(dchan);
- if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) {
- /* For AXI DMA resetting once channel will reset the
- * other channel as well so enable the interrupts here.
- */
- dma_ctrl_set(chan, XILINX_DMA_REG_DMACR,
- XILINX_DMA_DMAXR_ALL_IRQ_MASK);
- }
-
if ((chan->xdev->dma_config->dmatype == XDMA_TYPE_CDMA) && chan->has_sg)
dma_ctrl_set(chan, XILINX_DMA_REG_DMACR,
XILINX_CDMA_CR_SGMODE);
@@ -1566,6 +1558,7 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
head_desc->async_tx.phys);
reg &= ~XILINX_DMA_CR_DELAY_MAX;
reg |= chan->irq_delay << XILINX_DMA_CR_DELAY_SHIFT;
+ reg |= XILINX_DMA_DMAXR_ALL_IRQ_MASK;
dma_ctrl_write(chan, XILINX_DMA_REG_DMACR, reg);
xilinx_dma_start(chan);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 316/491] futex: Clear stale exiting pointer in futex_lock_pi() retry path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 315/491] dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 317/491] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Greg Kroah-Hartman
` (179 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Davidlohr Bueso, Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <dave@stgolabs.net>
commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream.
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer
is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
Fixes: 3ef240eaff36 ("futex: Prevent exit livelock")
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -2785,9 +2785,9 @@ static int futex_lock_pi(u32 __user *uad
ktime_t *time, int trylock)
{
struct hrtimer_sleeper timeout, *to;
- struct task_struct *exiting = NULL;
struct rt_mutex_waiter rt_waiter;
struct futex_hash_bucket *hb;
+ struct task_struct *exiting;
struct futex_q q = futex_q_init;
int res, ret;
@@ -2800,6 +2800,7 @@ static int futex_lock_pi(u32 __user *uad
to = futex_setup_timer(time, &timeout, FLAGS_CLOCKRT, 0);
retry:
+ exiting = NULL;
ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q.key, FUTEX_WRITE);
if (unlikely(ret != 0))
goto out;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 317/491] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 316/491] futex: Clear stale exiting pointer in futex_lock_pi() retry path Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 318/491] atm: lec: fix use-after-free in sock_def_readable() Greg Kroah-Hartman
` (178 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benoît Sevens, Jason Gerecke,
Jiri Kosina, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <bsevens@google.com>
[ Upstream commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 ]
The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.
Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if
a short report is received.
Signed-off-by: Benoît Sevens <bsevens@google.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/wacom_wac.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 2a7cd5be87444..12d70983ed407 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1251,10 +1251,20 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)
switch (data[0]) {
case 0x04:
+ if (len < 32) {
+ dev_warn(wacom->pen_input->dev.parent,
+ "Report 0x04 too short: %zu bytes\n", len);
+ break;
+ }
wacom_intuos_bt_process_data(wacom, data + i);
i += 10;
fallthrough;
case 0x03:
+ if (i == 1 && len < 22) {
+ dev_warn(wacom->pen_input->dev.parent,
+ "Report 0x03 too short: %zu bytes\n", len);
+ break;
+ }
wacom_intuos_bt_process_data(wacom, data + i);
i += 10;
wacom_intuos_bt_process_data(wacom, data + i);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 318/491] atm: lec: fix use-after-free in sock_def_readable()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 317/491] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 319/491] objtool: Fix Clang jump table detection Greg Kroah-Hartman
` (177 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f50072212ab792c86925,
Deepanshu Kartikey, Eric Dumazet, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
[ Upstream commit 922814879542c2e397b0e9641fd36b8202a8e555 ]
A race condition exists between lec_atm_close() setting priv->lecd
to NULL and concurrent access to priv->lecd in send_to_lecd(),
lec_handle_bridge(), and lec_atm_send(). When the socket is freed
via RCU while another thread is still using it, a use-after-free
occurs in sock_def_readable() when accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without
any synchronization, while callers dereference priv->lecd without
any protection against concurrent teardown.
Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference
the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in
lec_atm_close() to ensure all readers have completed before
proceeding. This is safe since lec_atm_close() is called from
vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close()
since vcc_destroy_socket() already drains it after lec_atm_close()
returns.
v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out
by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the
lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after
lec_atm_close() drains sk_receive_queue since timer and
workqueue paths bypass netif_stop_queue().
Note: Syzbot patch testing was attempted but the test VM terminated
unexpectedly with "Connection to localhost closed by remote host",
likely due to a QEMU AHCI emulation issue unrelated to this fix.
Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260309155908.508768-1-kartikey406@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/atm/lec.c | 72 +++++++++++++++++++++++++++++++++++++---------------------
net/atm/lec.h | 2 -
2 files changed, 48 insertions(+), 26 deletions(-)
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -142,6 +142,7 @@ static void lec_handle_bridge(struct sk_
struct sock *sk;
struct sk_buff *skb2;
struct atmlec_msg *mesg;
+ struct atm_vcc *vcc;
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
if (skb2 == NULL)
@@ -154,10 +155,18 @@ static void lec_handle_bridge(struct sk_
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct
int is_rdesc;
pr_debug("called\n");
- if (!priv->lecd) {
+ if (!rcu_access_pointer(priv->lecd)) {
pr_info("%s:No lecd attached\n", dev->name);
dev->stats.tx_errors++;
netif_stop_queue(dev);
@@ -443,6 +452,7 @@ static int lec_atm_send(struct atm_vcc *
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
+ struct atm_vcc *vcc;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
@@ -451,10 +461,18 @@ static int lec_atm_send(struct atm_vcc *
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -470,23 +488,16 @@ static int lec_atm_send(struct atm_vcc *
static void lec_atm_close(struct atm_vcc *vcc)
{
- struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
- priv->lecd = NULL;
+ rcu_assign_pointer(priv->lecd, NULL);
+ synchronize_rcu();
/* Do something needful? */
netif_stop_queue(dev);
lec_arp_destroy(priv);
- if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
- pr_info("%s closing with messages pending\n", dev->name);
- while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
- atm_return(vcc, skb->truesize);
- dev_kfree_skb(skb);
- }
-
pr_info("%s: Shut down!\n", dev->name);
module_put(THIS_MODULE);
}
@@ -512,12 +523,14 @@ send_to_lecd(struct lec_priv *priv, atml
const unsigned char *mac_addr, const unsigned char *atm_addr,
struct sk_buff *data)
{
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb;
struct atmlec_msg *mesg;
- if (!priv || !priv->lecd)
+ if (!priv || !rcu_access_pointer(priv->lecd))
return -1;
+
skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
if (!skb)
return -1;
@@ -534,18 +547,27 @@ send_to_lecd(struct lec_priv *priv, atml
if (atm_addr)
memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
- atm_force_charge(priv->lecd, skb->truesize);
- sk = sk_atm(priv->lecd);
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (!vcc) {
+ rcu_read_unlock();
+ kfree_skb(skb);
+ return -1;
+ }
+
+ atm_force_charge(vcc, skb->truesize);
+ sk = sk_atm(vcc);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
- atm_force_charge(priv->lecd, data->truesize);
+ atm_force_charge(vcc, data->truesize);
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
+ rcu_read_unlock();
return 0;
}
@@ -620,7 +642,7 @@ static void lec_push(struct atm_vcc *vcc
atm_return(vcc, skb->truesize);
if (*(__be16 *) skb->data == htons(priv->lecid) ||
- !priv->lecd || !(dev->flags & IFF_UP)) {
+ !rcu_access_pointer(priv->lecd) || !(dev->flags & IFF_UP)) {
/*
* Probably looping back, or if lecd is missing,
* lecd has gone down
@@ -755,12 +777,12 @@ static int lecd_attach(struct atm_vcc *v
priv = netdev_priv(dev_lec[i]);
} else {
priv = netdev_priv(dev_lec[i]);
- if (priv->lecd)
+ if (rcu_access_pointer(priv->lecd))
return -EADDRINUSE;
}
lec_arp_init(priv);
priv->itfnum = i; /* LANE2 addition */
- priv->lecd = vcc;
+ rcu_assign_pointer(priv->lecd, vcc);
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -91,7 +91,7 @@ struct lec_priv {
*/
spinlock_t lec_arp_lock;
struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */
- struct atm_vcc *lecd;
+ struct atm_vcc __rcu *lecd;
struct delayed_work lec_arp_work; /* C10 */
unsigned int maximum_unknown_frame_count;
/*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 319/491] objtool: Fix Clang jump table detection
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 318/491] atm: lec: fix use-after-free in sock_def_readable() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 320/491] HID: multitouch: Check to ensure report responses match the request Greg Kroah-Hartman
` (176 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Josh Poimboeuf,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@kernel.org>
[ Upstream commit 4e5019216402ad0b4a84cff457b662d26803f103 ]
With Clang, there can be a conditional forward jump between the load of
the jump table address and the indirect branch.
Fixes the following warning:
vmlinux.o: warning: objtool: ___bpf_prog_run+0x1c5: sibling call from callable instruction with modified stack frame
Reported-by: Arnd Bergmann <arnd@arndb.de>
Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com
Link: https://patch.msgid.link/7d8600caed08901b6679767488acd639f6df9688.1773071992.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/check.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 20ccdd60353be..ac4bd2d4fdda6 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1664,12 +1664,11 @@ static void mark_func_jump_tables(struct objtool_file *file,
last = insn;
/*
- * Store back-pointers for unconditional forward jumps such
+ * Store back-pointers for forward jumps such
* that find_jump_table() can back-track using those and
* avoid some potentially confusing code.
*/
- if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
- insn->offset > last->offset &&
+ if (insn->jump_dest &&
insn->jump_dest->offset > insn->offset &&
!insn->jump_dest->first_jump_src) {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 320/491] HID: multitouch: Check to ensure report responses match the request
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 319/491] objtool: Fix Clang jump table detection Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 321/491] crypto: af-alg - fix NULL pointer dereference in scatterwalk Greg Kroah-Hartman
` (175 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lee Jones, Benjamin Tissoires,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
[ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]
It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID. This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.
Add a check to ensure that the report ID in the response, matches the
one that was requested. If it doesn't, omit reporting the raw event and
return early.
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 227cf3f6ca227..948bd59ab5d21 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -442,12 +442,19 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
dev_warn(&hdev->dev, "failed to fetch feature %d\n",
report->id);
} else {
+ /* The report ID in the request and the response should match */
+ if (report->id != buf[0]) {
+ hid_err(hdev, "Returned feature report did not match the request\n");
+ goto free;
+ }
+
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
size, 0);
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
+free:
kfree(buf);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 321/491] crypto: af-alg - fix NULL pointer dereference in scatterwalk
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 320/491] HID: multitouch: Check to ensure report responses match the request Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 322/491] net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet Greg Kroah-Hartman
` (174 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Norbert Szetei, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
[ Upstream commit 62397b493e14107ae82d8b80938f293d95425bcb ]
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.
This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.
Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().
Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/af_alg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 3d622904f4c3d..5e0fe58f8bdd9 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -515,8 +515,10 @@ static int af_alg_alloc_tsgl(struct sock *sk)
sg_init_table(sgl->sg, MAX_SGL_ENTS + 1);
sgl->cur = 0;
- if (sg)
+ if (sg) {
+ sg_unmark_end(sg + MAX_SGL_ENTS - 1);
sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg);
+ }
list_add_tail(&sgl->list, &ctx->tsgl_list);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 322/491] net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 321/491] crypto: af-alg - fix NULL pointer dereference in scatterwalk Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 323/491] net: qrtr: Release distant nodes along the bridge node Greg Kroah-Hartman
` (173 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Loic Poulain, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@linaro.org>
[ Upstream commit f7dec6cb914c8923808eefc034bba8227a5dfe3a ]
This will be requested for allocating control packet in atomic context.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 2428083101f6 ("net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/qrtr/af_qrtr.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 8476a229bce0a..01d8cb93ad756 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -540,18 +540,20 @@ EXPORT_SYMBOL_GPL(qrtr_endpoint_post);
/**
* qrtr_alloc_ctrl_packet() - allocate control packet skb
* @pkt: reference to qrtr_ctrl_pkt pointer
+ * @flags: the type of memory to allocate
*
* Returns newly allocated sk_buff, or NULL on failure
*
* This function allocates a sk_buff large enough to carry a qrtr_ctrl_pkt and
* on success returns a reference to the control packet in @pkt.
*/
-static struct sk_buff *qrtr_alloc_ctrl_packet(struct qrtr_ctrl_pkt **pkt)
+static struct sk_buff *qrtr_alloc_ctrl_packet(struct qrtr_ctrl_pkt **pkt,
+ gfp_t flags)
{
const int pkt_len = sizeof(struct qrtr_ctrl_pkt);
struct sk_buff *skb;
- skb = alloc_skb(QRTR_HDR_MAX_SIZE + pkt_len, GFP_KERNEL);
+ skb = alloc_skb(QRTR_HDR_MAX_SIZE + pkt_len, flags);
if (!skb)
return NULL;
@@ -620,7 +622,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
mutex_unlock(&node->ep_lock);
/* Notify the local controller about the event */
- skb = qrtr_alloc_ctrl_packet(&pkt);
+ skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
if (skb) {
pkt->cmd = cpu_to_le32(QRTR_TYPE_BYE);
qrtr_local_enqueue(NULL, skb, QRTR_TYPE_BYE, &src, &dst);
@@ -677,7 +679,7 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
to.sq_node = QRTR_NODE_BCAST;
to.sq_port = QRTR_PORT_CTRL;
- skb = qrtr_alloc_ctrl_packet(&pkt);
+ skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
if (skb) {
pkt->cmd = cpu_to_le32(QRTR_TYPE_DEL_CLIENT);
pkt->client.node = cpu_to_le32(ipc->us.sq_node);
@@ -992,7 +994,7 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)
if (!node)
return -EINVAL;
- skb = qrtr_alloc_ctrl_packet(&pkt);
+ skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
if (!skb)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 323/491] net: qrtr: Release distant nodes along the bridge node
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 322/491] net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 324/491] net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Greg Kroah-Hartman
` (172 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Loic Poulain, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@linaro.org>
[ Upstream commit 90829f07baea7efe4ca77f79820f3849081186a8 ]
Distant QRTR nodes can be accessed via an other node that acts as
a bridge. When the a QRTR endpoint associated to a bridge node is
released, all the linked distant nodes should also be released.
This patch fixes endpoint release by:
- Submitting QRTR BYE message locally on behalf of all the nodes
accessible through the endpoint.
- Removing all the routable node IDs from radix tree pointing to
the released node endpoint.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 2428083101f6 ("net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/qrtr/af_qrtr.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 01d8cb93ad756..68b6124fc8a10 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -172,8 +172,13 @@ static void __qrtr_node_release(struct kref *kref)
void __rcu **slot;
spin_lock_irqsave(&qrtr_nodes_lock, flags);
- if (node->nid != QRTR_EP_NID_AUTO)
- radix_tree_delete(&qrtr_nodes, node->nid);
+ /* If the node is a bridge for other nodes, there are possibly
+ * multiple entries pointing to our released node, delete them all.
+ */
+ radix_tree_for_each_slot(slot, &qrtr_nodes, &iter, 0) {
+ if (*slot == node)
+ radix_tree_iter_delete(&qrtr_nodes, &iter, slot);
+ }
spin_unlock_irqrestore(&qrtr_nodes_lock, flags);
list_del(&node->item);
@@ -615,6 +620,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
struct qrtr_ctrl_pkt *pkt;
struct qrtr_tx_flow *flow;
struct sk_buff *skb;
+ unsigned long flags;
void __rcu **slot;
mutex_lock(&node->ep_lock);
@@ -622,11 +628,18 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
mutex_unlock(&node->ep_lock);
/* Notify the local controller about the event */
- skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
- if (skb) {
- pkt->cmd = cpu_to_le32(QRTR_TYPE_BYE);
- qrtr_local_enqueue(NULL, skb, QRTR_TYPE_BYE, &src, &dst);
+ spin_lock_irqsave(&qrtr_nodes_lock, flags);
+ radix_tree_for_each_slot(slot, &qrtr_nodes, &iter, 0) {
+ if (*slot != node)
+ continue;
+ src.sq_node = iter.index;
+ skb = qrtr_alloc_ctrl_packet(&pkt, GFP_ATOMIC);
+ if (skb) {
+ pkt->cmd = cpu_to_le32(QRTR_TYPE_BYE);
+ qrtr_local_enqueue(NULL, skb, QRTR_TYPE_BYE, &src, &dst);
+ }
}
+ spin_unlock_irqrestore(&qrtr_nodes_lock, flags);
/* Wake up any transmitters waiting for resume-tx from the node */
mutex_lock(&node->qrtr_tx_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 324/491] net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 323/491] net: qrtr: Release distant nodes along the bridge node Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 325/491] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Greg Kroah-Hartman
` (171 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+006987d1be3586e13555,
Jiayuan Chen, Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 2428083101f6883f979cceffa76cd8440751ffe6 ]
__radix_tree_create() allocates and links intermediate nodes into the
tree one by one. If a subsequent allocation fails, the already-linked
nodes remain in the tree with no corresponding leaf entry. These orphaned
internal nodes are never reclaimed because radix_tree_for_each_slot()
only visits slots containing leaf values.
The radix_tree API is deprecated in favor of xarray. As suggested by
Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead
of fixing the radix_tree itself [1]. xarray properly handles cleanup of
internal nodes — xa_destroy() frees all internal xarray nodes when the
qrtr_node is released, preventing the leak.
[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/
Reported-by: syzbot+006987d1be3586e13555@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000bfba3a060bf4ffcf@google.com/T/
Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324080645.290197-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/qrtr/af_qrtr.c | 31 +++++++++++++------------------
1 file changed, 13 insertions(+), 18 deletions(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 68b6124fc8a10..fdb7a5a12f035 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -116,7 +116,7 @@ static DEFINE_XARRAY_ALLOC(qrtr_ports);
* @ep: endpoint
* @ref: reference count for node
* @nid: node id
- * @qrtr_tx_flow: tree of qrtr_tx_flow, keyed by node << 32 | port
+ * @qrtr_tx_flow: xarray of qrtr_tx_flow, keyed by node << 32 | port
* @qrtr_tx_lock: lock for qrtr_tx_flow inserts
* @rx_queue: receive queue
* @item: list item for broadcast list
@@ -127,7 +127,7 @@ struct qrtr_node {
struct kref ref;
unsigned int nid;
- struct radix_tree_root qrtr_tx_flow;
+ struct xarray qrtr_tx_flow;
struct mutex qrtr_tx_lock; /* for qrtr_tx_flow */
struct sk_buff_head rx_queue;
@@ -170,6 +170,7 @@ static void __qrtr_node_release(struct kref *kref)
struct qrtr_tx_flow *flow;
unsigned long flags;
void __rcu **slot;
+ unsigned long index;
spin_lock_irqsave(&qrtr_nodes_lock, flags);
/* If the node is a bridge for other nodes, there are possibly
@@ -187,11 +188,9 @@ static void __qrtr_node_release(struct kref *kref)
skb_queue_purge(&node->rx_queue);
/* Free tx flow counters */
- radix_tree_for_each_slot(slot, &node->qrtr_tx_flow, &iter, 0) {
- flow = *slot;
- radix_tree_iter_delete(&node->qrtr_tx_flow, &iter, slot);
+ xa_for_each(&node->qrtr_tx_flow, index, flow)
kfree(flow);
- }
+ xa_destroy(&node->qrtr_tx_flow);
kfree(node);
}
@@ -226,9 +225,7 @@ static void qrtr_tx_resume(struct qrtr_node *node, struct sk_buff *skb)
key = remote_node << 32 | remote_port;
- rcu_read_lock();
- flow = radix_tree_lookup(&node->qrtr_tx_flow, key);
- rcu_read_unlock();
+ flow = xa_load(&node->qrtr_tx_flow, key);
if (flow) {
spin_lock(&flow->resume_tx.lock);
flow->pending = 0;
@@ -267,12 +264,13 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
return 0;
mutex_lock(&node->qrtr_tx_lock);
- flow = radix_tree_lookup(&node->qrtr_tx_flow, key);
+ flow = xa_load(&node->qrtr_tx_flow, key);
if (!flow) {
flow = kzalloc(sizeof(*flow), GFP_KERNEL);
if (flow) {
init_waitqueue_head(&flow->resume_tx);
- if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+ if (xa_err(xa_store(&node->qrtr_tx_flow, key, flow,
+ GFP_KERNEL))) {
kfree(flow);
flow = NULL;
}
@@ -324,9 +322,7 @@ static void qrtr_tx_flow_failed(struct qrtr_node *node, int dest_node,
unsigned long key = (u64)dest_node << 32 | dest_port;
struct qrtr_tx_flow *flow;
- rcu_read_lock();
- flow = radix_tree_lookup(&node->qrtr_tx_flow, key);
- rcu_read_unlock();
+ flow = xa_load(&node->qrtr_tx_flow, key);
if (flow) {
spin_lock_irq(&flow->resume_tx.lock);
flow->tx_failed = 1;
@@ -593,7 +589,7 @@ int qrtr_endpoint_register(struct qrtr_endpoint *ep, unsigned int nid)
node->nid = QRTR_EP_NID_AUTO;
node->ep = ep;
- INIT_RADIX_TREE(&node->qrtr_tx_flow, GFP_KERNEL);
+ xa_init(&node->qrtr_tx_flow);
mutex_init(&node->qrtr_tx_lock);
qrtr_node_assign(node, nid);
@@ -621,6 +617,7 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
struct qrtr_tx_flow *flow;
struct sk_buff *skb;
unsigned long flags;
+ unsigned long index;
void __rcu **slot;
mutex_lock(&node->ep_lock);
@@ -643,10 +640,8 @@ void qrtr_endpoint_unregister(struct qrtr_endpoint *ep)
/* Wake up any transmitters waiting for resume-tx from the node */
mutex_lock(&node->qrtr_tx_lock);
- radix_tree_for_each_slot(slot, &node->qrtr_tx_flow, &iter, 0) {
- flow = *slot;
+ xa_for_each(&node->qrtr_tx_flow, index, flow)
wake_up_interruptible_all(&flow->resume_tx);
- }
mutex_unlock(&node->qrtr_tx_lock);
qrtr_node_release(node);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 325/491] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 324/491] net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 326/491] tg3: Fix race for querying speed/duplex Greg Kroah-Hartman
` (170 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yochai Eisenrich, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <echelonh@gmail.com>
[ Upstream commit ae05340ccaa9d347fe85415609e075545bec589f ]
When processing Router Advertisements with user options the kernel
builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
has three padding fields that are never zeroed and can leak kernel data
The fix is simple, just zeroes the padding fields.
Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink (RDNSS support)")
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260324224925.2437775-1-echelonh@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ndisc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 43ad4e5db5941..de389b519700d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1155,6 +1155,9 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
+ ndmsg->nduseropt_pad1 = 0;
+ ndmsg->nduseropt_pad2 = 0;
+ ndmsg->nduseropt_pad3 = 0;
memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 326/491] tg3: Fix race for querying speed/duplex
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 325/491] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 327/491] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Greg Kroah-Hartman
` (169 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Pavan Chebbi,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
[ Upstream commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed ]
When driver signals carrier up via netif_carrier_on() its internal
link_up state isn't updated immediately. This leads to inconsistent
speed/duplex in /proc/net/bonding/bondX where the speed and duplex
is shown as unknown while ethtool shows correct values. Fix this by
using netif_carrier_ok() for link checking in get_ksettings function.
Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices")
Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/tg3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e8be9e5a244fd..954a51fe0cd70 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12232,7 +12232,7 @@ static int tg3_get_link_ksettings(struct net_device *dev,
ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising,
advertising);
- if (netif_running(dev) && tp->link_up) {
+ if (netif_running(dev) && netif_carrier_ok(dev)) {
cmd->base.speed = tp->link_config.active_speed;
cmd->base.duplex = tp->link_config.active_duplex;
ethtool_convert_legacy_u32_to_link_mode(
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 327/491] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 326/491] tg3: Fix race for querying speed/duplex Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 328/491] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Greg Kroah-Hartman
` (168 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Eric Dumazet,
Oskar Kjos, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ]
Sashiko AI-review observed:
In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet
where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2
and passed to icmp6_send(), it uses IP6CB(skb2).
IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso
offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm
at offset 18.
If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao
would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called
and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
This would scan the inner, attacker-controlled IPv6 packet starting at that
offset, potentially returning a fake TLV without checking if the remaining
packet length can hold the full 18-byte struct ipv6_destopt_hao.
Could mip6_addr_swap() then perform a 16-byte swap that extends past the end
of the packet data into skb_shared_info?
Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and
ip6ip6_err() to prevent this?
This patch implements the first suggestion.
I am not sure if ip6ip6_err() needs to be changed.
A separate patch would be better anyway.
Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error")
Reported-by: Ido Schimmel <idosch@nvidia.com>
Closes: https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Oskar Kjos <oskar.kjos@hotmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260326202608.2976021-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/icmp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d01165bb6a32b..65846f4451894 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -673,6 +673,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
if (!skb2)
return 1;
+ /* Remove debris left by IPv4 stack. */
+ memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2)));
+
skb_dst_drop(skb2);
skb_pull(skb2, nhs);
skb_reset_network_header(skb2);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 328/491] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 327/491] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 329/491] bridge: br_nd_send: linearize skb before parsing ND options Greg Kroah-Hartman
` (167 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oskar Kjos, Eric Dumazet,
Ido Schimmel, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ]
Oskar Kjos reported the following problem.
ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
value. __ip_options_echo() then reads optlen from attacker-controlled
packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
Also add minimal IPv4 header validation (version == 4, ihl >= 5).
Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260326155138.2429480-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_tunnel.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index e8c4e02e75d43..dda90c77f8984 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -634,11 +634,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (!skb2)
return 0;
+ /* Remove debris left by IPv6 stack. */
+ memset(IPCB(skb2), 0, sizeof(*IPCB(skb2)));
+
skb_dst_drop(skb2);
skb_pull(skb2, offset);
skb_reset_network_header(skb2);
eiph = ip_hdr(skb2);
+ if (eiph->version != 4 || eiph->ihl < 5)
+ goto out;
/* Try to guess incoming interface */
rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 329/491] bridge: br_nd_send: linearize skb before parsing ND options
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 328/491] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 330/491] net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Greg Kroah-Hartman
` (166 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Ao Zhou,
Yuan Tan, Xin Liu, Ido Schimmel, Nikolay Aleksandrov,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <n05ec@lzu.edu.cn>
[ Upstream commit a01aee7cafc575bb82f5529e8734e7052f9b16ea ]
br_nd_send() parses neighbour discovery options from ns->opt[] and
assumes that these options are in the linear part of request.
Its callers only guarantee that the ICMPv6 header and target address
are available, so the option area can still be non-linear. Parsing
ns->opt[] in that case can access data past the linear buffer.
Linearize request before option parsing and derive ns from the linear
network header.
Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260326034441.2037420-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_arp_nd_proxy.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 3db1def4437b3..a44d14b94865e 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -248,12 +248,12 @@ struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *msg)
static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
struct sk_buff *request, struct neighbour *n,
- __be16 vlan_proto, u16 vlan_tci, struct nd_msg *ns)
+ __be16 vlan_proto, u16 vlan_tci)
{
struct net_device *dev = request->dev;
struct net_bridge_vlan_group *vg;
+ struct nd_msg *na, *ns;
struct sk_buff *reply;
- struct nd_msg *na;
struct ipv6hdr *pip6;
int na_olen = 8; /* opt hdr + ETH_ALEN for target */
int ns_olen;
@@ -261,7 +261,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
u8 *daddr;
u16 pvid;
- if (!dev)
+ if (!dev || skb_linearize(request))
return;
len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
@@ -278,6 +278,8 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
skb_set_mac_header(reply, 0);
daddr = eth_hdr(request)->h_source;
+ ns = (struct nd_msg *)(skb_network_header(request) +
+ sizeof(struct ipv6hdr));
/* Do we need option processing ? */
ns_olen = request->len - (skb_network_offset(request) +
@@ -465,9 +467,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
if (vid != 0)
br_nd_send(br, p, skb, n,
skb->vlan_proto,
- skb_vlan_tag_get(skb), msg);
+ skb_vlan_tag_get(skb));
else
- br_nd_send(br, p, skb, n, 0, 0, msg);
+ br_nd_send(br, p, skb, n, 0, 0);
replied = true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 330/491] net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 329/491] bridge: br_nd_send: linearize skb before parsing ND options Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 331/491] ipv6: prevent possible UaF in addrconf_permanent_addr() Greg Kroah-Hartman
` (165 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jamal Hadi Salim, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 4576100b8cd03118267513cafacde164b498b322 ]
m2sm() converts a u32 slope to a u64 scaled value. For large inputs
(e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores
the difference of two such u64 values in a u32 variable `dsm` and
uses it as a divisor. When the difference is exactly 2^32 the
truncation yields zero, causing a divide-by-zero oops in the
concave-curve intersection path:
Oops: divide error: 0000
RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601)
Call Trace:
init_ed (net/sched/sch_hfsc.c:629)
hfsc_enqueue (net/sched/sch_hfsc.c:1569)
[...]
Widen `dsm` to u64 and replace do_div() with div64_u64() so the full
difference is preserved.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260326204310.1549327-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 25360061ad288..3a271ad16443b 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -556,7 +556,7 @@ static void
rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y)
{
u64 y1, y2, dx, dy;
- u32 dsm;
+ u64 dsm;
if (isc->sm1 <= isc->sm2) {
/* service curve is convex */
@@ -599,7 +599,7 @@ rtsc_min(struct runtime_sc *rtsc, struct internal_sc *isc, u64 x, u64 y)
*/
dx = (y1 - y) << SM_SHIFT;
dsm = isc->sm1 - isc->sm2;
- do_div(dx, dsm);
+ dx = div64_u64(dx, dsm);
/*
* check if (x, y1) belongs to the 1st segment of rtsc.
* if so, add the offset.
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 331/491] ipv6: prevent possible UaF in addrconf_permanent_addr()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 330/491] net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 332/491] net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Greg Kroah-Hartman
` (164 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 ]
The mentioned helper try to warn the user about an exceptional
condition, but the message is delivered too late, accessing the ipv6
after its possible deletion.
Reorder the statement to avoid the possible UaF; while at it, place the
warning outside the idev->lock as it needs no protection.
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://sashiko.dev/#/patchset/8c8bfe2e1a324e501f0e15fef404a77443fd8caf.1774365668.git.pabeni%40redhat.com
Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/ef973c3a8cb4f8f1787ed469f3e5391b9fe95aa0.1774601542.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ced20abf4ef8e..758cea239e618 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3509,12 +3509,12 @@ static void addrconf_permanent_addr(struct net *net, struct net_device *dev)
if ((ifp->flags & IFA_F_PERMANENT) &&
fixup_permanent_addr(net, idev, ifp) < 0) {
write_unlock_bh(&idev->lock);
- in6_ifa_hold(ifp);
- ipv6_del_addr(ifp);
- write_lock_bh(&idev->lock);
net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
idev->dev->name, &ifp->addr);
+ in6_ifa_hold(ifp);
+ ipv6_del_addr(ifp);
+ write_lock_bh(&idev->lock);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 332/491] net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 331/491] ipv6: prevent possible UaF in addrconf_permanent_addr() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 333/491] NFC: pn533: bound the UART receive buffer Greg Kroah-Hartman
` (163 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yochai Eisenrich, Jamal Hadi Salim,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <echelonh@gmail.com>
[ Upstream commit e6e3eb5ee89ac4c163d46429391c889a1bb5e404 ]
When building netlink messages, tc_chain_fill_node() never initializes
the tcm_info field of struct tcmsg. Since the allocation is not zeroed,
kernel heap memory is leaked to userspace through this 4-byte field.
The fix simply zeroes tcm_info alongside the other fields that are
already initialized.
Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi")
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260328211436.1010152-1-echelonh@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index beedd0d2b5097..27847fae053d3 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -2669,6 +2669,7 @@ static int tc_chain_fill_node(const struct tcf_proto_ops *tmplt_ops,
tcm->tcm__pad1 = 0;
tcm->tcm__pad2 = 0;
tcm->tcm_handle = 0;
+ tcm->tcm_info = 0;
if (block->q) {
tcm->tcm_ifindex = qdisc_dev(block->q)->ifindex;
tcm->tcm_parent = block->q->handle;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 333/491] NFC: pn533: bound the UART receive buffer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 332/491] net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 334/491] net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Greg Kroah-Hartman
` (162 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 30fe3f5f6494f827d812ff179f295a8e532709d6 ]
pn532_receive_buf() appends every incoming byte to dev->recv_skb and
only resets the buffer after pn532_uart_rx_is_frame() recognizes a
complete frame. A continuous stream of bytes without a valid PN532 frame
header therefore keeps growing the skb until skb_put_u8() hits the tail
limit.
Drop the accumulated partial frame once the fixed receive buffer is full
so malformed UART traffic cannot grow the skb past
PN532_UART_SKB_BUFF_LEN.
Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260326142033.82297-1-pengpeng@iscas.ac.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nfc/pn533/uart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/nfc/pn533/uart.c b/drivers/nfc/pn533/uart.c
index e92535ebb5287..7465b4b48c829 100644
--- a/drivers/nfc/pn533/uart.c
+++ b/drivers/nfc/pn533/uart.c
@@ -211,6 +211,9 @@ static int pn532_receive_buf(struct serdev_device *serdev,
del_timer(&dev->cmd_timeout);
for (i = 0; i < count; i++) {
+ if (unlikely(!skb_tailroom(dev->recv_skb)))
+ skb_trim(dev->recv_skb, 0);
+
skb_put_u8(dev->recv_skb, *data++);
if (!pn532_uart_rx_is_frame(dev->recv_skb))
continue;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 334/491] net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 333/491] NFC: pn533: bound the UART receive buffer Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 335/491] bpf: Fix regsafe() for pointers to packet Greg Kroah-Hartman
` (161 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suraj Gupta, Sean Anderson,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <suraj.gupta2@amd.com>
[ Upstream commit 393e0b4f178ec7fce1141dacc3304e3607a92ee9 ]
The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK
macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP
product guide (PG021) specifies the buffer length field as bits 25:0
(26 bits). Update both masks to match the IP documentation.
In practice this had no functional impact, since Ethernet frames are
far smaller than 2^23 bytes and the extra bits were always zero, but
the masks should still reflect the hardware specification.
Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Link: https://patch.msgid.link/20260327073238.134948-2-suraj.gupta2@amd.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h
index 071822028ea5e..516f40e7560ac 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h
@@ -103,7 +103,7 @@
#define XAXIDMA_BD_HAS_DRE_MASK 0xF00 /* Whether has DRE mask */
#define XAXIDMA_BD_WORDLEN_MASK 0xFF /* Whether has DRE mask */
-#define XAXIDMA_BD_CTRL_LENGTH_MASK 0x007FFFFF /* Requested len */
+#define XAXIDMA_BD_CTRL_LENGTH_MASK GENMASK(25, 0) /* Requested len */
#define XAXIDMA_BD_CTRL_TXSOF_MASK 0x08000000 /* First tx packet */
#define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000 /* Last tx packet */
#define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000 /* All control bits */
@@ -129,7 +129,7 @@
#define XAXIDMA_BD_CTRL_TXEOF_MASK 0x04000000 /* Last tx packet */
#define XAXIDMA_BD_CTRL_ALL_MASK 0x0C000000 /* All control bits */
-#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK 0x007FFFFF /* Actual len */
+#define XAXIDMA_BD_STS_ACTUAL_LEN_MASK GENMASK(25, 0) /* Actual len */
#define XAXIDMA_BD_STS_COMPLETE_MASK 0x80000000 /* Completed */
#define XAXIDMA_BD_STS_DEC_ERR_MASK 0x40000000 /* Decode error */
#define XAXIDMA_BD_STS_SLV_ERR_MASK 0x20000000 /* Slave error */
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 335/491] bpf: Fix regsafe() for pointers to packet
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 334/491] net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 336/491] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Greg Kroah-Hartman
` (160 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Amery Hung, Eduard Zingerman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@kernel.org>
[ Upstream commit a8502a79e832b861e99218cbd2d8f4312d62e225 ]
In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N
regsafe() may return true which may lead to current state with
valid packet range not being explored. Fix the bug.
Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a2ccbd97e8dd2..e6cf29b117e1a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9459,8 +9459,13 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,
* since someone could have accessed through (ptr - k), or
* even done ptr -= k in a register, to get a safe access.
*/
- if (rold->range > rcur->range)
+ if (rold->range < 0 || rcur->range < 0) {
+ /* special case for [BEYOND|AT]_PKT_END */
+ if (rold->range != rcur->range)
+ return false;
+ } else if (rold->range > rcur->range) {
return false;
+ }
/* If the offsets don't match, we can't trust our alignment;
* nor can we be sure that we won't fall out of range.
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 336/491] net: ipv6: flowlabel: defer exclusive option free until RCU teardown
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 335/491] bpf: Fix regsafe() for pointers to packet Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 337/491] netfilter: nfnetlink_log: account for netlink header size Greg Kroah-Hartman
` (159 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Yuan Tan,
Xin Liu, Ren Wei, Zhengchuan Liang, Ren Wei, Eric Dumazet,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <zcliangcn@gmail.com>
[ Upstream commit 9ca562bb8e66978b53028fa32b1a190708e6a091 ]
`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt->opt_nflen` when an option block
is present.
Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`
drops to zero in `fl_release()`. However, the surrounding
`struct ip6_flowlabel` remains visible in the global hash table until
later garbage collection removes it and `fl_free_rcu()` finally tears it
down.
A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that
early `kfree()` and dereference freed option state, triggering a crash
in `ip6fl_seq_show()`.
Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches
the lifetime already required for the enclosing flowlabel while readers
can still reach it under RCU.
Fixes: d3aedd5ebd4b ("ipv6 flowlabel: Convert hash list to RCU.")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/07351f0ec47bcee289576f39f9354f4a64add6e4.1774855883.git.zcliangcn@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_flowlabel.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index ceb85c67ce395..bb528d0ddb73a 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -133,11 +133,6 @@ static void fl_release(struct ip6_flowlabel *fl)
if (time_after(ttd, fl->expires))
fl->expires = ttd;
ttd = fl->expires;
- if (fl->opt && fl->share == IPV6_FL_S_EXCL) {
- struct ipv6_txoptions *opt = fl->opt;
- fl->opt = NULL;
- kfree(opt);
- }
if (!timer_pending(&ip6_fl_gc_timer) ||
time_after(ip6_fl_gc_timer.expires, ttd))
mod_timer(&ip6_fl_gc_timer, ttd);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 337/491] netfilter: nfnetlink_log: account for netlink header size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 336/491] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 338/491] netfilter: x_tables: ensure names are nul-terminated Greg Kroah-Hartman
` (158 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 6d52a4a0520a6696bdde51caa11f2d6821cd0c01 ]
This is a followup to an old bug fix: NLMSG_DONE needs to account
for the netlink header size, not just the attribute size.
This can result in a WARN splat + drop of the netlink message,
but other than this there are no ill effects.
Fixes: 9dfa1dfe4d5e ("netfilter: nf_log: account for size of NLMSG_DONE attribute")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 3a71ba47224c4..d41560d4812d0 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -711,7 +711,7 @@ nfulnl_log_packet(struct net *net,
+ nla_total_size(plen) /* prefix */
+ nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))
- + nla_total_size(sizeof(struct nfgenmsg)); /* NLMSG_DONE */
+ + nlmsg_total_size(sizeof(struct nfgenmsg)); /* NLMSG_DONE */
if (in && skb_mac_header_was_set(skb)) {
size += nla_total_size(skb->dev->hard_header_len)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 338/491] netfilter: x_tables: ensure names are nul-terminated
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 337/491] netfilter: nfnetlink_log: account for netlink header size Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 339/491] netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Greg Kroah-Hartman
` (157 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e ]
Reject names that lack a \0 character before feeding them
to functions that expect c-strings.
Fixes tag is the most recent commit that needs this change.
Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_cgroup.c | 6 ++++++
net/netfilter/xt_rateest.c | 5 +++++
2 files changed, 11 insertions(+)
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index c0f5e9a4f3c65..bfc98719684e2 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -53,6 +53,9 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
info->priv = NULL;
if (info->has_path) {
+ if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path))
+ return -ENAMETOOLONG;
+
cgrp = cgroup_get_from_path(info->path);
if (IS_ERR(cgrp)) {
pr_info_ratelimited("invalid path, errno=%ld\n",
@@ -85,6 +88,9 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
info->priv = NULL;
if (info->has_path) {
+ if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path))
+ return -ENAMETOOLONG;
+
cgrp = cgroup_get_from_path(info->path);
if (IS_ERR(cgrp)) {
pr_info_ratelimited("invalid path, errno=%ld\n",
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index 72324bd976af8..b1d736c15fcbe 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -91,6 +91,11 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
goto err1;
}
+ if (strnlen(info->name1, sizeof(info->name1)) >= sizeof(info->name1))
+ return -ENAMETOOLONG;
+ if (strnlen(info->name2, sizeof(info->name2)) >= sizeof(info->name2))
+ return -ENAMETOOLONG;
+
ret = -ENOENT;
est1 = xt_rateest_lookup(par->net, info->name1);
if (!est1)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 339/491] netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 338/491] netfilter: x_tables: ensure names are nul-terminated Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 340/491] netfilter: nf_conntrack_helper: pass helper to expect cleanup Greg Kroah-Hartman
` (156 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit b7e8590987aa94c9dc51518fad0e58cb887b1db5 ]
IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they
cannot be treated like a c-string.
They either have to be switched to NLA_NUL_STRING, or the compare
operations need to use the nla functions.
Fixes: f830837f0eed ("netfilter: ipset: list:set set type support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netfilter/ipset/ip_set.h | 2 +-
net/netfilter/ipset/ip_set_core.c | 4 ++--
net/netfilter/ipset/ip_set_list_set.c | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index f27894e50ef19..4269b64252787 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -306,7 +306,7 @@ enum {
/* register and unregister set references */
extern ip_set_id_t ip_set_get_byname(struct net *net,
- const char *name, struct ip_set **set);
+ const struct nlattr *name, struct ip_set **set);
extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index a265efd31ba96..cf827d72581e1 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -823,7 +823,7 @@ EXPORT_SYMBOL_GPL(ip_set_del);
*
*/
ip_set_id_t
-ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)
+ip_set_get_byname(struct net *net, const struct nlattr *name, struct ip_set **set)
{
ip_set_id_t i, index = IPSET_INVALID_ID;
struct ip_set *s;
@@ -832,7 +832,7 @@ ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)
rcu_read_lock();
for (i = 0; i < inst->ip_set_max; i++) {
s = rcu_dereference(inst->ip_set_list)[i];
- if (s && STRNCMP(s->name, name)) {
+ if (s && nla_strcmp(name, s->name) == 0) {
__ip_set_get(s);
index = i;
*set = s;
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 5cc35b553a048..7d1ba6ad514f5 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -367,7 +367,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
ret = ip_set_get_extensions(set, tb, &ext);
if (ret)
return ret;
- e.id = ip_set_get_byname(map->net, nla_data(tb[IPSET_ATTR_NAME]), &s);
+ e.id = ip_set_get_byname(map->net, tb[IPSET_ATTR_NAME], &s);
if (e.id == IPSET_INVALID_ID)
return -IPSET_ERR_NAME;
/* "Loop detection" */
@@ -389,7 +389,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
if (tb[IPSET_ATTR_NAMEREF]) {
e.refid = ip_set_get_byname(map->net,
- nla_data(tb[IPSET_ATTR_NAMEREF]),
+ tb[IPSET_ATTR_NAMEREF],
&s);
if (e.refid == IPSET_INVALID_ID) {
ret = -IPSET_ERR_NAMEREF;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 340/491] netfilter: nf_conntrack_helper: pass helper to expect cleanup
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 339/491] netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 341/491] netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Greg Kroah-Hartman
` (155 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Tang, Phil Sutter,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <tpluszz77@gmail.com>
[ Upstream commit a242a9ae58aa46ff7dae51ce64150a93957abe65 ]
nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()
to remove expectations belonging to the helper being unregistered.
However, it passes NULL instead of the helper pointer as the data
argument, so expect_iter_me() never matches any expectation and all
of them survive the cleanup.
After unregister returns, nfnl_cthelper_del() frees the helper
object immediately. Subsequent expectation dumps or packet-driven
init_conntrack() calls then dereference the freed exp->helper,
causing a use-after-free.
Pass the actual helper pointer so expectations referencing it are
properly destroyed before the helper object is freed.
BUG: KASAN: slab-use-after-free in string+0x38f/0x430
Read of size 1 at addr ffff888003b14d20 by task poc/103
Call Trace:
string+0x38f/0x430
vsnprintf+0x3cc/0x1170
seq_printf+0x17a/0x240
exp_seq_show+0x2e5/0x560
seq_read_iter+0x419/0x1280
proc_reg_read+0x1ac/0x270
vfs_read+0x179/0x930
ksys_read+0xef/0x1c0
Freed by task 103:
The buggy address is located 32 bytes inside of
freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)
Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers")
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 89174c91053ed..24f3f8d5e6998 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -468,7 +468,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
*/
synchronize_rcu();
- nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
+ nf_ct_expect_iterate_destroy(expect_iter_me, me);
nf_ct_iterate_destroy(unhelp, me);
/* Maybe someone has gotten the helper already when unhelp above.
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 341/491] netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 340/491] netfilter: nf_conntrack_helper: pass helper to expect cleanup Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 342/491] netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Greg Kroah-Hartman
` (154 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Qi Tang,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <tpluszz77@gmail.com>
[ Upstream commit 35177c6877134a21315f37d57a5577846225623e ]
ctnetlink_alloc_expect() allocates expectations from a non-zeroing
slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not
present in the netlink message, saved_addr and saved_proto are
never initialized. Stale data from a previous slab occupant can
then be dumped to userspace by ctnetlink_exp_dump_expect(), which
checks these fields to decide whether to emit CTA_EXPECT_NAT.
The safe sibling nf_ct_expect_init(), used by the packet path,
explicitly zeroes these fields.
Zero saved_addr, saved_proto and dir in the else branch, guarded
by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when
NAT is enabled.
Confirmed by priming the expect slab with NAT-bearing expectations,
freeing them, creating a new expectation without CTA_EXPECT_NAT,
and observing that the ctnetlink dump emits a spurious
CTA_EXPECT_NAT containing stale data from the prior allocation.
Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 8d35e17a0f7e7..befc9d2bc0b52 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3568,6 +3568,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
exp, nf_ct_l3num(ct));
if (err < 0)
goto err_out;
+#if IS_ENABLED(CONFIG_NF_NAT)
+ } else {
+ memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+ memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+ exp->dir = 0;
+#endif
}
return exp;
err_out:
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 342/491] netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 341/491] netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 343/491] netfilter: nf_tables: reject immediate NF_QUEUE verdict Greg Kroah-Hartman
` (153 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 3d5d488f11776738deab9da336038add95d342d1 ]
Weiming Shi says:
xt_match and xt_target structs registered with NFPROTO_UNSPEC can be
loaded by any protocol family through nft_compat. When such a
match/target sets .hooks to restrict which hooks it may run on, the
bitmask uses NF_INET_* constants. This is only correct for families
whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge
all share the same five hooks (PRE_ROUTING ... POST_ROUTING).
ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different
semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks
validation silently passes for the wrong reasons, allowing matches to
run on ARP chains where the hook assumptions (e.g. state->in being
set on input hooks) do not hold. This leads to NULL pointer
dereferences; xt_devgroup is one concrete example:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
RIP: 0010:devgroup_mt+0xff/0x350
Call Trace:
<TASK>
nft_match_eval (net/netfilter/nft_compat.c:407)
nft_do_chain (net/netfilter/nf_tables_core.c:285)
nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61)
nf_hook_slow (net/netfilter/core.c:623)
arp_xmit (net/ipv4/arp.c:666)
</TASK>
Kernel panic - not syncing: Fatal exception in interrupt
Fix it by restricting arptables to NFPROTO_ARP extensions only.
Note that arptables-legacy only supports:
- arpt_CLASSIFY
- arpt_mangle
- arpt_MARK
that provide explicit NFPROTO_ARP match/target declarations.
Fixes: 9291747f118d ("netfilter: xtables: add device group match")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/x_tables.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 92e9d4ebc5e8d..94778fae2d91d 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -481,6 +481,17 @@ int xt_check_match(struct xt_mtchk_param *par,
par->match->table, par->table);
return -EINVAL;
}
+
+ /* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with
+ * NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP
+ * support.
+ */
+ if (par->family == NFPROTO_ARP &&
+ par->match->family != NFPROTO_ARP) {
+ pr_info_ratelimited("%s_tables: %s match: not valid for this family\n",
+ xt_prefix[par->family], par->match->name);
+ return -EINVAL;
+ }
if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
char used[64], allow[64];
@@ -996,6 +1007,18 @@ int xt_check_target(struct xt_tgchk_param *par,
par->target->table, par->table);
return -EINVAL;
}
+
+ /* NFPROTO_UNSPEC implies NF_INET_* hooks which do not overlap with
+ * NF_ARP_IN,OUT,FORWARD, allow explicit extensions with NFPROTO_ARP
+ * support.
+ */
+ if (par->family == NFPROTO_ARP &&
+ par->target->family != NFPROTO_ARP) {
+ pr_info_ratelimited("%s_tables: %s target: not valid for this family\n",
+ xt_prefix[par->family], par->target->name);
+ return -EINVAL;
+ }
+
if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
char used[64], allow[64];
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 343/491] netfilter: nf_tables: reject immediate NF_QUEUE verdict
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 342/491] netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 344/491] Bluetooth: MGMT: validate LTK enc_size on load Greg Kroah-Hartman
` (152 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec ]
nft_queue is always used from userspace nftables to deliver the NF_QUEUE
verdict. Immediately emitting an NF_QUEUE verdict is never used by the
userspace nft tools, so reject immediate NF_QUEUE verdicts.
The arp family does not provide queue support, but such an immediate
verdict is still reachable. Globally reject NF_QUEUE immediate verdicts
to address this issue.
Fixes: f342de4e2f33 ("netfilter: nf_tables: reject QUEUE/DROP verdict parameters")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 189997bcaeef5..15486d3051f6b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9362,8 +9362,6 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
switch (data->verdict.code) {
case NF_ACCEPT:
case NF_DROP:
- case NF_QUEUE:
- break;
case NFT_CONTINUE:
case NFT_BREAK:
case NFT_RETURN:
@@ -9398,6 +9396,11 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
data->verdict.chain = chain;
break;
+ case NF_QUEUE:
+ /* The nft_queue expression is used for this purpose, an
+ * immediate NF_QUEUE verdict should not ever be seen here.
+ */
+ fallthrough;
default:
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 344/491] Bluetooth: MGMT: validate LTK enc_size on load
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 343/491] netfilter: nf_tables: reject immediate NF_QUEUE verdict Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 345/491] rds: ib: reject FRMR registration before IB connection is established Greg Kroah-Hartman
` (151 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keenan Dong, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <keenanat2000@gmail.com>
[ Upstream commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ]
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.
Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index fda0bd990dcb7..b768abbf2b121 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5948,6 +5948,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key)
if (key->initiator != 0x00 && key->initiator != 0x01)
return false;
+ if (key->enc_size > sizeof(key->val))
+ return false;
+
switch (key->addr.type) {
case BDADDR_LE_PUBLIC:
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 345/491] rds: ib: reject FRMR registration before IB connection is established
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 344/491] Bluetooth: MGMT: validate LTK enc_size on load Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 346/491] net: macb: fix clk handling on PCI glue driver removal Greg Kroah-Hartman
` (150 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Allison Henderson, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit a54ecccfae62c5c85259ae5ea5d9c20009519049 ]
rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
i_cm_id = NULL because the connection worker has not yet called
rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
the control message before any connection establishment, allowing
rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
kernel.
The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
commit 9e630bcb7701), which does not catch this case since ic is allocated
early and is always non-NULL once the connection object exists.
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
Call Trace:
rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
rds_ib_map_frmr (net/rds/ib_frmr.c:252)
rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
rds_ib_get_mr (net/rds/ib_rdma.c:615)
__rds_rdma_map (net/rds/rdma.c:295)
rds_cmsg_rdma_map (net/rds/rdma.c:860)
rds_sendmsg (net/rds/send.c:1363)
____sys_sendmsg
do_syscall_64
Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
non-NULL before proceeding with FRMR registration, mirroring the guard
already present in rds_ib_post_inv(). Return -ENODEV when the connection
is not ready, which the existing error handling in rds_cmsg_send() converts
to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
start the connection worker.
Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260330163237.2752440-2-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/ib_rdma.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 8f070ee7e7426..30fca2169aa7a 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -608,8 +608,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
return ibmr;
}
- if (conn)
+ if (conn) {
ic = conn->c_transport_data;
+ if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) {
+ ret = -ENODEV;
+ goto out;
+ }
+ }
if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
ret = -ENODEV;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 346/491] net: macb: fix clk handling on PCI glue driver removal
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 345/491] rds: ib: reject FRMR registration before IB connection is established Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 347/491] net: macb: properly unregister fixed rate clocks Greg Kroah-Hartman
` (149 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit ce8fe5287b87e24e225c342f3b0ec04f0b3680fe ]
platform_device_unregister() may still want to use the registered clks
during runtime resume callback.
Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free
on rmmod") that addressed the similar problem of clk vs platform device
unregistration but just moved the bug to another place.
Save the pointers to clks into local variables for reuse after platform
device is unregistered.
BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60
Read of size 8 at addr ffff888104f85e00 by task modprobe/597
CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x8d/0xba
print_report+0x17f/0x496
kasan_report+0xd9/0x180
clk_prepare+0x5a/0x60
macb_runtime_resume+0x13d/0x410 [macb]
pm_generic_runtime_resume+0x97/0xd0
__rpm_callback+0xc8/0x4d0
rpm_callback+0xf6/0x230
rpm_resume+0xeeb/0x1a70
__pm_runtime_resume+0xb4/0x170
bus_remove_device+0x2e3/0x4b0
device_del+0x5b3/0xdc0
platform_device_del+0x4e/0x280
platform_device_unregister+0x11/0x50
pci_device_remove+0xae/0x210
device_remove+0xcb/0x180
device_release_driver_internal+0x529/0x770
driver_detach+0xd4/0x1a0
bus_remove_driver+0x135/0x260
driver_unregister+0x72/0xb0
pci_unregister_driver+0x26/0x220
__do_sys_delete_module+0x32e/0x550
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
</TASK>
Allocated by task 519:
kasan_save_stack+0x2c/0x50
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x8e/0x90
__clk_register+0x458/0x2890
clk_hw_register+0x1a/0x60
__clk_hw_register_fixed_rate+0x255/0x410
clk_register_fixed_rate+0x3c/0xa0
macb_probe+0x1d8/0x42e [macb_pci]
local_pci_probe+0xd7/0x190
pci_device_probe+0x252/0x600
really_probe+0x255/0x7f0
__driver_probe_device+0x1ee/0x330
driver_probe_device+0x4c/0x1f0
__driver_attach+0x1df/0x4e0
bus_for_each_dev+0x15d/0x1f0
bus_add_driver+0x486/0x5e0
driver_register+0x23a/0x3d0
do_one_initcall+0xfd/0x4d0
do_init_module+0x18b/0x5a0
load_module+0x5663/0x7950
__do_sys_finit_module+0x101/0x180
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 597:
kasan_save_stack+0x2c/0x50
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x50
__kasan_slab_free+0x106/0x180
__kmem_cache_free+0xbc/0x320
clk_unregister+0x6de/0x8d0
macb_remove+0x73/0xc0 [macb_pci]
pci_device_remove+0xae/0x210
device_remove+0xcb/0x180
device_release_driver_internal+0x529/0x770
driver_detach+0xd4/0x1a0
bus_remove_driver+0x135/0x260
driver_unregister+0x72/0xb0
pci_unregister_driver+0x26/0x220
__do_sys_delete_module+0x32e/0x550
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Fixes: d82d5303c4c5 ("net: macb: fix use after free on rmmod")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20260330184542.626619-1-pchelkin@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_pci.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_pci.c b/drivers/net/ethernet/cadence/macb_pci.c
index 3593b310c325d..9be050c5d83e0 100644
--- a/drivers/net/ethernet/cadence/macb_pci.c
+++ b/drivers/net/ethernet/cadence/macb_pci.c
@@ -110,10 +110,12 @@ static void macb_remove(struct pci_dev *pdev)
{
struct platform_device *plat_dev = pci_get_drvdata(pdev);
struct macb_platform_data *plat_data = dev_get_platdata(&plat_dev->dev);
+ struct clk *pclk = plat_data->pclk;
+ struct clk *hclk = plat_data->hclk;
- clk_unregister(plat_data->pclk);
- clk_unregister(plat_data->hclk);
platform_device_unregister(plat_dev);
+ clk_unregister(pclk);
+ clk_unregister(hclk);
}
static const struct pci_device_id dev_id_table[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 347/491] net: macb: properly unregister fixed rate clocks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 346/491] net: macb: fix clk handling on PCI glue driver removal Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 348/491] net/mlx5: Avoid "No data available" when FW version queries fail Greg Kroah-Hartman
` (148 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit f0f367a4f459cc8118aadc43c6bba53c60d93f8d ]
The additional resources allocated with clk_register_fixed_rate() need
to be released with clk_unregister_fixed_rate(), otherwise they are lost.
Fixes: 83a77e9ec415 ("net: macb: Added PCI wrapper for Platform Driver.")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20260330184542.626619-2-pchelkin@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_pci.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_pci.c b/drivers/net/ethernet/cadence/macb_pci.c
index 9be050c5d83e0..e6c17e0af1ccf 100644
--- a/drivers/net/ethernet/cadence/macb_pci.c
+++ b/drivers/net/ethernet/cadence/macb_pci.c
@@ -97,10 +97,10 @@ static int macb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return 0;
err_plat_dev_register:
- clk_unregister(plat_data.hclk);
+ clk_unregister_fixed_rate(plat_data.hclk);
err_hclk_register:
- clk_unregister(plat_data.pclk);
+ clk_unregister_fixed_rate(plat_data.pclk);
err_pclk_register:
return err;
@@ -114,8 +114,8 @@ static void macb_remove(struct pci_dev *pdev)
struct clk *hclk = plat_data->hclk;
platform_device_unregister(plat_dev);
- clk_unregister(pclk);
- clk_unregister(hclk);
+ clk_unregister_fixed_rate(pclk);
+ clk_unregister_fixed_rate(hclk);
}
static const struct pci_device_id dev_id_table[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 348/491] net/mlx5: Avoid "No data available" when FW version queries fail
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 347/491] net: macb: properly unregister fixed rate clocks Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 349/491] net/x25: Fix potential double free of skb Greg Kroah-Hartman
` (147 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saeed Mahameed, Moshe Shemesh,
Tariq Toukan, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <saeedm@nvidia.com>
[ Upstream commit 10dc35f6a443d488f219d1a1e3fb8f8dac422070 ]
Avoid printing the misleading "kernel answers: No data available" devlink
output when querying firmware or pending firmware version fails
(e.g. MLX5 fw state errors / flash failures).
FW can fail on loading the pending flash image and get its version due
to various reasons, examples:
mlxfw: Firmware flash failed: key not applicable, err (7)
mlx5_fw_image_pending: can't read pending fw version while fw state is 1
and the resulting:
$ devlink dev info
kernel answers: No data available
Instead, just report 0 or 0xfff.. versions in case of failure to indicate
a problem, and let other information be shown.
after the fix:
$ devlink dev info
pci/0000:00:06.0:
driver mlx5_core
serial_number xxx...
board.serial_number MT2225300179
versions:
fixed:
fw.psid MT_0000000436
running:
fw.version 22.41.0188
fw 22.41.0188
stored:
fw.version 255.255.65535
fw 255.255.65535
Fixes: 9c86b07e3069 ("net/mlx5: Added fw version query command")
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260330194015.53585-3-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/devlink.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/fw.c | 53 ++++++++++++-------
.../ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +-
3 files changed, 37 insertions(+), 24 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 060561f633114..62ac22d82e1a9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -60,9 +60,7 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req,
if (err)
return err;
- err = mlx5_fw_version_query(dev, &running_fw, &stored_fw);
- if (err)
- return err;
+ mlx5_fw_version_query(dev, &running_fw, &stored_fw);
snprintf(version_str, sizeof(version_str), "%d.%d.%04d",
mlx5_fw_ver_major(running_fw), mlx5_fw_ver_minor(running_fw),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
index 02558ac2ace69..eb414452dbd0f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
@@ -770,48 +770,63 @@ mlx5_fw_image_pending(struct mlx5_core_dev *dev,
return 0;
}
-int mlx5_fw_version_query(struct mlx5_core_dev *dev,
- u32 *running_ver, u32 *pending_ver)
+void mlx5_fw_version_query(struct mlx5_core_dev *dev,
+ u32 *running_ver, u32 *pending_ver)
{
u32 reg_mcqi_version[MLX5_ST_SZ_DW(mcqi_version)] = {};
bool pending_version_exists;
int component_index;
int err;
+ *running_ver = 0;
+ *pending_ver = 0;
+
if (!MLX5_CAP_GEN(dev, mcam_reg) || !MLX5_CAP_MCAM_REG(dev, mcqi) ||
!MLX5_CAP_MCAM_REG(dev, mcqs)) {
mlx5_core_warn(dev, "fw query isn't supported by the FW\n");
- return -EOPNOTSUPP;
+ return;
}
component_index = mlx5_get_boot_img_component_index(dev);
- if (component_index < 0)
- return component_index;
+ if (component_index < 0) {
+ mlx5_core_warn(dev, "fw query failed to find boot img component index, err %d\n",
+ component_index);
+ return;
+ }
+ *running_ver = U32_MAX; /* indicate failure */
err = mlx5_reg_mcqi_version_query(dev, component_index,
MCQI_FW_RUNNING_VERSION,
reg_mcqi_version);
- if (err)
- return err;
-
- *running_ver = MLX5_GET(mcqi_version, reg_mcqi_version, version);
-
+ if (!err)
+ *running_ver = MLX5_GET(mcqi_version, reg_mcqi_version,
+ version);
+ else
+ mlx5_core_warn(dev, "failed to query running version, err %d\n",
+ err);
+
+ *pending_ver = U32_MAX; /* indicate failure */
err = mlx5_fw_image_pending(dev, component_index, &pending_version_exists);
- if (err)
- return err;
+ if (err) {
+ mlx5_core_warn(dev, "failed to query pending image, err %d\n",
+ err);
+ return;
+ }
if (!pending_version_exists) {
*pending_ver = 0;
- return 0;
+ return;
}
err = mlx5_reg_mcqi_version_query(dev, component_index,
MCQI_FW_STORED_VERSION,
reg_mcqi_version);
- if (err)
- return err;
-
- *pending_ver = MLX5_GET(mcqi_version, reg_mcqi_version, version);
-
- return 0;
+ if (!err)
+ *pending_ver = MLX5_GET(mcqi_version, reg_mcqi_version,
+ version);
+ else
+ mlx5_core_warn(dev, "failed to query pending version, err %d\n",
+ err);
+
+ return;
}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index b285f1515e4e8..d3279536c902c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -209,8 +209,8 @@ void mlx5_dm_cleanup(struct mlx5_core_dev *dev);
int mlx5_firmware_flash(struct mlx5_core_dev *dev, const struct firmware *fw,
struct netlink_ext_ack *extack);
-int mlx5_fw_version_query(struct mlx5_core_dev *dev,
- u32 *running_ver, u32 *stored_ver);
+void mlx5_fw_version_query(struct mlx5_core_dev *dev, u32 *running_ver,
+ u32 *stored_ver);
void mlx5e_init(void);
void mlx5e_cleanup(void);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 349/491] net/x25: Fix potential double free of skb
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 348/491] net/mlx5: Avoid "No data available" when FW version queries fail Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 350/491] net/x25: Fix overflow when accumulating packets Greg Kroah-Hartman
` (146 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Schiller, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit d10a26aa4d072320530e6968ef945c8c575edf61 ]
When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:
x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again
This would free the same skb twice. Looking at x25_backlog_rcv:
net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://patch.msgid.link/20260331-x25_fraglen-v4-1-3e69f18464b4@dev.tdt.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/x25/x25_in.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index e1c4197af468e..77ad186507f64 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -44,10 +44,9 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
if (!more && x25->fraglen > 0) { /* End of fragment */
int len = x25->fraglen + skb->len;
- if ((skbn = alloc_skb(len, GFP_ATOMIC)) == NULL){
- kfree_skb(skb);
+ skbn = alloc_skb(len, GFP_ATOMIC);
+ if (!skbn)
return 1;
- }
skb_queue_tail(&x25->fragment_queue, skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 350/491] net/x25: Fix overflow when accumulating packets
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 349/491] net/x25: Fix potential double free of skb Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 351/491] net/sched: cls_fw: fix NULL pointer dereference on shared blocks Greg Kroah-Hartman
` (145 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Martin Schiller,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit a1822cb524e89b4cd2cf0b82e484a2335496a6d9 ]
Add a check to ensure that `x25_sock.fraglen` does not overflow.
The `fraglen` also needs to be resetted when purging `fragment_queue` in
`x25_clear_queues()`.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://patch.msgid.link/20260331-x25_fraglen-v4-2-3e69f18464b4@dev.tdt.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/x25/x25_in.c | 4 ++++
net/x25/x25_subr.c | 1 +
2 files changed, 5 insertions(+)
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 77ad186507f64..956e056803079 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -34,6 +34,10 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
struct sk_buff *skbo, *skbn = skb;
struct x25_sock *x25 = x25_sk(sk);
+ /* make sure we don't overflow */
+ if (x25->fraglen + skb->len > USHRT_MAX)
+ return 1;
+
if (more) {
x25->fraglen += skb->len;
skb_queue_tail(&x25->fragment_queue, skb);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 0285aaa1e93c1..159708d9ad20c 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -40,6 +40,7 @@ void x25_clear_queues(struct sock *sk)
skb_queue_purge(&x25->interrupt_in_queue);
skb_queue_purge(&x25->interrupt_out_queue);
skb_queue_purge(&x25->fragment_queue);
+ x25->fraglen = 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 351/491] net/sched: cls_fw: fix NULL pointer dereference on shared blocks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 350/491] net/x25: Fix overflow when accumulating packets Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 352/491] net/sched: cls_flow: " Greg Kroah-Hartman
` (144 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit faeea8bbf6e958bf3c00cb08263109661975987c ]
The old-method path in fw_classify() calls tcf_block_q() and
dereferences q->handle. Shared blocks leave block->q NULL, causing a
NULL deref when an empty cls_fw filter is attached to a shared block
and a packet with a nonzero major skb mark is classified.
Reject the configuration in fw_change() when the old method (no
TCA_OPTIONS) is used on a shared block, since fw_classify()'s
old-method path needs block->q which is NULL for shared blocks.
The fixed null-ptr-deref calling stack:
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
RIP: 0010:fw_classify (net/sched/cls_fw.c:81)
Call Trace:
tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)
tc_run (net/core/dev.c:4401)
__dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)
Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260331050217.504278-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_fw.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 08c41f1976c47..23cf4f7111174 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -246,8 +246,18 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
struct nlattr *tb[TCA_FW_MAX + 1];
int err;
- if (!opt)
- return handle ? -EINVAL : 0; /* Succeed if it is old method. */
+ if (!opt) {
+ if (handle)
+ return -EINVAL;
+
+ if (tcf_block_shared(tp->chain->block)) {
+ NL_SET_ERR_MSG(extack,
+ "Must specify mark when attaching fw filter to block");
+ return -EINVAL;
+ }
+
+ return 0; /* Succeed if it is old method. */
+ }
err = nla_parse_nested_deprecated(tb, TCA_FW_MAX, opt, fw_policy,
NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 352/491] net/sched: cls_flow: fix NULL pointer dereference on shared blocks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 351/491] net/sched: cls_fw: fix NULL pointer dereference on shared blocks Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 353/491] ipv6: avoid overflows in ip6_datagram_send_ctl() Greg Kroah-Hartman
` (143 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 1a280dd4bd1d616a01d6ffe0de284c907b555504 ]
flow_change() calls tcf_block_q() and dereferences q->handle to derive
a default baseclass. Shared blocks leave block->q NULL, causing a NULL
deref when a flow filter without a fully qualified baseclass is created
on a shared block.
Check tcf_block_shared() before accessing block->q and return -EINVAL
for shared blocks. This avoids the null-deref shown below:
=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
RIP: 0010:flow_change (net/sched/cls_flow.c:508)
Call Trace:
tc_new_tfilter (net/sched/cls_api.c:2432)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)
[...]
=======================================================================
Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_flow.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 117c7b038591e..7918ecdcfe696 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -501,8 +501,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
}
if (TC_H_MAJ(baseclass) == 0) {
- struct Qdisc *q = tcf_block_q(tp->chain->block);
+ struct tcf_block *block = tp->chain->block;
+ struct Qdisc *q;
+ if (tcf_block_shared(block)) {
+ NL_SET_ERR_MSG(extack,
+ "Must specify baseclass when attaching flow filter to block");
+ goto err2;
+ }
+
+ q = tcf_block_q(block);
baseclass = TC_H_MAKE(q->handle, baseclass);
}
if (TC_H_MIN(baseclass) == 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 353/491] ipv6: avoid overflows in ip6_datagram_send_ctl()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 352/491] net/sched: cls_flow: " Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 354/491] efi/mokvar-table: Avoid repeated map/unmap of the same page Greg Kroah-Hartman
` (142 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Eric Dumazet,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e ]
Yiming Qian reported :
<quote>
I believe I found a locally triggerable kernel bug in the IPv6 sendmsg
ancillary-data path that can panic the kernel via `skb_under_panic()`
(local DoS).
The core issue is a mismatch between:
- a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type
`__u16`) and
- a pointer to the *last* provided destination-options header (`opt->dst1opt`)
when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.
- `include/net/ipv6.h`:
- `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).
(lines 291-307, especially 298)
- `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:
- Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`
without rejecting duplicates. (lines 909-933)
- `net/ipv6/ip6_output.c:__ip6_append_data()`:
- Uses `opt->opt_flen + opt->opt_nflen` to compute header
sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)
- `net/ipv6/ip6_output.c:__ip6_make_skb()`:
- Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero.
(lines 1930-1934)
- `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:
- Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the
pointed-to header). (lines 1179-1185 and 1206-1211)
1. `opt_flen` is a 16-bit accumulator:
- `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.
2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs
and increments `opt_flen` each time:
- In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:
- It computes `len = ((hdr->hdrlen + 1) << 3);`
- It checks `CAP_NET_RAW` using `ns_capable(net->user_ns,
CAP_NET_RAW)`. (line 922)
- Then it does:
- `opt->opt_flen += len;` (line 927)
- `opt->dst1opt = hdr;` (line 928)
There is no duplicate rejection here (unlike the legacy
`IPV6_2292DSTOPTS` path which rejects duplicates at
`net/ipv6/datagram.c:901-904`).
If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps
while `dst1opt` still points to a large (2048-byte)
destination-options header.
In the attached PoC (`poc.c`):
- 32 cmsgs with `hdrlen=255` => `len = (255+1)*8 = 2048`
- 1 cmsg with `hdrlen=0` => `len = 8`
- Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8`
- The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.
3. The transmit path sizes headers using the wrapped `opt_flen`:
- In `net/ipv6/ip6_output.c:1463-1465`:
- `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +
opt->opt_nflen : 0) + ...;`
With wrapped `opt_flen`, `headersize`/headroom decisions underestimate
what will be pushed later.
4. When building the final skb, the actual push length comes from
`dst1opt` and is not limited by wrapped `opt_flen`:
- In `net/ipv6/ip6_output.c:1930-1934`:
- `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);`
- In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes
`dst1opt` via `ipv6_push_exthdr()`.
- In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:
- `skb_push(skb, ipv6_optlen(opt));`
- `memcpy(h, opt, ipv6_optlen(opt));`
With insufficient headroom, `skb_push()` underflows and triggers
`skb_under_panic()` -> `BUG()`:
- `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)
- `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)
- The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target
netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`).
- Root (or any task with `CAP_NET_RAW`) can trigger this without user
namespaces.
- An unprivileged `uid=1000` user can trigger this if unprivileged
user namespaces are enabled and it can create a userns+netns to obtain
namespaced `CAP_NET_RAW` (the attached PoC does this).
- Local denial of service: kernel BUG/panic (system crash).
- Reproducible with a small userspace PoC.
</quote>
This patch does not reject duplicated options, as this might break
some user applications.
Instead, it makes sure to adjust opt_flen and opt_nflen to correctly
reflect the size of the current option headers, preventing the overflows
and the potential for panics.
This applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR.
Specifically:
When a new IPV6_DSTOPTS is processed, the length of the old opt->dst1opt
is subtracted from opt->opt_flen before adding the new length.
When a new IPV6_HOPOPTS is processed, the length of the old opt->dst0opt
is subtracted from opt->opt_nflen.
When a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed,
the length of the old opt->srcrt is subtracted from opt->opt_nflen.
In the special case within IPV6_2292RTHDR handling where dst1opt is moved
to dst0opt, the length of the old opt->dst0opt is subtracted from
opt->opt_nflen before the new one is added.
Fixes: 333fad5364d6 ("[IPV6]: Support several new sockopt / ancillary data in Advanced API (RFC3542).")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Closes: https://lore.kernel.org/netdev/CAL_bE8JNzawgr5OX5m+3jnQDHry2XxhQT5=jThW1zDPtUikRYA@mail.gmail.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260401154721.3740056-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/datagram.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a30ff5d6808aa..d8af31805133f 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -756,6 +756,7 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
{
struct in6_pktinfo *src_info;
struct cmsghdr *cmsg;
+ struct ipv6_rt_hdr *orthdr;
struct ipv6_rt_hdr *rthdr;
struct ipv6_opt_hdr *hdr;
struct ipv6_txoptions *opt = ipc6->opt;
@@ -917,9 +918,13 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
goto exit_f;
}
if (cmsg->cmsg_type == IPV6_DSTOPTS) {
+ if (opt->dst1opt)
+ opt->opt_flen -= ipv6_optlen(opt->dst1opt);
opt->opt_flen += len;
opt->dst1opt = hdr;
} else {
+ if (opt->dst0opt)
+ opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
opt->opt_nflen += len;
opt->dst0opt = hdr;
}
@@ -962,12 +967,17 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
goto exit_f;
}
+ orthdr = opt->srcrt;
+ if (orthdr)
+ opt->opt_nflen -= ((orthdr->hdrlen + 1) << 3);
opt->opt_nflen += len;
opt->srcrt = rthdr;
if (cmsg->cmsg_type == IPV6_2292RTHDR && opt->dst1opt) {
int dsthdrlen = ((opt->dst1opt->hdrlen+1)<<3);
+ if (opt->dst0opt)
+ opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
opt->opt_nflen += dsthdrlen;
opt->dst0opt = opt->dst1opt;
opt->dst1opt = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 354/491] efi/mokvar-table: Avoid repeated map/unmap of the same page
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 353/491] ipv6: avoid overflows in ip6_datagram_send_ctl() Greg Kroah-Hartman
@ 2026-04-13 15:59 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 355/491] Revert "drm/vmwgfx: Add seqno waiter for sync_files" Greg Kroah-Hartman
` (141 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 15:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Jones, Ard Biesheuvel,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit e3cf2d91d0583cae70aeb512da87e3ade25ea912 ]
Tweak the logic that traverses the MOKVAR UEFI configuration table to
only unmap the entry header and map the next one if they don't live in
the same physical page.
Link: https://lore.kernel.org/all/8f085931-3e9d-4386-9209-1d6c95616327@uncooperative.org/
Tested-By: Peter Jones <pjones@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/mokvar-table.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c
index 39a49adf007a5..69ac876ca809d 100644
--- a/drivers/firmware/efi/mokvar-table.c
+++ b/drivers/firmware/efi/mokvar-table.c
@@ -99,13 +99,13 @@ static struct kobject *mokvar_kobj;
*/
void __init efi_mokvar_table_init(void)
{
+ struct efi_mokvar_table_entry __aligned(1) *mokvar_entry, *next_entry;
efi_memory_desc_t md;
void *va = NULL;
unsigned long cur_offset = 0;
unsigned long offset_limit;
unsigned long map_size_needed = 0;
unsigned long size;
- struct efi_mokvar_table_entry *mokvar_entry;
int err;
if (!efi_enabled(EFI_MEMMAP))
@@ -142,7 +142,7 @@ void __init efi_mokvar_table_init(void)
return;
}
mokvar_entry = va;
-
+next:
/* Check for last sentinel entry */
if (mokvar_entry->name[0] == '\0') {
if (mokvar_entry->data_size != 0)
@@ -156,7 +156,19 @@ void __init efi_mokvar_table_init(void)
mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0';
/* Advance to the next entry */
- cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size;
+ size = sizeof(*mokvar_entry) + mokvar_entry->data_size;
+ cur_offset += size;
+
+ /*
+ * Don't bother remapping if the current entry header and the
+ * next one end on the same page.
+ */
+ next_entry = (void *)((unsigned long)mokvar_entry + size);
+ if (((((unsigned long)(mokvar_entry + 1) - 1) ^
+ ((unsigned long)(next_entry + 1) - 1)) & PAGE_MASK) == 0) {
+ mokvar_entry = next_entry;
+ goto next;
+ }
}
if (va)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 355/491] Revert "drm/vmwgfx: Add seqno waiter for sync_files"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-04-13 15:59 ` [PATCH 5.10 354/491] efi/mokvar-table: Avoid repeated map/unmap of the same page Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 356/491] drm/vmwgfx: Add seqno waiter for sync_files Greg Kroah-Hartman
` (140 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 7db6c88bb52f3b7525a06110cfd208990c49f8b4.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 -------------------------
1 file changed, 26 deletions(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 361f96d09374d..daea547704ddc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -4039,23 +4039,6 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
return 0;
}
-/*
- * DMA fence callback to remove a seqno_waiter
- */
-struct seqno_waiter_rm_context {
- struct dma_fence_cb base;
- struct vmw_private *dev_priv;
-};
-
-static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
-{
- struct seqno_waiter_rm_context *ctx =
- container_of(cb, struct seqno_waiter_rm_context, base);
-
- vmw_seqno_waiter_remove(ctx->dev_priv);
- kfree(ctx);
-}
-
int vmw_execbuf_process(struct drm_file *file_priv,
struct vmw_private *dev_priv,
void __user *user_commands, void *kernel_commands,
@@ -4249,15 +4232,6 @@ int vmw_execbuf_process(struct drm_file *file_priv,
} else {
/* Link the fence with the FD created earlier */
fd_install(out_fence_fd, sync_file->file);
- struct seqno_waiter_rm_context *ctx =
- kmalloc(sizeof(*ctx), GFP_KERNEL);
- ctx->dev_priv = dev_priv;
- vmw_seqno_waiter_add(dev_priv);
- if (dma_fence_add_callback(&fence->base, &ctx->base,
- seqno_waiter_rm_cb) < 0) {
- vmw_seqno_waiter_remove(dev_priv);
- kfree(ctx);
- }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 356/491] drm/vmwgfx: Add seqno waiter for sync_files
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 355/491] Revert "drm/vmwgfx: Add seqno waiter for sync_files" Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 357/491] Revert "scsi: core: Wake up the error handler when final completions race against each other" Greg Kroah-Hartman
` (139 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Forbes, Zack Rusin, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <ian.forbes@broadcom.com>
[ Upstream commit 0039a3b35b10d9c15d3d26320532ab56cc566750 ]
Because sync_files are passive waiters they do not participate in
the processing of fences like the traditional vmw_fence_wait IOCTL.
If userspace exclusively uses sync_files for synchronization then
nothing in the kernel actually processes fence updates as interrupts
for fences are masked and ignored if the kernel does not indicate to the
SVGA device that there are active waiters.
This oversight results in a bug where the entire GUI can freeze waiting
on a sync_file that will never be signalled as we've masked the interrupts
to signal its completion. This bug is incredibly racy as any process which
interacts with the fencing code via the 3D stack can process the stuck
fences on behalf of the stuck process causing it to run again. Even a
simple app like eglinfo is enough to resume the stuck process. Usually
this bug is seen at a login screen like GDM because there are no other
3D apps running.
By adding a seqno waiter we re-enable interrupt based processing of the
dma_fences associated with the sync_file which is signalled as part of a
dma_fence_callback.
This has likely been broken since it was initially added to the kernel in
2017 but has gone unnoticed until mutter recently started using sync_files
heavily over the course of 2024 as part of their explicit sync support.
Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250228200633.642417-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 +++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index daea547704ddc..9bec26fda14cb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -4039,6 +4039,23 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
return 0;
}
+/*
+ * DMA fence callback to remove a seqno_waiter
+ */
+struct seqno_waiter_rm_context {
+ struct dma_fence_cb base;
+ struct vmw_private *dev_priv;
+};
+
+static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
+{
+ struct seqno_waiter_rm_context *ctx =
+ container_of(cb, struct seqno_waiter_rm_context, base);
+
+ vmw_seqno_waiter_remove(ctx->dev_priv);
+ kfree(ctx);
+}
+
int vmw_execbuf_process(struct drm_file *file_priv,
struct vmw_private *dev_priv,
void __user *user_commands, void *kernel_commands,
@@ -4230,8 +4247,17 @@ int vmw_execbuf_process(struct drm_file *file_priv,
fput(sync_file->file);
put_unused_fd(out_fence_fd);
} else {
+ struct seqno_waiter_rm_context *ctx;
/* Link the fence with the FD created earlier */
fd_install(out_fence_fd, sync_file->file);
+ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+ ctx->dev_priv = dev_priv;
+ vmw_seqno_waiter_add(dev_priv);
+ if (dma_fence_add_callback(&fence->base, &ctx->base,
+ seqno_waiter_rm_cb) < 0) {
+ vmw_seqno_waiter_remove(dev_priv);
+ kfree(ctx);
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 357/491] Revert "scsi: core: Wake up the error handler when final completions race against each other"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 356/491] drm/vmwgfx: Add seqno waiter for sync_files Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 358/491] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
` (138 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit cc872e35c0df80062abc71268d690a2f749e542e.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_error.c | 11 +----------
drivers/scsi/scsi_lib.c | 8 --------
2 files changed, 1 insertion(+), 18 deletions(-)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 4e9114f069832..ffc6f3031e82b 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -241,20 +241,11 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
{
struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
struct Scsi_Host *shost = scmd->device->host;
- unsigned int busy;
+ unsigned int busy = scsi_host_busy(shost);
unsigned long flags;
spin_lock_irqsave(shost->host_lock, flags);
shost->host_failed++;
- spin_unlock_irqrestore(shost->host_lock, flags);
- /*
- * The counting of busy requests needs to occur after adding to
- * host_failed or after the lock acquire for adding to host_failed
- * to prevent a race with host unbusy and missing an eh wakeup.
- */
- busy = scsi_host_busy(shost);
-
- spin_lock_irqsave(shost->host_lock, flags);
scsi_eh_wakeup(shost, busy);
spin_unlock_irqrestore(shost->host_lock, flags);
}
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 8d570632982f3..fb48d47e9183e 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -310,14 +310,6 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
rcu_read_lock();
__clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
if (unlikely(scsi_host_in_recovery(shost))) {
- /*
- * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
- * other CPUs before counting busy requests. Otherwise,
- * reordering can cause CPUs to race and miss an eh wakeup
- * when no CPU sees all busy requests as done or timed out.
- */
- smp_mb();
-
unsigned int busy = scsi_host_busy(shost);
spin_lock_irqsave(shost->host_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 358/491] scsi: core: Wake up the error handler when final completions race against each other
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 357/491] Revert "scsi: core: Wake up the error handler when final completions race against each other" Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 359/491] Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" Greg Kroah-Hartman
` (137 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Jeffery, Bart Van Assche,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Jeffery <djeffery@redhat.com>
[ Upstream commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 ]
The fragile ordering between marking commands completed or failed so
that the error handler only wakes when the last running command
completes or times out has race conditions. These race conditions can
cause the SCSI layer to fail to wake the error handler, leaving I/O
through the SCSI host stuck as the error state cannot advance.
First, there is an memory ordering issue within scsi_dec_host_busy().
The write which clears SCMD_STATE_INFLIGHT may be reordered with reads
counting in scsi_host_busy(). While the local CPU will see its own
write, reordering can allow other CPUs in scsi_dec_host_busy() or
scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to
see a host busy equal to the host_failed count.
This race condition can be prevented with a memory barrier on the error
path to force the write to be visible before counting host busy
commands.
Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By
counting busy commands before incrementing host_failed, it can race with a
final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does
not see host_failed incremented but scsi_eh_inc_host_failed() counts busy
commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),
resulting in neither waking the error handler task.
This needs the call to scsi_host_busy() to be moved after host_failed is
incremented to close the race condition.
Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq")
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260113161036.6730-1-djeffery@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_error.c | 11 ++++++++++-
drivers/scsi/scsi_lib.c | 11 ++++++++++-
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index ffc6f3031e82b..4e9114f069832 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -241,11 +241,20 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
{
struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
struct Scsi_Host *shost = scmd->device->host;
- unsigned int busy = scsi_host_busy(shost);
+ unsigned int busy;
unsigned long flags;
spin_lock_irqsave(shost->host_lock, flags);
shost->host_failed++;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+ /*
+ * The counting of busy requests needs to occur after adding to
+ * host_failed or after the lock acquire for adding to host_failed
+ * to prevent a race with host unbusy and missing an eh wakeup.
+ */
+ busy = scsi_host_busy(shost);
+
+ spin_lock_irqsave(shost->host_lock, flags);
scsi_eh_wakeup(shost, busy);
spin_unlock_irqrestore(shost->host_lock, flags);
}
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index fb48d47e9183e..e69d1c0ea4507 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -310,7 +310,16 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
rcu_read_lock();
__clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
if (unlikely(scsi_host_in_recovery(shost))) {
- unsigned int busy = scsi_host_busy(shost);
+ unsigned int busy;
+ /*
+ * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
+ * other CPUs before counting busy requests. Otherwise,
+ * reordering can cause CPUs to race and miss an eh wakeup
+ * when no CPU sees all busy requests as done or timed out.
+ */
+ smp_mb();
+
+ busy = scsi_host_busy(shost);
spin_lock_irqsave(shost->host_lock, flags);
if (shost->host_failed || shost->host_eh_scheduled)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 359/491] Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 358/491] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 360/491] media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Greg Kroah-Hartman
` (136 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit b3d77a3fc71c084575d3df4ec6544b3fb6ce587d.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/dib7000p.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index 08b3ac8ff1083..a4d060fb1babd 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2198,8 +2198,6 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
u8 n_overflow = 1;
u16 i = 1000;
- if (msg[0].len < 3)
- return -EOPNOTSUPP;
u16 serpar_num = msg[0].buf[0];
while (n_overflow == 1 && i) {
@@ -2219,8 +2217,6 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
u8 n_overflow = 1, n_empty = 1;
u16 i = 1000;
- if (msg[0].len < 1 || msg[1].len < 2)
- return -EOPNOTSUPP;
u16 serpar_num = msg[0].buf[0];
u16 read_word;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 360/491] media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 359/491] Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 361/491] hwmon: (pxe1610) Check return value of page-select write in probe Greg Kroah-Hartman
` (135 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Guo, Mauro Carvalho Chehab,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Guo <alexguo1023@gmail.com>
[ Upstream commit ed0234c8458b3149f15e496b48a1c9874dd24a1b ]
In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash.
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Alex Guo <alexguo1023@gmail.com>
Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/dib7000p.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index a4d060fb1babd..18b48a3984291 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2198,7 +2198,11 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
u8 n_overflow = 1;
u16 i = 1000;
- u16 serpar_num = msg[0].buf[0];
+ u16 serpar_num;
+
+ if (msg[0].len < 3)
+ return -EOPNOTSUPP;
+ serpar_num = msg[0].buf[0];
while (n_overflow == 1 && i) {
n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
@@ -2217,9 +2221,13 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
u8 n_overflow = 1, n_empty = 1;
u16 i = 1000;
- u16 serpar_num = msg[0].buf[0];
+ u16 serpar_num;
u16 read_word;
+ if (msg[0].len < 1 || msg[1].len < 2)
+ return -EOPNOTSUPP;
+ serpar_num = msg[0].buf[0];
+
while (n_overflow == 1 && i) {
n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
i--;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 361/491] hwmon: (pxe1610) Check return value of page-select write in probe
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 360/491] media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 362/491] hwmon: (occ) Fix missing newline in occ_show_extended() Greg Kroah-Hartman
` (134 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Guenter Roeck,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
the return value. If the write fails, subsequent register reads operate
on an indeterminate page, leading to silent misconfiguration.
Check the return value and propagate the error using dev_err_probe(),
which also handles -EPROBE_DEFER correctly without log spam.
Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
[groeck: Fix "Fixes" SHA]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
index 212433eb6cc31..7794e5cf550fc 100644
--- a/drivers/hwmon/pmbus/pxe1610.c
+++ b/drivers/hwmon/pmbus/pxe1610.c
@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
* By default this device doesn't boot to page 0, so set page 0
* to access all pmbus registers.
*/
- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
+ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
+ if (ret < 0)
+ return dev_err_probe(&client->dev, ret,
+ "Failed to set page 0\n");
/* Read Manufacturer id */
ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 362/491] hwmon: (occ) Fix missing newline in occ_show_extended()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 361/491] hwmon: (pxe1610) Check return value of page-select write in probe Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 363/491] riscv: kgdb: fix several debug register assignment bugs Greg Kroah-Hartman
` (133 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Guenter Roeck,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
is set, the sysfs_emit format string "%u" is missing the trailing
newline that the sysfs ABI expects. The else branch correctly uses
"%4phN\n", and all other show functions in this file include the
trailing newline.
Add the missing "\n" for consistency and correct sysfs output.
Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/occ/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index 1a6c8ebc32e16..2b088418259b0 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -727,7 +727,7 @@ static ssize_t occ_show_extended(struct device *dev,
switch (sattr->nr) {
case 0:
if (extn->flags & EXTN_FLAG_SENSOR_ID) {
- rc = sysfs_emit(buf, "%u",
+ rc = sysfs_emit(buf, "%u\n",
get_unaligned_be32(&extn->sensor_id));
} else {
rc = sysfs_emit(buf, "%02x%02x%02x%02x\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 363/491] riscv: kgdb: fix several debug register assignment bugs
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 362/491] hwmon: (occ) Fix missing newline in occ_show_extended() Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 364/491] drm/ioc32: stop speculation on the drm_compat_ioctl path Greg Kroah-Hartman
` (132 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Chen, Paul Walmsley,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Walmsley <pjw@kernel.org>
[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
Fix several bugs in the RISC-V kgdb implementation:
- The element of dbg_reg_def[] that is supposed to pertain to the S1
register embeds instead the struct pt_regs offset of the A1
register. Fix this to use the S1 register offset in struct pt_regs.
- The sleeping_thread_to_gdb_regs() function copies the value of the
S10 register into the gdb_regs[] array element meant for the S9
register, and copies the value of the S11 register into the array
element meant for the S10 register. It also neglects to copy the
value of the S11 register. Fix all of these issues.
Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
Cc: Vincent Chen <vincent.chen@sifive.com>
Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/kgdb.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
index 1d83b36967212..eb737c7a563b9 100644
--- a/arch/riscv/kernel/kgdb.c
+++ b/arch/riscv/kernel/kgdb.c
@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
+ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
+ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 364/491] drm/ioc32: stop speculation on the drm_compat_ioctl path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 363/491] riscv: kgdb: fix several debug register assignment bugs Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 365/491] wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman
` (131 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f8995c2df519f382525ca4bc90553ad2ec611067 upstream.
The drm compat ioctl path takes a user controlled pointer, and then
dereferences it into a table of function pointers, the signature method
of spectre problems. Fix this up by calling array_index_nospec() on the
index to the function pointer list.
Fixes: 505b5240329b ("drm/ioctl: Fix Spectre v1 vulnerabilities")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Simona Vetter <simona@ffwll.ch>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_ioc32.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -28,6 +28,7 @@
* IN THE SOFTWARE.
*/
#include <linux/compat.h>
+#include <linux/nospec.h>
#include <linux/ratelimit.h>
#include <linux/export.h>
@@ -992,6 +993,7 @@ long drm_compat_ioctl(struct file *filp,
if (nr >= ARRAY_SIZE(drm_compat_ioctls))
return drm_ioctl(filp, cmd, arg);
+ nr = array_index_nospec(nr, ARRAY_SIZE(drm_compat_ioctls));
fn = drm_compat_ioctls[nr].fn;
if (!fn)
return drm_ioctl(filp, cmd, arg);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 365/491] wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 364/491] drm/ioc32: stop speculation on the drm_compat_ioctl path Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 366/491] USB: serial: option: add MeiG Smart SRM825WN Greg Kroah-Hartman
` (130 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yasuaki Torimaru, Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
commit d049e56b1739101d1c4d81deedb269c52a8dbba0 upstream.
The variable valuesize is declared as u8 but accumulates the total
length of all SSIDs to scan. Each SSID contributes up to 33 bytes
(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)
SSIDs the total can reach 330, which wraps around to 74 when stored
in a u8.
This causes kmalloc to allocate only 75 bytes while the subsequent
memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte
heap buffer overflow.
Widen valuesize from u8 to u32 to accommodate the full range.
Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
Link: https://patch.msgid.link/20260324100624.983458-1-yasuakitorimaru@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/microchip/wilc1000/hif.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -157,7 +157,7 @@ int wilc_scan(struct wilc_vif *vif, u8 s
u32 index = 0;
u32 i, scan_timeout;
u8 *buffer;
- u8 valuesize = 0;
+ u32 valuesize = 0;
u8 *search_ssid_vals = NULL;
struct host_if_drv *hif_drv = vif->hif_drv;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 366/491] USB: serial: option: add MeiG Smart SRM825WN
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 365/491] wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 367/491] ALSA: caiaq: fix stack out-of-bounds read in init_card Greg Kroah-Hartman
` (129 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ernestas Kulik, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ernestas Kulik <ernestas.k@iconn-networks.com>
commit e8d0ed37bd51da52da6225d278e330c2f18a6198 upstream.
Add support for the SDX62-based MeiG Smart SRM825WN module.
If#= 0: RNDIS
If#= 1: RNDIS
If#= 2: Diag
If#= 3: AT
If#= 4: AT
If#= 5: NMEA
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 19 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2dee ProdID=4d38 Rev= 5.04
S: Manufacturer=MEIG
S: Product=LTE-A Module
S: SerialNumber=da47a175
C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Ernestas Kulik <ernestas.k@iconn-networks.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2441,6 +2441,9 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */
{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */
{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM825WN (Diag) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825WN (AT) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d38, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825WN (NMEA) */
{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */
{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 367/491] ALSA: caiaq: fix stack out-of-bounds read in init_card
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 366/491] USB: serial: option: add MeiG Smart SRM825WN Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 368/491] ALSA: ctxfi: Fix missing SPDIFI1 index handling Greg Kroah-Hartman
` (128 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Konovalov, Berk Cem Goksel,
Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Berk Cem Goksel <berkcgoksel@gmail.com>
commit 45424e871abf2a152e247a9cff78359f18dd95c0 upstream.
The loop creates a whitespace-stripped copy of the card shortname
where `len < sizeof(card->id)` is used for the bounds check. Since
sizeof(card->id) is 16 and the local id buffer is also 16 bytes,
writing 16 non-space characters fills the entire buffer,
overwriting the terminating nullbyte.
When this non-null-terminated string is later passed to
snd_card_set_id() -> copy_valid_id_string(), the function scans
forward with `while (*nid && ...)` and reads past the end of the
stack buffer, reading the contents of the stack.
A USB device with a product name containing many non-ASCII, non-space
characters (e.g. multibyte UTF-8) will reliably trigger this as follows:
BUG: KASAN: stack-out-of-bounds in copy_valid_id_string
sound/core/init.c:696 [inline]
BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c
sound/core/init.c:718
The off-by-one has been present since commit bafeee5b1f8d ("ALSA:
snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1),
which first introduced this whitespace-stripping loop. The original
code never accounted for the null terminator when bounding the copy.
Fix this by changing the loop bound to `sizeof(card->id) - 1`,
ensuring at least one byte remains as the null terminator.
Fixes: bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname")
Cc: stable@vger.kernel.org
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Reported-by: Berk Cem Goksel <berkcgoksel@gmail.com>
Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com>
Link: https://patch.msgid.link/20260329133825.581585-1-berkcgoksel@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/caiaq/device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -502,7 +502,7 @@ static int init_card(struct snd_usb_caia
memset(id, 0, sizeof(id));
for (c = card->shortname, len = 0;
- *c && len < sizeof(card->id); c++)
+ *c && len < sizeof(card->id) - 1; c++)
if (*c != ' ')
id[len++] = *c;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 368/491] ALSA: ctxfi: Fix missing SPDIFI1 index handling
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 367/491] ALSA: caiaq: fix stack out-of-bounds read in init_card Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 369/491] Bluetooth: SMP: derive legacy responder STK authentication from MITM state Greg Kroah-Hartman
` (127 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Karsten Hohmeier
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit b045ab3dff97edae6d538eeff900a34c098761f8 upstream.
SPDIF1 DAIO type isn't properly handled in daio_device_index() for
hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds
array access. Follow the hw20k1 pattern and return the proper index
for this type, too.
Reported-and-tested-by: Karsten Hohmeier <linux@hohmatik.de>
Closes: https://lore.kernel.org/20260315155004.15633-1-linux@hohmatik.de
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260329091240.420194-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ctxfi/ctdaio.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -119,6 +119,7 @@ static unsigned int daio_device_index(en
switch (type) {
case SPDIFOO: return 0;
case SPDIFIO: return 0;
+ case SPDIFI1: return 1;
case LINEO1: return 4;
case LINEO2: return 7;
case LINEO3: return 5;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 369/491] Bluetooth: SMP: derive legacy responder STK authentication from MITM state
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 368/491] ALSA: ctxfi: Fix missing SPDIFI1 index handling Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 370/491] Bluetooth: SMP: force responder MITM requirements before building the pairing response Greg Kroah-Hartman
` (126 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleh Konko, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <security@1seal.org>
commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream.
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.
Fixes: fff3490f4781 ("Bluetooth: Fix setting correct authentication information for SMP STK")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/smp.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1018,10 +1018,7 @@ static u8 smp_random(struct smp_chan *sm
smp_s1(smp->tk, smp->prnd, smp->rrnd, stk);
- if (hcon->pending_sec_level == BT_SECURITY_HIGH)
- auth = 1;
- else
- auth = 0;
+ auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0;
/* Even though there's no _RESPONDER suffix this is the
* responder STK we're adding for later lookup (the initiator
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 370/491] Bluetooth: SMP: force responder MITM requirements before building the pairing response
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 369/491] Bluetooth: SMP: derive legacy responder STK authentication from MITM state Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 371/491] MIPS: Fix the GCC version check for `__multi3 workaround Greg Kroah-Hartman
` (125 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Oleh Konko,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <security@1seal.org>
commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream.
smp_cmd_pairing_req() currently builds the pairing response from the
initiator auth_req before enforcing the local BT_SECURITY_HIGH
requirement. If the initiator omits SMP_AUTH_MITM, the response can
also omit it even though the local side still requires MITM.
tk_request() then sees an auth value without SMP_AUTH_MITM and may
select JUST_CFM, making method selection inconsistent with the pairing
policy the responder already enforces.
When the local side requires HIGH security, first verify that MITM can
be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
response in both rsp.auth_req and auth. This keeps the responder auth bits
and later method selection aligned.
Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/smp.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1818,7 +1818,7 @@ static u8 smp_cmd_pairing_req(struct l2c
if (sec_level > conn->hcon->pending_sec_level)
conn->hcon->pending_sec_level = sec_level;
- /* If we need MITM check that it can be achieved */
+ /* If we need MITM check that it can be achieved. */
if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
u8 method;
@@ -1826,6 +1826,10 @@ static u8 smp_cmd_pairing_req(struct l2c
req->io_capability);
if (method == JUST_WORKS || method == JUST_CFM)
return SMP_AUTH_REQUIREMENTS;
+
+ /* Force MITM bit if it isn't set by the initiator. */
+ auth |= SMP_AUTH_MITM;
+ rsp.auth_req |= SMP_AUTH_MITM;
}
key_size = min(req->max_key_size, rsp.max_key_size);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 371/491] MIPS: Fix the GCC version check for `__multi3 workaround
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 370/491] Bluetooth: SMP: force responder MITM requirements before building the pairing response Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 372/491] hwmon: (occ) Fix division by zero in occ_show_power_1() Greg Kroah-Hartman
` (124 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Maciej W. Rozycki,
Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit ec8bf18814915460d9c617b556bf024efef26613 upstream.
It was only GCC 10 that fixed a MIPS64r6 code generation issue with a
`__multi3' libcall inefficiently produced to perform 64-bit widening
multiplication while suitable machine instructions exist to do such a
calculation. The fix went in with GCC commit 48b2123f6336 ("re PR
target/82981 (unnecessary __multi3 call for mips64r6 linux kernel)").
Adjust our code accordingly, removing build failures such as:
mips64-linux-ld: lib/math/div64.o: in function `mul_u64_add_u64_div_u64':
div64.c:(.text+0x84): undefined reference to `__multi3'
with the GCC versions affected.
Fixes: ebabcf17bcd7 ("MIPS: Implement __multi3 for GCC7 MIPS64r6 builds")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601140146.hMLODc6v-lkp@intel.com/
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v4.15+
Reviewed-by: David Laight <david.laight.linux@gmail.com.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/lib/multi3.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/mips/lib/multi3.c
+++ b/arch/mips/lib/multi3.c
@@ -4,12 +4,12 @@
#include "libgcc.h"
/*
- * GCC 7 & older can suboptimally generate __multi3 calls for mips64r6, so for
+ * GCC 9 & older can suboptimally generate __multi3 calls for mips64r6, so for
* that specific case only we implement that intrinsic here.
*
* See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981
*/
-#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ < 8)
+#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ < 10)
/* multiply 64-bit values, low 64-bits returned */
static inline long long notrace dmulu(long long a, long long b)
@@ -51,4 +51,4 @@ ti_type notrace __multi3(ti_type a, ti_t
}
EXPORT_SYMBOL(__multi3);
-#endif /* 64BIT && CPU_MIPSR6 && GCC7 */
+#endif /* 64BIT && CPU_MIPSR6 && GCC9 */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 372/491] hwmon: (occ) Fix division by zero in occ_show_power_1()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 371/491] MIPS: Fix the GCC version check for `__multi3 workaround Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 373/491] drm/ast: dp501: Fix initialization of SCU2C Greg Kroah-Hartman
` (123 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
commit 39e2a5bf970402a8530a319cf06122e216ba57b8 upstream.
In occ_show_power_1() case 1, the accumulator is divided by
update_tag without checking for zero. If no samples have been
collected yet (e.g. during early boot when the sensor block is
included but hasn't been updated), update_tag is zero, causing
a kernel divide-by-zero crash.
The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by
zero issue") only addressed occ_get_powr_avg() used by
occ_show_power_2() and occ_show_power_a0(). This separate code
path in occ_show_power_1() was missed.
Fix this by reusing the existing occ_get_powr_avg() helper, which
already handles the zero-sample case and uses mul_u64_u32_div()
to multiply before dividing for better precision. Move the helper
above occ_show_power_1() so it is visible at the call site.
Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260326224510.294619-2-sanman.pradhan@hpe.com
[groeck: Fix alignment problems reported by checkpatch]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/occ/common.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -422,6 +422,12 @@ static ssize_t occ_show_freq_2(struct de
return sysfs_emit(buf, "%u\n", val);
}
+static u64 occ_get_powr_avg(u64 accum, u32 samples)
+{
+ return (samples == 0) ? 0 :
+ mul_u64_u32_div(accum, 1000000UL, samples);
+}
+
static ssize_t occ_show_power_1(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -443,9 +449,8 @@ static ssize_t occ_show_power_1(struct d
val = get_unaligned_be16(&power->sensor_id);
break;
case 1:
- val = get_unaligned_be32(&power->accumulator) /
- get_unaligned_be32(&power->update_tag);
- val *= 1000000ULL;
+ val = occ_get_powr_avg(get_unaligned_be32(&power->accumulator),
+ get_unaligned_be32(&power->update_tag));
break;
case 2:
val = (u64)get_unaligned_be32(&power->update_tag) *
@@ -461,12 +466,6 @@ static ssize_t occ_show_power_1(struct d
return sysfs_emit(buf, "%llu\n", val);
}
-static u64 occ_get_powr_avg(u64 accum, u32 samples)
-{
- return (samples == 0) ? 0 :
- mul_u64_u32_div(accum, 1000000UL, samples);
-}
-
static ssize_t occ_show_power_2(struct device *dev,
struct device_attribute *attr, char *buf)
{
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 373/491] drm/ast: dp501: Fix initialization of SCU2C
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 372/491] hwmon: (occ) Fix division by zero in occ_show_power_1() Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 374/491] USB: serial: io_edgeport: add support for Blackbox IC135A Greg Kroah-Hartman
` (122 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Jocelyn Falempe,
Dave Airlie, dri-devel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 2f42c1a6161646cbd29b443459fd635d29eda634 upstream.
Ast's DP501 initialization reads the register SCU2C at offset 0x1202c
and tries to set it to source data from VGA. But writes the update to
offset 0x0, with unknown results. Write the result to SCU instead.
The bug only happens in ast_init_analog(). There's similar code in
ast_init_dvo(), which works correctly.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 83c6620bae3f ("drm/ast: initial DP501 support (v0.2)")
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.16+
Link: https://patch.msgid.link/20260327133532.79696-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_dp501.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ast/ast_dp501.c
+++ b/drivers/gpu/drm/ast/ast_dp501.c
@@ -484,7 +484,7 @@ static void ast_init_analog(struct drm_d
/* Finally, clear bits [17:16] of SCU2c */
data = ast_read32(ast, 0x1202c);
data &= 0xfffcffff;
- ast_write32(ast, 0, data);
+ ast_write32(ast, 0x1202c, data);
/* Disable DVO */
ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x00);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 374/491] USB: serial: io_edgeport: add support for Blackbox IC135A
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 373/491] drm/ast: dp501: Fix initialization of SCU2C Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 375/491] USB: serial: option: add support for Rolling Wireless RW135R-GL Greg Kroah-Hartman
` (121 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frej Drejhammar, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frej Drejhammar <frej@stacken.kth.se>
commit 0e01c3416eb863ee7f156a9d7e7421ec0a9f68a0 upstream.
The Blackbox 724-746-5500 USB Director USB-RS-232 HUB, part number
IC135A, is a rebadged Edgeport/4 with its own USB device id.
Signed-off-by: Frej Drejhammar <frej@stacken.kth.se>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_edgeport.c | 3 +++
drivers/usb/serial/io_usbvend.h | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -73,6 +73,7 @@ static const struct usb_device_id edgepo
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_22I) },
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_412_4) },
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_COMPATIBLE) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_BLACKBOX_IC135A) },
{ }
};
@@ -121,6 +122,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_8R) },
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_8RR) },
{ USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_EDGEPORT_412_8) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_BLACKBOX_IC135A) },
{ USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0202) },
{ USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0203) },
{ USB_DEVICE(USB_VENDOR_ID_NCR, NCR_DEVICE_ID_EPIC_0310) },
@@ -546,6 +548,7 @@ static void get_product_info(struct edge
case ION_DEVICE_ID_EDGEPORT_2_DIN:
case ION_DEVICE_ID_EDGEPORT_4_DIN:
case ION_DEVICE_ID_EDGEPORT_16_DUAL_CPU:
+ case ION_DEVICE_ID_BLACKBOX_IC135A:
product_info->IsRS232 = 1;
break;
--- a/drivers/usb/serial/io_usbvend.h
+++ b/drivers/usb/serial/io_usbvend.h
@@ -211,6 +211,7 @@
//
// Definitions for other product IDs
+#define ION_DEVICE_ID_BLACKBOX_IC135A 0x0801 // OEM device (rebranded Edgeport/4)
#define ION_DEVICE_ID_MT4X56USB 0x1403 // OEM device
#define ION_DEVICE_ID_E5805A 0x1A01 // OEM device (rebranded Edgeport/4)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 375/491] USB: serial: option: add support for Rolling Wireless RW135R-GL
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 374/491] USB: serial: io_edgeport: add support for Blackbox IC135A Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 376/491] USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Greg Kroah-Hartman
` (120 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wanquan Zhong, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanquan Zhong <wanquan.zhong@fibocom.com>
commit 01e8d0f742222f1e68f48180d5480097adf7ae9f upstream.
Add VID/PID 33f8:1003 for the Rolling Wireless RW135R-GL M.2 module,
which is used in laptop debug cards with MBIM interface for
Linux/Chrome OS. The device supports mbim, pipe functionalities.
Here are the outputs of usb-devices:
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=33f8 ProdID=1003 Rev=05.15
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW135R-GL Module
S: SerialNumber=12345678
C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
Signed-off-by: Wanquan Zhong <wanquan.zhong@fibocom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2464,6 +2464,7 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */
.driver_info = RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff) }, /* Rolling RW135R-GL (laptop MBIM) */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 376/491] USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 375/491] USB: serial: option: add support for Rolling Wireless RW135R-GL Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 377/491] Input: synaptics-rmi4 - fix a locking bug in an error path Greg Kroah-Hartman
` (119 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, JP Hein
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Hein <jp@jphein.com>
commit 8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c upstream.
The Razer Kiyo Pro (1532:0e05) is a USB 3.0 UVC webcam whose firmware
does not handle USB Link Power Management transitions reliably. When LPM
is active, the device can enter a state where it fails to respond to
control transfers, producing EPIPE (-32) errors on UVC probe control
SET_CUR requests. In the worst case, the stalled endpoint triggers an
xHCI stop-endpoint command that times out, causing the host controller
to be declared dead and every USB device on the bus to be disconnected.
This has been reported as Ubuntu Launchpad Bug #2061177. The failure
mode is:
1. UVC probe control SET_CUR returns -32 (EPIPE)
2. xHCI host not responding to stop endpoint command
3. xHCI host controller not responding, assume dead
4. All USB devices on the affected xHCI controller disconnect
Disabling LPM prevents the firmware from entering the problematic low-
power states that precede the stall. This is the same approach used for
other webcams with similar firmware issues (e.g., Logitech HD Webcam C270).
Cc: stable <stable@kernel.org>
Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2061177
Signed-off-by: JP Hein <jp@jphein.com>
Link: https://patch.msgid.link/20260331003806.212565-2-jp@jphein.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -477,6 +477,8 @@ static const struct usb_device_id usb_qu
/* Razer - Razer Blade Keyboard */
{ USB_DEVICE(0x1532, 0x0116), .driver_info =
USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ /* Razer - Razer Kiyo Pro Webcam */
+ { USB_DEVICE(0x1532, 0x0e05), .driver_info = USB_QUIRK_NO_LPM },
/* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
{ USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 377/491] Input: synaptics-rmi4 - fix a locking bug in an error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 376/491] USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 378/491] Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Greg Kroah-Hartman
` (118 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 upstream.
Lock f54->data_mutex when entering the function statement since jumping
to the 'error' label when checking report_size fails causes that mutex
to be unlocked.
This bug has been detected by the Clang thread-safety checker.
Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f54.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -534,6 +534,8 @@ static void rmi_f54_work(struct work_str
int error;
int i;
+ mutex_lock(&f54->data_mutex);
+
report_size = rmi_f54_get_report_size(f54);
if (report_size == 0) {
dev_err(&fn->dev, "Bad report size, report type=%d\n",
@@ -542,8 +544,6 @@ static void rmi_f54_work(struct work_str
goto error; /* retry won't help */
}
- mutex_lock(&f54->data_mutex);
-
/*
* Need to check if command has completed.
* If not try again later.
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 378/491] Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 377/491] Input: synaptics-rmi4 - fix a locking bug in an error path Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 379/491] Input: xpad - add support for Razer Wolverine V3 Pro Greg Kroah-Hartman
` (117 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoffer Sandberg, Werner Sembach,
Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <cs@tuxedo.de>
commit 5839419cffc7788a356428d321e3ec18055c0286 upstream.
The device occasionally wakes up from suspend with missing input on the
internal keyboard and the following suspend attempt results in an instant
wake-up. The quirks fix both issues for this device.
Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -1189,6 +1189,13 @@ static const struct dmi_system_id i8042_
},
{
.matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "X6KK45xU_X6SP45xU"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+ .matches = {
DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
},
.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 379/491] Input: xpad - add support for Razer Wolverine V3 Pro
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 378/491] Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 380/491] iio: dac: ad5770r: fix error return in ad5770r_read_raw() Greg Kroah-Hartman
` (116 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zoltan Illes, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zoltan Illes <zoliviragh@gmail.com>
commit e2b0ae529db4766584e77647cefe3ec15c3d842e upstream.
Add device IDs for the Razer Wolverine V3 Pro controller in both
wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.
The controller uses the Xbox 360 protocol (vendor-specific class,
subclass 93, protocol 1) on interface 0 with an identical 20-byte
input report layout, so no additional processing is needed.
Signed-off-by: Zoltan Illes <zoliviragh@gmail.com>
Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -269,6 +269,8 @@ static const struct xpad_device {
{ 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
{ 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
+ { 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
+ { 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 380/491] iio: dac: ad5770r: fix error return in ad5770r_read_raw()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 379/491] Input: xpad - add support for Razer Wolverine V3 Pro Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 381/491] iio: light: vcnl4035: fix scan buffer on big-endian Greg Kroah-Hartman
` (115 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Antoniu Miclaus, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
commit c354521708175d776d896f8bdae44b18711eccb6 upstream.
Return the error code from regmap_bulk_read() instead of 0 so
that I/O failures are properly propagated.
Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ad5770r.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/dac/ad5770r.c
+++ b/drivers/iio/dac/ad5770r.c
@@ -323,7 +323,7 @@ static int ad5770r_read_raw(struct iio_d
chan->address,
st->transf_buf, 2);
if (ret)
- return 0;
+ return ret;
buf16 = st->transf_buf[0] + (st->transf_buf[1] << 8);
*val = buf16 >> 2;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 381/491] iio: light: vcnl4035: fix scan buffer on big-endian
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 380/491] iio: dac: ad5770r: fix error return in ad5770r_read_raw() Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 382/491] iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Greg Kroah-Hartman
` (114 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Lechner, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <dlechner@baylibre.com>
commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b upstream.
Rework vcnl4035_trigger_consumer_handler() so that we are not passing
what should be a u16 value as an int * to regmap_read(). This won't
work on bit endian systems.
Instead, add a new unsigned int variable to pass to regmap_read(). Then
copy that value into the buffer struct.
The buffer array is replaced with a struct since there is only one value
being read. This allows us to use the correct u16 data type and has a
side-effect of simplifying the alignment specification.
Also fix the endianness of the scan format from little-endian to CPU
endianness. Since we are using regmap to read the value, it will be
CPU-endian.
Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/vcnl4035.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/iio/light/vcnl4035.c
+++ b/drivers/iio/light/vcnl4035.c
@@ -105,17 +105,23 @@ static irqreturn_t vcnl4035_trigger_cons
struct iio_dev *indio_dev = pf->indio_dev;
struct vcnl4035_data *data = iio_priv(indio_dev);
/* Ensure naturally aligned timestamp */
- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { };
+ struct {
+ u16 als_data;
+ aligned_s64 timestamp;
+ } buffer = { };
+ unsigned int val;
int ret;
- ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);
+ ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, &val);
if (ret < 0) {
dev_err(&data->client->dev,
"Trigger consumer can't read from sensor.\n");
goto fail_read;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
- iio_get_time_ns(indio_dev));
+
+ buffer.als_data = val;
+ iio_push_to_buffers_with_timestamp(indio_dev, &buffer,
+ iio_get_time_ns(indio_dev));
fail_read:
iio_trigger_notify_done(indio_dev->trig);
@@ -380,7 +386,7 @@ static const struct iio_chan_spec vcnl40
.sign = 'u',
.realbits = 16,
.storagebits = 16,
- .endianness = IIO_LE,
+ .endianness = IIO_CPU,
},
},
{
@@ -394,7 +400,7 @@ static const struct iio_chan_spec vcnl40
.sign = 'u',
.realbits = 16,
.storagebits = 16,
- .endianness = IIO_LE,
+ .endianness = IIO_CPU,
},
},
};
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 382/491] iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 381/491] iio: light: vcnl4035: fix scan buffer on big-endian Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 383/491] iio: gyro: mpu3050: Fix incorrect free_irq() variable Greg Kroah-Hartman
` (113 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Lavra, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit 630748afa7030b272b7bee5df857e7bcf132ed51 upstream.
The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and
disabling the hardware FIFO, checks the contents of the hw->settings->batch
array at index sensor->id, and then sets the current ODR value in sensor
registers that depend on whether the register address is set in the above
array element. This logic is valid for internal sensors only, i.e. the
accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu:
st_lsm6dsx: add i2c embedded controller support"), this function is called
also when configuring the hardware FIFO for external sensors (i.e. sensors
accessed through the sensor hub functionality), which can result in
unrelated device registers being written.
Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does
not touch any registers unless it is called for internal sensors.
Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -201,6 +201,10 @@ static int st_lsm6dsx_set_fifo_odr(struc
const struct st_lsm6dsx_reg *batch_reg;
u8 data;
+ /* Only internal sensors have a FIFO ODR configuration register. */
+ if (sensor->id >= ARRAY_SIZE(hw->settings->batch))
+ return 0;
+
batch_reg = &hw->settings->batch[sensor->id];
if (batch_reg->addr) {
int val;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 383/491] iio: gyro: mpu3050: Fix incorrect free_irq() variable
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 382/491] iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 384/491] iio: gyro: mpu3050: Fix irq resource leak Greg Kroah-Hartman
` (112 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Ethan Tidmore,
Andy Shevchenko, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 upstream.
The handler for the IRQ part of this driver is mpu3050->trig but,
in the teardown free_irq() is called with handler mpu3050.
Use correct IRQ handler when calling free_irq().
Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1278,7 +1278,7 @@ int mpu3050_common_remove(struct device
pm_runtime_disable(dev);
iio_triggered_buffer_cleanup(indio_dev);
if (mpu3050->irq)
- free_irq(mpu3050->irq, mpu3050);
+ free_irq(mpu3050->irq, mpu3050->trig);
iio_device_unregister(indio_dev);
mpu3050_power_down(mpu3050);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 384/491] iio: gyro: mpu3050: Fix irq resource leak
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 383/491] iio: gyro: mpu3050: Fix incorrect free_irq() variable Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 385/491] iio: gyro: mpu3050: Move iio_device_register() to correct location Greg Kroah-Hartman
` (111 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Ethan Tidmore,
Andy Shevchenko, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 upstream.
The interrupt handler is setup but only a few lines down if
iio_trigger_register() fails the function returns without properly
releasing the handler.
Add cleanup goto to resolve resource leak.
Detected by Smatch:
drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
'irq' from request_threaded_irq() not released on lines: 1124.
Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1137,11 +1137,16 @@ static int mpu3050_trigger_probe(struct
ret = iio_trigger_register(mpu3050->trig);
if (ret)
- return ret;
+ goto err_iio_trigger;
indio_dev->trig = iio_trigger_get(mpu3050->trig);
return 0;
+
+err_iio_trigger:
+ free_irq(mpu3050->irq, mpu3050->trig);
+
+ return ret;
}
int mpu3050_common_probe(struct device *dev,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 385/491] iio: gyro: mpu3050: Move iio_device_register() to correct location
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 384/491] iio: gyro: mpu3050: Fix irq resource leak Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 386/491] iio: gyro: mpu3050: Fix out-of-sequence free_irq() Greg Kroah-Hartman
` (110 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Linus Walleij,
Ethan Tidmore, Andy Shevchenko, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d upstream.
iio_device_register() should be at the end of the probe function to
prevent race conditions.
Place iio_device_register() at the end of the probe function and place
iio_device_unregister() accordingly.
Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Suggested-by: Jonathan Cameron <jic23@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1234,12 +1234,6 @@ int mpu3050_common_probe(struct device *
goto err_power_down;
}
- ret = iio_device_register(indio_dev);
- if (ret) {
- dev_err(dev, "device register failed\n");
- goto err_cleanup_buffer;
- }
-
dev_set_drvdata(dev, indio_dev);
/* Check if we have an assigned IRQ to use as trigger */
@@ -1262,9 +1256,20 @@ int mpu3050_common_probe(struct device *
pm_runtime_use_autosuspend(dev);
pm_runtime_put(dev);
+ ret = iio_device_register(indio_dev);
+ if (ret) {
+ dev_err(dev, "device register failed\n");
+ goto err_iio_device_register;
+ }
+
return 0;
-err_cleanup_buffer:
+err_iio_device_register:
+ pm_runtime_get_sync(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ if (irq)
+ free_irq(mpu3050->irq, mpu3050->trig);
iio_triggered_buffer_cleanup(indio_dev);
err_power_down:
mpu3050_power_down(mpu3050);
@@ -1278,13 +1283,13 @@ int mpu3050_common_remove(struct device
struct iio_dev *indio_dev = dev_get_drvdata(dev);
struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+ iio_device_unregister(indio_dev);
pm_runtime_get_sync(dev);
pm_runtime_put_noidle(dev);
pm_runtime_disable(dev);
iio_triggered_buffer_cleanup(indio_dev);
if (mpu3050->irq)
free_irq(mpu3050->irq, mpu3050->trig);
- iio_device_unregister(indio_dev);
mpu3050_power_down(mpu3050);
return 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 386/491] iio: gyro: mpu3050: Fix out-of-sequence free_irq()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 385/491] iio: gyro: mpu3050: Move iio_device_register() to correct location Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 387/491] usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Greg Kroah-Hartman
` (109 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron, Linus Walleij,
Ethan Tidmore, Andy Shevchenko, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c upstream.
The triggered buffer is initialized before the IRQ is requested. The
removal path currently calls iio_triggered_buffer_cleanup() before
free_irq(). This violates the expected LIFO.
Place free_irq() in the correct location relative to
iio_triggered_buffer_cleanup().
Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Suggested-by: Jonathan Cameron <jic23@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/mpu3050-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1287,9 +1287,9 @@ int mpu3050_common_remove(struct device
pm_runtime_get_sync(dev);
pm_runtime_put_noidle(dev);
pm_runtime_disable(dev);
- iio_triggered_buffer_cleanup(indio_dev);
if (mpu3050->irq)
free_irq(mpu3050->irq, mpu3050->trig);
+ iio_triggered_buffer_cleanup(indio_dev);
mpu3050_power_down(mpu3050);
return 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 387/491] usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 386/491] iio: gyro: mpu3050: Fix out-of-sequence free_irq() Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 388/491] usb: ulpi: fix double free in ulpi_register_interface() error path Greg Kroah-Hartman
` (108 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miao Li, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miao Li <limiao@kylinos.cn>
commit dd36014ec6042f424ef51b923e607772f7502ee7 upstream.
Another Silicon Motion flash drive also randomly work incorrectly
(lsusb does not list the device) on Huawei hisi platforms during
500 reboot cycles, and the DELAY_INIT quirk fixes this issue.
Signed-off-by: Miao Li <limiao@kylinos.cn>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -394,6 +394,7 @@ static const struct usb_device_id usb_qu
/* Silicon Motion Flash Drive */
{ USB_DEVICE(0x090c, 0x1000), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x090c, 0x2000), .driver_info = USB_QUIRK_DELAY_INIT },
/* Sound Devices USBPre2 */
{ USB_DEVICE(0x0926, 0x0202), .driver_info =
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 388/491] usb: ulpi: fix double free in ulpi_register_interface() error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 387/491] usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 389/491] usb: usbtmc: Flush anchored URBs in usbtmc_release Greg Kroah-Hartman
` (107 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Guangshuo Li,
Heikki Krogerus
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 01af542392b5d41fd659d487015a71f627accce3 upstream.
When device_register() fails, ulpi_register() calls put_device() on
ulpi->dev.
The device release callback ulpi_dev_release() drops the OF node
reference and frees ulpi, but the current error path in
ulpi_register_interface() then calls kfree(ulpi) again, causing a
double free.
Let put_device() handle the cleanup through ulpi_dev_release() and
avoid freeing ulpi again in ulpi_register_interface().
Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI")
Cc: stable <stable@kernel.org>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/common/ulpi.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(str
ulpi->ops = ops;
ret = ulpi_register(dev, ulpi);
- if (ret) {
- kfree(ulpi);
+ if (ret)
return ERR_PTR(ret);
- }
+
return ulpi;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 389/491] usb: usbtmc: Flush anchored URBs in usbtmc_release
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 388/491] usb: ulpi: fix double free in ulpi_register_interface() error path Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 390/491] usb: ehci-brcm: fix sleep during atomic Greg Kroah-Hartman
` (106 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9a3c54f52bd1edbd975f, stable,
Heitor Alves de Siqueira
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heitor Alves de Siqueira <halves@igalia.com>
commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 upstream.
When calling usbtmc_release, pending anchored URBs must be flushed or
killed to prevent use-after-free errors (e.g. in the HCD giveback
path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file")
Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f
Cc: stable <stable@kernel.org>
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/usbtmc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -254,6 +254,9 @@ static int usbtmc_release(struct inode *
list_del(&file_data->file_elem);
spin_unlock_irq(&file_data->data->dev_lock);
+
+ /* flush anchored URBs */
+ usbtmc_draw_down(file_data);
mutex_unlock(&file_data->data->io_mutex);
kref_put(&file_data->data->kref, usbtmc_delete);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 390/491] usb: ehci-brcm: fix sleep during atomic
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 389/491] usb: usbtmc: Flush anchored URBs in usbtmc_release Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 391/491] phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind Greg Kroah-Hartman
` (105 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Justin Chen,
Florian Fainelli
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <justin.chen@broadcom.com>
commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 upstream.
echi_brcm_wait_for_sof() gets called after disabling interrupts
in ehci_brcm_hub_control(). Use the atomic version of poll_timeout
to fix the warning.
Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's")
Cc: stable <stable@kernel.org>
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-brcm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/ehci-brcm.c
+++ b/drivers/usb/host/ehci-brcm.c
@@ -31,8 +31,8 @@ static inline void ehci_brcm_wait_for_so
int res;
/* Wait for next microframe (every 125 usecs) */
- res = readl_relaxed_poll_timeout(&ehci->regs->frame_index, val,
- val != frame_idx, 1, 130);
+ res = readl_relaxed_poll_timeout_atomic(&ehci->regs->frame_index,
+ val, val != frame_idx, 1, 130);
if (res)
ehci_err(ehci, "Error waiting for SOF\n");
udelay(delay);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 391/491] phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 390/491] usb: ehci-brcm: fix sleep during atomic Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 392/491] phy: renesas: rcar-gen3-usb2: Move IRQ request in probe Greg Kroah-Hartman
` (104 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Lad Prabhakar,
Claudiu Beznea, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 54c4c58713aaff76c2422ff5750e557ab3b100d7 upstream.
It has been observed on the Renesas RZ/G3S SoC that unbinding and binding
the PHY driver leads to role autodetection failures. This issue occurs when
PHY 3 is the first initialized PHY. PHY 3 does not have an interrupt
associated with the USB2_INT_ENABLE register (as
rcar_gen3_int_enable[3] = 0). As a result, rcar_gen3_init_otg() is called
to initialize OTG without enabling PHY interrupts.
To resolve this, add rcar_gen3_is_any_otg_rphy_initialized() and call it in
role_store(), role_show(), and rcar_gen3_init_otg(). At the same time,
rcar_gen3_init_otg() is only called when initialization for a PHY with
interrupt bits is in progress. As a result, the
struct rcar_gen3_phy::otg_initialized is no longer needed.
[claudiu.beznea: declare the i iterrator from
rcar_gen3_is_any_otg_rphy_initialized() outside of for loop]
Fixes: 549b6b55b005 ("phy: renesas: rcar-gen3-usb2: enable/disable independent irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://lore.kernel.org/r/20250507125032.565017-2-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 32 +++++++++++-------------
1 file changed, 14 insertions(+), 18 deletions(-)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index ea01a121b8fc5..646a5140b30e1 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -98,7 +98,6 @@ struct rcar_gen3_phy {
struct rcar_gen3_chan *ch;
u32 int_enable_bits;
bool initialized;
- bool otg_initialized;
bool powered;
};
@@ -288,16 +287,16 @@ static bool rcar_gen3_is_any_rphy_initialized(struct rcar_gen3_chan *ch)
return false;
}
-static bool rcar_gen3_needs_init_otg(struct rcar_gen3_chan *ch)
+static bool rcar_gen3_is_any_otg_rphy_initialized(struct rcar_gen3_chan *ch)
{
- int i;
+ enum rcar_gen3_phy_index i;
- for (i = 0; i < NUM_OF_PHYS; i++) {
- if (ch->rphys[i].otg_initialized)
- return false;
+ for (i = PHY_INDEX_BOTH_HC; i <= PHY_INDEX_EHCI; i++) {
+ if (ch->rphys[i].initialized)
+ return true;
}
- return true;
+ return false;
}
static bool rcar_gen3_are_all_rphys_power_off(struct rcar_gen3_chan *ch)
@@ -319,7 +318,7 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
bool is_b_device;
enum phy_mode cur_mode, new_mode;
- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch))
+ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch))
return -EIO;
if (sysfs_streq(buf, "host"))
@@ -357,7 +356,7 @@ static ssize_t role_show(struct device *dev, struct device_attribute *attr,
{
struct rcar_gen3_chan *ch = dev_get_drvdata(dev);
- if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch))
+ if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch))
return -EIO;
return sprintf(buf, "%s\n", rcar_gen3_is_host(ch) ? "host" :
@@ -370,6 +369,9 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
void __iomem *usb2_base = ch->base;
u32 val;
+ if (!ch->is_otg_channel || rcar_gen3_is_any_otg_rphy_initialized(ch))
+ return;
+
/* Should not use functions of read-modify-write a register */
val = readl(usb2_base + USB2_LINECTRL1);
val = (val & ~USB2_LINECTRL1_DP_RPD) | USB2_LINECTRL1_DPRPD_EN |
@@ -435,12 +437,9 @@ static int rcar_gen3_phy_usb2_init(struct phy *p)
writel(USB2_OC_TIMSET_INIT, usb2_base + USB2_OC_TIMSET);
}
- /* Initialize otg part */
- if (channel->is_otg_channel) {
- if (rcar_gen3_needs_init_otg(channel))
- rcar_gen3_init_otg(channel);
- rphy->otg_initialized = true;
- }
+ /* Initialize otg part (only if we initialize a PHY with IRQs). */
+ if (rphy->int_enable_bits)
+ rcar_gen3_init_otg(channel);
rphy->initialized = true;
@@ -456,9 +455,6 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p)
rphy->initialized = false;
- if (channel->is_otg_channel)
- rphy->otg_initialized = false;
-
val = readl(usb2_base + USB2_INT_ENABLE);
val &= ~rphy->int_enable_bits;
if (!rcar_gen3_is_any_rphy_initialized(channel))
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 392/491] phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 391/491] phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Greg Kroah-Hartman
` (103 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Lad Prabhakar,
Claudiu Beznea, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit de76809f60cc938d3580bbbd5b04b7d12af6ce3a upstream.
Commit 08b0ad375ca6 ("phy: renesas: rcar-gen3-usb2: move IRQ registration
to init") moved the IRQ request operation from probe to
struct phy_ops::phy_init API to avoid triggering interrupts (which lead to
register accesses) while the PHY clocks (enabled through runtime PM APIs)
are not active. If this happens, it results in a synchronous abort.
One way to reproduce this issue is by enabling CONFIG_DEBUG_SHIRQ, which
calls free_irq() on driver removal.
Move the IRQ request and free operations back to probe, and take the
runtime PM state into account in IRQ handler. This commit is preparatory
for the subsequent fixes in this series.
[claudiu.beznea: fixed conflicts by:
- dropping irq and obint_enable_bits members of rcar_gen3_chan
- using USB2_OBINT_BITS marco in rcar_gen3_phy_usb2_irq()
- keeping irq local variable in rcar_gen3_phy_usb2_probe()
- dropping channel->irq and channel->obint_enable_bits asssignement from
probe
- keeping platform_set_drvdata() and channel->dev assignment in probe]
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://lore.kernel.org/r/20250507125032.565017-3-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 46 +++++++++++++-----------
1 file changed, 26 insertions(+), 20 deletions(-)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 646a5140b30e1..f66e0daa23648 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -110,7 +110,6 @@ struct rcar_gen3_chan {
struct work_struct work;
struct mutex lock; /* protects rphys[...].powered */
enum usb_dr_mode dr_mode;
- int irq;
bool extcon_host;
bool is_otg_channel;
bool uses_otg_pins;
@@ -396,16 +395,25 @@ static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch)
{
struct rcar_gen3_chan *ch = _ch;
void __iomem *usb2_base = ch->base;
- u32 status = readl(usb2_base + USB2_OBINTSTA);
+ struct device *dev = ch->dev;
irqreturn_t ret = IRQ_NONE;
+ u32 status;
+ pm_runtime_get_noresume(dev);
+
+ if (pm_runtime_suspended(dev))
+ goto rpm_put;
+
+ status = readl(usb2_base + USB2_OBINTSTA);
if (status & USB2_OBINT_BITS) {
- dev_vdbg(ch->dev, "%s: %08x\n", __func__, status);
+ dev_vdbg(dev, "%s: %08x\n", __func__, status);
writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA);
rcar_gen3_device_recognition(ch);
ret = IRQ_HANDLED;
}
+rpm_put:
+ pm_runtime_put_noidle(dev);
return ret;
}
@@ -415,17 +423,6 @@ static int rcar_gen3_phy_usb2_init(struct phy *p)
struct rcar_gen3_chan *channel = rphy->ch;
void __iomem *usb2_base = channel->base;
u32 val;
- int ret;
-
- if (!rcar_gen3_is_any_rphy_initialized(channel) && channel->irq >= 0) {
- INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
- ret = request_irq(channel->irq, rcar_gen3_phy_usb2_irq,
- IRQF_SHARED, dev_name(channel->dev), channel);
- if (ret < 0) {
- dev_err(channel->dev, "No irq handler (%d)\n", channel->irq);
- return ret;
- }
- }
/* Initialize USB2 part */
val = readl(usb2_base + USB2_INT_ENABLE);
@@ -461,9 +458,6 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p)
val &= ~USB2_INT_ENABLE_UCOM_INTEN;
writel(val, usb2_base + USB2_INT_ENABLE);
- if (channel->irq >= 0 && !rcar_gen3_is_any_rphy_initialized(channel))
- free_irq(channel->irq, channel);
-
return 0;
}
@@ -612,7 +606,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
struct phy_provider *provider;
struct resource *res;
const struct phy_ops *phy_usb2_ops;
- int ret = 0, i;
+ int ret = 0, i, irq;
if (!dev->of_node) {
dev_err(dev, "This driver needs device tree\n");
@@ -628,8 +622,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
if (IS_ERR(channel->base))
return PTR_ERR(channel->base);
- /* get irq number here and request_irq for OTG in phy_init */
- channel->irq = platform_get_irq_optional(pdev, 0);
channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node);
if (channel->dr_mode != USB_DR_MODE_UNKNOWN) {
channel->is_otg_channel = true;
@@ -683,6 +675,20 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, channel);
channel->dev = dev;
+
+ irq = platform_get_irq_optional(pdev, 0);
+ if (irq < 0 && irq != -ENXIO) {
+ ret = irq;
+ goto error;
+ } else if (irq > 0) {
+ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
+ ret = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq,
+ IRQF_SHARED, dev_name(dev), channel);
+ if (ret < 0) {
+ dev_err(dev, "Failed to request irq (%d)\n", irq);
+ goto error;
+ }
+ }
provider = devm_of_phy_provider_register(dev, rcar_gen3_phy_usb2_xlate);
if (IS_ERR(provider)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 392/491] phy: renesas: rcar-gen3-usb2: Move IRQ request in probe Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-18 11:38 ` Ben Hutchings
2026-04-13 16:00 ` [PATCH 5.10 394/491] phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off Greg Kroah-Hartman
` (102 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Lad Prabhakar,
Claudiu Beznea, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 55a387ebb9219cbe4edfa8ba9996ccb0e7ad4932 upstream.
The phy-rcar-gen3-usb2 driver exposes four individual PHYs that are
requested and configured by PHY users. The struct phy_ops APIs access the
same set of registers to configure all PHYs. Additionally, PHY settings can
be modified through sysfs or an IRQ handler. While some struct phy_ops APIs
are protected by a driver-wide mutex, others rely on individual
PHY-specific mutexes.
This approach can lead to various issues, including:
1/ the IRQ handler may interrupt PHY settings in progress, racing with
hardware configuration protected by a mutex lock
2/ due to msleep(20) in rcar_gen3_init_otg(), while a configuration thread
suspends to wait for the delay, another thread may try to configure
another PHY (with phy_init() + phy_power_on()); re-running the
phy_init() goes to the exact same configuration code, re-running the
same hardware configuration on the same set of registers (and bits)
which might impact the result of the msleep for the 1st configuring
thread
3/ sysfs can configure the hardware (though role_store()) and it can
still race with the phy_init()/phy_power_on() APIs calling into the
drivers struct phy_ops
To address these issues, add a spinlock to protect hardware register access
and driver private data structures (e.g., calls to
rcar_gen3_is_any_rphy_initialized()). Checking driver-specific data remains
necessary as all PHY instances share common settings. With this change,
the existing mutex protection is removed and the cleanup.h helpers are
used.
While at it, to keep the code simpler, do not skip
regulator_enable()/regulator_disable() APIs in
rcar_gen3_phy_usb2_power_on()/rcar_gen3_phy_usb2_power_off() as the
regulators enable/disable operations are reference counted anyway.
[claudiu.beznea:
- in rcar_gen3_init_otg(): fixed conflict by droppping ch->soc_no_adp_ctrl check
- in rcar_gen3_phy_usb2_irq() use spin_lock()/spin_unlock() as scoped_guard()
is not avaialable in v5.10
- in probe(): replace mutex_init() with spin_lock_init()
- rcar_gen3_phy_usb2_power_off() replaced scoped_guard() as it is not
available in v5.10
- in rcar_gen3_phy_usb2_power_on() droppped guard to avoid compilation
warning "ISO C90 forbids mixed declarations and code"]
Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
Cc: stable@vger.kernel.org
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://lore.kernel.org/r/20250507125032.565017-4-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 41 +++++++++++++++---------
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index f66e0daa23648..558c07512c05b 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -9,6 +9,7 @@
* Copyright (C) 2014 Cogent Embedded, Inc.
*/
+#include <linux/cleanup.h>
#include <linux/extcon-provider.h>
#include <linux/interrupt.h>
#include <linux/io.h>
@@ -108,7 +109,7 @@ struct rcar_gen3_chan {
struct rcar_gen3_phy rphys[NUM_OF_PHYS];
struct regulator *vbus;
struct work_struct work;
- struct mutex lock; /* protects rphys[...].powered */
+ spinlock_t lock; /* protects access to hardware and driver data structure. */
enum usb_dr_mode dr_mode;
bool extcon_host;
bool is_otg_channel;
@@ -317,6 +318,8 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
bool is_b_device;
enum phy_mode cur_mode, new_mode;
+ guard(spinlock_irqsave)(&ch->lock);
+
if (!ch->is_otg_channel || !rcar_gen3_is_any_otg_rphy_initialized(ch))
return -EIO;
@@ -404,6 +407,8 @@ static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch)
if (pm_runtime_suspended(dev))
goto rpm_put;
+ spin_lock(&ch->lock);
+
status = readl(usb2_base + USB2_OBINTSTA);
if (status & USB2_OBINT_BITS) {
dev_vdbg(dev, "%s: %08x\n", __func__, status);
@@ -412,6 +417,8 @@ static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch)
ret = IRQ_HANDLED;
}
+ spin_unlock(&ch->lock);
+
rpm_put:
pm_runtime_put_noidle(dev);
return ret;
@@ -424,6 +431,8 @@ static int rcar_gen3_phy_usb2_init(struct phy *p)
void __iomem *usb2_base = channel->base;
u32 val;
+ guard(spinlock_irqsave)(&channel->lock);
+
/* Initialize USB2 part */
val = readl(usb2_base + USB2_INT_ENABLE);
val |= USB2_INT_ENABLE_UCOM_INTEN | rphy->int_enable_bits;
@@ -450,6 +459,8 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p)
void __iomem *usb2_base = channel->base;
u32 val;
+ guard(spinlock_irqsave)(&channel->lock);
+
rphy->initialized = false;
val = readl(usb2_base + USB2_INT_ENABLE);
@@ -466,19 +477,21 @@ static int rcar_gen3_phy_usb2_power_on(struct phy *p)
struct rcar_gen3_phy *rphy = phy_get_drvdata(p);
struct rcar_gen3_chan *channel = rphy->ch;
void __iomem *usb2_base = channel->base;
+ unsigned long flags;
u32 val;
int ret = 0;
- mutex_lock(&channel->lock);
- if (!rcar_gen3_are_all_rphys_power_off(channel))
- goto out;
-
if (channel->vbus) {
ret = regulator_enable(channel->vbus);
if (ret)
- goto out;
+ return ret;
}
+ spin_lock_irqsave(&channel->lock, flags);
+
+ if (!rcar_gen3_are_all_rphys_power_off(channel))
+ goto out;
+
val = readl(usb2_base + USB2_USBCTR);
val |= USB2_USBCTR_PLL_RST;
writel(val, usb2_base + USB2_USBCTR);
@@ -488,7 +501,8 @@ static int rcar_gen3_phy_usb2_power_on(struct phy *p)
out:
/* The powered flag should be set for any other phys anyway */
rphy->powered = true;
- mutex_unlock(&channel->lock);
+
+ spin_unlock_irqrestore(&channel->lock, flags);
return 0;
}
@@ -497,20 +511,16 @@ static int rcar_gen3_phy_usb2_power_off(struct phy *p)
{
struct rcar_gen3_phy *rphy = phy_get_drvdata(p);
struct rcar_gen3_chan *channel = rphy->ch;
+ unsigned long flags;
int ret = 0;
- mutex_lock(&channel->lock);
+ spin_lock_irqsave(&channel->lock, flags);
rphy->powered = false;
-
- if (!rcar_gen3_are_all_rphys_power_off(channel))
- goto out;
+ spin_unlock_irqrestore(&channel->lock, flags);
if (channel->vbus)
ret = regulator_disable(channel->vbus);
-out:
- mutex_unlock(&channel->lock);
-
return ret;
}
@@ -650,7 +660,8 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
goto error;
}
- mutex_init(&channel->lock);
+ spin_lock_init(&channel->lock);
+
for (i = 0; i < NUM_OF_PHYS; i++) {
channel->rphys[i].phy = devm_phy_create(dev, NULL,
phy_usb2_ops);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 394/491] phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 395/491] bridge: br_nd_send: validate ND option lengths Greg Kroah-Hartman
` (101 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Lad Prabhakar,
Claudiu Beznea, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 9ce71e85b29eb63e48e294479742e670513f03a0 upstream.
Assert PLL reset on PHY power off. This saves power.
[claudiu.beznea: fixed conflict in rcar_gen3_phy_usb2_power_off() by
using spin_lock_irqsave()/spin_unlock_irqrestore() instead of
scoped_guard()]
Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")
Cc: stable@vger.kernel.org
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://lore.kernel.org/r/20250507125032.565017-5-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 558c07512c05b..9fcbde094699d 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -516,8 +516,15 @@ static int rcar_gen3_phy_usb2_power_off(struct phy *p)
spin_lock_irqsave(&channel->lock, flags);
rphy->powered = false;
- spin_unlock_irqrestore(&channel->lock, flags);
+ if (rcar_gen3_are_all_rphys_power_off(channel)) {
+ u32 val = readl(channel->base + USB2_USBCTR);
+
+ val |= USB2_USBCTR_PLL_RST;
+ writel(val, channel->base + USB2_USBCTR);
+ }
+ spin_unlock_irqrestore(&channel->lock, flags);
+
if (channel->vbus)
ret = regulator_disable(channel->vbus);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 395/491] bridge: br_nd_send: validate ND option lengths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 394/491] phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 396/491] cdc-acm: new quirk for EPSON HMD Greg Kroah-Hartman
` (100 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Ao Zhou,
Yuan Tan, Xin Liu, Ido Schimmel, Nikolay Aleksandrov,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <n05ec@lzu.edu.cn>
commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream.
br_nd_send() walks ND options according to option-provided lengths.
A malformed option can make the parser advance beyond the computed
option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before
advancing, and only read source LLADDR when the option is large enough
for an Ethernet address.
Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_arp_nd_proxy.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -285,12 +285,14 @@ static void br_nd_send(struct net_bridge
ns_olen = request->len - (skb_network_offset(request) +
sizeof(struct ipv6hdr)) - sizeof(*ns);
for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
- if (!ns->opt[i + 1]) {
+ if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) {
kfree_skb(reply);
return;
}
if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
- daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+ if ((ns->opt[i + 1] << 3) >=
+ sizeof(struct nd_opt_hdr) + ETH_ALEN)
+ daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
break;
}
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 396/491] cdc-acm: new quirk for EPSON HMD
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 395/491] bridge: br_nd_send: validate ND option lengths Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 397/491] comedi: dt2815: add hardware detection to prevent crash Greg Kroah-Hartman
` (99 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit f97e96c303d689708f7f713d8f3afcc31f1237e9 upstream.
This device has a union descriptor that is just garbage
and needs a custom descriptor.
In principle this could be done with a (conditionally
activated) heuristic. That would match more devices
without a need for defining a new quirk. However,
this always carries the risk that the heuristics
does the wrong thing and leads to more breakage.
Defining the quirk and telling it exactly what to do
is the safe and conservative approach.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260317084139.1461008-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 9 +++++++++
drivers/usb/class/cdc-acm.h | 1 +
2 files changed, 10 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1218,6 +1218,12 @@ static int acm_probe(struct usb_interfac
if (!data_interface || !control_interface)
return -ENODEV;
goto skip_normal_probe;
+ } else if (quirks == NO_UNION_12) {
+ data_interface = usb_ifnum_to_if(usb_dev, 2);
+ control_interface = usb_ifnum_to_if(usb_dev, 1);
+ if (!data_interface || !control_interface)
+ return -ENODEV;
+ goto skip_normal_probe;
}
/* normal probing*/
@@ -1749,6 +1755,9 @@ static const struct usb_device_id acm_id
{ USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */
.driver_info = DISABLE_ECHO, /* Don't echo banner */
},
+ { USB_DEVICE(0x04b8, 0x0d12), /* EPSON HMD Com&Sens */
+ .driver_info = NO_UNION_12, /* union descriptor is garbage */
+ },
{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
},
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -142,3 +142,4 @@ struct acm {
#define SEND_ZERO_PACKET BIT(6)
#define DISABLE_ECHO BIT(7)
#define MISSING_CAP_BRK BIT(8)
+#define NO_UNION_12 BIT(9)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 397/491] comedi: dt2815: add hardware detection to prevent crash
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 396/491] cdc-acm: new quirk for EPSON HMD Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 398/491] comedi: Reinit dev->spinlock between attachments to low-level drivers Greg Kroah-Hartman
` (98 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+72f94b474d6e50b71ffc, stable,
Ian Abbott, Deepanshu Kartikey
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 93853512f565e625df2397f0d8050d6aafd7c3ad upstream.
The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach
the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return
0xff (floating bus), but outb() operations can trigger page faults due
to undefined behavior, especially under race conditions:
BUG: unable to handle page fault for address: 000000007fffff90
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:dt2815_attach+0x6e0/0x1110
Add hardware detection by reading the status register before attempting
any write operations. If the read returns 0xff, assume no hardware is
present and fail the attach with -ENODEV. This prevents crashes from
outb() operations on non-existent hardware.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Tested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/]
Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/
Link: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/dt2815.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/staging/comedi/drivers/dt2815.c
+++ b/drivers/staging/comedi/drivers/dt2815.c
@@ -176,6 +176,18 @@ static int dt2815_attach(struct comedi_d
? current_range_type : voltage_range_type;
}
+ /*
+ * Check if hardware is present before attempting any I/O operations.
+ * Reading 0xff from status register typically indicates no hardware
+ * on the bus (floating bus reads as all 1s).
+ */
+ if (inb(dev->iobase + DT2815_STATUS) == 0xff) {
+ dev_err(dev->class_dev,
+ "No hardware detected at I/O base 0x%lx\n",
+ dev->iobase);
+ return -ENODEV;
+ }
+
/* Init the 2815 */
outb(0x00, dev->iobase + DT2815_STATUS);
for (i = 0; i < 100; i++) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 398/491] comedi: Reinit dev->spinlock between attachments to low-level drivers
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 397/491] comedi: dt2815: add hardware detection to prevent crash Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 399/491] comedi: ni_atmio16d: Fix invalid clean-up after failed attach Greg Kroah-Hartman
` (97 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cc9f7f4a7df09f53c4a4, stable,
Ian Abbott
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit 4b9a9a6d71e3e252032f959fb3895a33acb5865c upstream.
`struct comedi_device` is the main controlling structure for a COMEDI
device created by the COMEDI subsystem. It contains a member `spinlock`
containing a spin-lock that is initialized by the COMEDI subsystem, but
is reserved for use by a low-level driver attached to the COMEDI device
(at least since commit 25436dc9d84f ("Staging: comedi: remove RT
code")).
Some COMEDI devices (those created on initialization of the COMEDI
subsystem when the "comedi.comedi_num_legacy_minors" parameter is
non-zero) can be attached to different low-level drivers over their
lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in
inconsistent lock states being reported when there is a mismatch in the
spin-lock locking levels used by each low-level driver to which the
COMEDI device has been attached. Fix it by reinitializing
`dev->spinlock` before calling the low-level driver's `attach` function
pointer if `CONFIG_LOCKDEP` is enabled.
Reported-by: syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cc9f7f4a7df09f53c4a4
Fixes: ed9eccbe8970 ("Staging: add comedi core")
Cc: stable <stable@kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260225132427.86578-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -1000,6 +1000,14 @@ int comedi_device_attach(struct comedi_d
ret = -EIO;
goto out;
}
+ if (IS_ENABLED(CONFIG_LOCKDEP)) {
+ /*
+ * dev->spinlock is for private use by the attached low-level
+ * driver. Reinitialize it to stop lock-dependency tracking
+ * between attachments to different low-level drivers.
+ */
+ spin_lock_init(&dev->spinlock);
+ }
dev->driver = driv;
dev->board_name = dev->board_ptr ? *(const char **)dev->board_ptr
: dev->driver->driver_name;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 399/491] comedi: ni_atmio16d: Fix invalid clean-up after failed attach
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 398/491] comedi: Reinit dev->spinlock between attachments to low-level drivers Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 400/491] comedi: me_daq: Fix potential overrun of firmware buffer Greg Kroah-Hartman
` (96 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ian Abbott
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit 101ab946b79ad83b36d5cfd47de587492a80acf0 upstream.
If the driver's COMEDI "attach" handler function (`atmio16d_attach()`)
returns an error, the COMEDI core will call the driver's "detach"
handler function (`atmio16d_detach()`) to clean up. This calls
`reset_atmio16d()` unconditionally, but depending on where the error
occurred in the attach handler, the device may not have been
sufficiently initialized to call `reset_atmio16d()`. It uses
`dev->iobase` as the I/O port base address and `dev->private` as the
pointer to the COMEDI device's private data structure. `dev->iobase`
may still be set to its initial value of 0, which would result in
undesired writes to low I/O port addresses. `dev->private` may still be
`NULL`, which would result in null pointer dereferences.
Fix `atmio16d_detach()` by checking that `dev->private` is valid
(non-null) before calling `reset_atmio16d()`. This implies that
`dev->iobase` was set correctly since that is set up before
`dev->private`.
Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260128150011.5006-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/ni_atmio16d.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/comedi/drivers/ni_atmio16d.c
+++ b/drivers/staging/comedi/drivers/ni_atmio16d.c
@@ -699,7 +699,8 @@ static int atmio16d_attach(struct comedi
static void atmio16d_detach(struct comedi_device *dev)
{
- reset_atmio16d(dev);
+ if (dev->private)
+ reset_atmio16d(dev);
comedi_legacy_detach(dev);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 400/491] comedi: me_daq: Fix potential overrun of firmware buffer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 399/491] comedi: ni_atmio16d: Fix invalid clean-up after failed attach Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 401/491] comedi: me4000: " Greg Kroah-Hartman
` (95 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ian Abbott
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit cc797d4821c754c701d9714b58bea947e31dbbe0 upstream.
`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards. Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
Fixes: 85acac61096f9 ("Staging: comedi: add me_daq driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260205140130.76697-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/me_daq.c | 35 +++++++++++++++++---------------
1 file changed, 19 insertions(+), 16 deletions(-)
--- a/drivers/staging/comedi/drivers/me_daq.c
+++ b/drivers/staging/comedi/drivers/me_daq.c
@@ -345,6 +345,25 @@ static int me2600_xilinx_download(struct
unsigned int file_length;
unsigned int i;
+ /*
+ * Format of the firmware
+ * Build longs from the byte-wise coded header
+ * Byte 1-3: length of the array
+ * Byte 4-7: version
+ * Byte 8-11: date
+ * Byte 12-15: reserved
+ */
+ if (size >= 4) {
+ file_length = (((unsigned int)data[0] & 0xff) << 24) +
+ (((unsigned int)data[1] & 0xff) << 16) +
+ (((unsigned int)data[2] & 0xff) << 8) +
+ ((unsigned int)data[3] & 0xff);
+ }
+ if (size < 16 || file_length > size - 16) {
+ dev_err(dev->class_dev, "Firmware length inconsistency\n");
+ return -EINVAL;
+ }
+
/* disable irq's on PLX */
writel(0x00, devpriv->plx_regbase + PLX9052_INTCSR);
@@ -359,22 +378,6 @@ static int me2600_xilinx_download(struct
sleep(1);
/*
- * Format of the firmware
- * Build longs from the byte-wise coded header
- * Byte 1-3: length of the array
- * Byte 4-7: version
- * Byte 8-11: date
- * Byte 12-15: reserved
- */
- if (size < 16)
- return -EINVAL;
-
- file_length = (((unsigned int)data[0] & 0xff) << 24) +
- (((unsigned int)data[1] & 0xff) << 16) +
- (((unsigned int)data[2] & 0xff) << 8) +
- ((unsigned int)data[3] & 0xff);
-
- /*
* Loop for writing firmware byte by byte to xilinx
* Firmware data start at offset 16
*/
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 401/491] comedi: me4000: Fix potential overrun of firmware buffer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 400/491] comedi: me_daq: Fix potential overrun of firmware buffer Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 402/491] netfilter: ipset: drop logically empty buckets in mtype_del Greg Kroah-Hartman
` (94 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ian Abbott
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit 3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7 upstream.
`me4000_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
Note: The firmware loading was totally broken before commit ac584af59945
("staging: comedi: me4000: fix firmware downloading"), but that is the
most sensible target for this fix.
Fixes: ac584af59945 ("staging: comedi: me4000: fix firmware downloading")
Cc: stable <stable@kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260205133949.71722-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/me4000.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -316,6 +316,18 @@ static int me4000_xilinx_download(struct
unsigned int val;
unsigned int i;
+ /* Get data stream length from header. */
+ if (size >= 4) {
+ file_length = (((unsigned int)data[0] & 0xff) << 24) +
+ (((unsigned int)data[1] & 0xff) << 16) +
+ (((unsigned int)data[2] & 0xff) << 8) +
+ ((unsigned int)data[3] & 0xff);
+ }
+ if (size < 16 || file_length > size - 16) {
+ dev_err(dev->class_dev, "Firmware length inconsistency\n");
+ return -EINVAL;
+ }
+
if (!xilinx_iobase)
return -ENODEV;
@@ -347,10 +359,6 @@ static int me4000_xilinx_download(struct
outl(val, devpriv->plx_regbase + PLX9052_CNTRL);
/* Download Xilinx firmware */
- file_length = (((unsigned int)data[0] & 0xff) << 24) +
- (((unsigned int)data[1] & 0xff) << 16) +
- (((unsigned int)data[2] & 0xff) << 8) +
- ((unsigned int)data[3] & 0xff);
usleep_range(10, 1000);
for (i = 0; i < file_length; i++) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 402/491] netfilter: ipset: drop logically empty buckets in mtype_del
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 401/491] comedi: me4000: " Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 403/491] vxlan: validate ND option lengths in vxlan_na_create Greg Kroah-Hartman
` (93 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juefei Pu, Xin Liu, Yifan Wu,
Yuan Tan, Phil Sutter, Pablo Neira Ayuso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Wu <yifanwucs@gmail.com>
commit 9862ef9ab0a116c6dca98842aab7de13a252ae02 upstream.
mtype_del() counts empty slots below n->pos in k, but it only drops the
bucket when both n->pos and k are zero. This misses buckets whose live
entries have all been removed while n->pos still points past deleted slots.
Treat a bucket as empty when all positions below n->pos are unused and
release it directly instead of shrinking it further.
Fixes: 8af1c6fbd923 ("netfilter: ipset: Fix forceadd evaluation path")
Cc: stable@vger.kernel.org
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1108,7 +1108,7 @@ mtype_del(struct ip_set *set, void *valu
if (!test_bit(i, n->used))
k++;
}
- if (n->pos == 0 && k == 0) {
+ if (k == n->pos) {
t->hregion[r].ext_size -= ext_size(n->size, dsize);
rcu_assign_pointer(hbucket(t, key), NULL);
kfree_rcu(n, rcu);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 403/491] vxlan: validate ND option lengths in vxlan_na_create
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 402/491] netfilter: ipset: drop logically empty buckets in mtype_del Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 404/491] net: ftgmac100: fix ring allocation unwind on open failure Greg Kroah-Hartman
` (92 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Ao Zhou,
Yuan Tan, Xin Liu, Ido Schimmel, Nikolay Aleksandrov,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <n05ec@lzu.edu.cn>
commit afa9a05e6c4971bd5586f1b304e14d61fb3d9385 upstream.
vxlan_na_create() walks ND options according to option-provided
lengths. A malformed option can make the parser advance beyond the
computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before
advancing, and only read source LLADDR when the option is large enough
for an Ethernet address.
Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260326034441.2037420-4-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vxlan/vxlan_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2098,12 +2098,14 @@ static struct sk_buff *vxlan_na_create(s
ns_olen = request->len - skb_network_offset(request) -
sizeof(struct ipv6hdr) - sizeof(*ns);
for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
- if (!ns->opt[i + 1]) {
+ if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) {
kfree_skb(reply);
return NULL;
}
if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
- daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+ if ((ns->opt[i + 1] << 3) >=
+ sizeof(struct nd_opt_hdr) + ETH_ALEN)
+ daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
break;
}
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 404/491] net: ftgmac100: fix ring allocation unwind on open failure
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 403/491] vxlan: validate ND option lengths in vxlan_na_create Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 405/491] thunderbolt: Fix property read in nhi_wake_supported() Greg Kroah-Hartman
` (91 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yufan Chen, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yufan Chen <yufan.chen@linux.dev>
commit c0fd0fe745f5e8c568d898cd1513d0083e46204a upstream.
ftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and
rx_scratch in stages. On intermediate failures it returned -ENOMEM
directly, leaking resources allocated earlier in the function.
Rework the failure path to use staged local unwind labels and free
allocated resources in reverse order before returning -ENOMEM. This
matches common netdev allocation cleanup style.
Fixes: d72e01a0430f ("ftgmac100: Use a scratch buffer for failed RX allocations")
Cc: stable@vger.kernel.org
Signed-off-by: Yufan Chen <yufan.chen@linux.dev>
Link: https://patch.msgid.link/20260328163257.60836-1-yufan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/faraday/ftgmac100.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -931,19 +931,19 @@ static int ftgmac100_alloc_rings(struct
priv->tx_skbs = kcalloc(MAX_TX_QUEUE_ENTRIES, sizeof(void *),
GFP_KERNEL);
if (!priv->tx_skbs)
- return -ENOMEM;
+ goto err_free_rx_skbs;
/* Allocate descriptors */
priv->rxdes = dma_alloc_coherent(priv->dev,
MAX_RX_QUEUE_ENTRIES * sizeof(struct ftgmac100_rxdes),
&priv->rxdes_dma, GFP_KERNEL);
if (!priv->rxdes)
- return -ENOMEM;
+ goto err_free_tx_skbs;
priv->txdes = dma_alloc_coherent(priv->dev,
MAX_TX_QUEUE_ENTRIES * sizeof(struct ftgmac100_txdes),
&priv->txdes_dma, GFP_KERNEL);
if (!priv->txdes)
- return -ENOMEM;
+ goto err_free_rxdes;
/* Allocate scratch packet buffer */
priv->rx_scratch = dma_alloc_coherent(priv->dev,
@@ -951,9 +951,29 @@ static int ftgmac100_alloc_rings(struct
&priv->rx_scratch_dma,
GFP_KERNEL);
if (!priv->rx_scratch)
- return -ENOMEM;
+ goto err_free_txdes;
return 0;
+
+err_free_txdes:
+ dma_free_coherent(priv->dev,
+ MAX_TX_QUEUE_ENTRIES *
+ sizeof(struct ftgmac100_txdes),
+ priv->txdes, priv->txdes_dma);
+ priv->txdes = NULL;
+err_free_rxdes:
+ dma_free_coherent(priv->dev,
+ MAX_RX_QUEUE_ENTRIES *
+ sizeof(struct ftgmac100_rxdes),
+ priv->rxdes, priv->rxdes_dma);
+ priv->rxdes = NULL;
+err_free_tx_skbs:
+ kfree(priv->tx_skbs);
+ priv->tx_skbs = NULL;
+err_free_rx_skbs:
+ kfree(priv->rx_skbs);
+ priv->rx_skbs = NULL;
+ return -ENOMEM;
}
static void ftgmac100_init_rings(struct ftgmac100 *priv)
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 405/491] thunderbolt: Fix property read in nhi_wake_supported()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 404/491] net: ftgmac100: fix ring allocation unwind on open failure Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 406/491] USB: dummy-hcd: Fix locking/synchronization error Greg Kroah-Hartman
` (90 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Mika Westerberg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
commit 73a505dc48144ec72e25874e2b2a72487b02d3bc upstream.
device_property_read_foo() returns 0 on success and only then modifies
'val'. Currently, val is left uninitialized if the aforementioned
function returns non-zero, making nhi_wake_supported() return true
almost always (random != 0) if the property is not present in device
firmware.
Invert the check to make it make sense.
Fixes: 3cdb9446a117 ("thunderbolt: Add support for Intel Ice Lake")
Cc: stable@vger.kernel.org
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/nhi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -899,7 +899,7 @@ static bool nhi_wake_supported(struct pc
* If power rails are sustainable for wakeup from S4 this
* property is set by the BIOS.
*/
- if (device_property_read_u8(&pdev->dev, "WAKE_SUPPORTED", &val))
+ if (!device_property_read_u8(&pdev->dev, "WAKE_SUPPORTED", &val))
return !!val;
return true;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 406/491] USB: dummy-hcd: Fix locking/synchronization error
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 405/491] thunderbolt: Fix property read in nhi_wake_supported() Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 407/491] usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Greg Kroah-Hartman
` (89 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern,
syzbot+19bed92c97bee999e5db, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 616a63ff495df12863692ab3f9f7b84e3fa7a66d upstream.
Syzbot testing was able to provoke an addressing exception and crash
in the usb_gadget_udc_reset() routine in
drivers/usb/gadgets/udc/core.c, resulting from the fact that the
routine was called with a second ("driver") argument of NULL. The bad
caller was set_link_state() in dummy_hcd.c, and the problem arose
because of a race between a USB reset and driver unbind.
These sorts of races were not supposed to be possible; commit
7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"),
along with a few followup commits, was written specifically to prevent
them. As it turns out, there are (at least) two errors remaining in
the code. Another patch will address the second error; this one is
concerned with the first.
The error responsible for the syzbot crash occurred because the
stop_activity() routine will sometimes drop and then re-acquire the
dum->lock spinlock. A call to stop_activity() occurs in
set_link_state() when handling an emulated USB reset, after the test
of dum->ints_enabled and before the increment of dum->callback_usage.
This allowed another thread (doing a driver unbind) to sneak in and
grab the spinlock, and then clear dum->ints_enabled and dum->driver.
Normally this other thread would have to wait for dum->callback_usage
to go down to 0 before it would clear dum->driver, but in this case it
didn't have to wait since dum->callback_usage had not yet been
incremented.
The fix is to increment dum->callback_usage _before_ calling
stop_activity() instead of after. Then the thread doing the unbind
will not clear dum->driver until after the call to
usb_gadget_udc_reset() safely returns and dum->callback_usage has been
decremented again.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/68fc7c9c.050a0220.346f24.023c.GAE@google.com/
Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com
Fixes: 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change")
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/46135f42-fdbe-46b5-aac0-6ca70492af15@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/dummy_hcd.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -458,8 +458,13 @@ static void set_link_state(struct dummy_
/* Report reset and disconnect events to the driver */
if (dum->ints_enabled && (disconnect || reset)) {
- stop_activity(dum);
++dum->callback_usage;
+ /*
+ * stop_activity() can drop dum->lock, so it must
+ * not come between the dum->ints_enabled test
+ * and the ++dum->callback_usage.
+ */
+ stop_activity(dum);
spin_unlock(&dum->lock);
if (reset)
usb_gadget_udc_reset(&dum->gadget, dum->driver);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 407/491] usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 406/491] USB: dummy-hcd: Fix locking/synchronization error Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 408/491] nvmet-tcp: fix use-before-check of sg in bounds validation Greg Kroah-Hartman
` (88 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sebastian Urban, stable, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Urban <surban@surban.net>
commit f50200dd44125e445a6164e88c217472fa79cdbc upstream.
When a gadget request is only partially transferred in transfer()
because the per-frame bandwidth budget is exhausted, the loop advances
to the next queued request. If that next request is a zero-length
packet (ZLP), len evaluates to zero and the code takes the
unlikely(len == 0) path, which sets is_short = 1. This bypasses the
bandwidth guard ("limit < ep->ep.maxpacket && limit < len") that
lives in the else branch and would otherwise break out of the loop for
non-zero requests. The is_short path then completes the URB before all
data from the first request has been transferred.
Reproducer (bulk IN, high speed):
Device side (FunctionFS with Linux AIO):
1. Queue a 65024-byte write via io_submit (127 * 512, i.e. a
multiple of the HS bulk max packet size).
2. Immediately queue a zero-length write (ZLP) via io_submit.
Host side:
3. Submit a 65536-byte bulk IN URB.
Expected: URB completes with actual_length = 65024.
Actual: URB completes with actual_length = 53248, losing 11776
bytes that leak into subsequent URBs.
At high speed the per-frame budget is 53248 bytes (512 * 13 * 8).
The 65024-byte request exhausts this budget after 53248 bytes, leaving
the request incomplete (req->req.actual < req->req.length). Neither
the request nor the URB is finished, and rescan is 0, so the loop
advances to the ZLP. For the ZLP, dev_len = 0, so len = min(12288, 0)
= 0, taking the unlikely(len == 0) path and setting is_short = 1.
The is_short handler then sets *status = 0, completing the URB with
only 53248 of the expected 65024 bytes.
Fix this by breaking out of the loop when the current request has
remaining data (req->req.actual < req->req.length). The request
resumes on the next timer tick, preserving correct data ordering.
Signed-off-by: Sebastian Urban <surban@surban.net>
Cc: stable <stable@kernel.org>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260315151045.1155850-1-surban@surban.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/dummy_hcd.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1521,6 +1521,12 @@ top:
/* rescan to continue with any other queued i/o */
if (rescan)
goto top;
+
+ /* request not fully transferred; stop iterating to
+ * preserve data ordering across queued requests.
+ */
+ if (req->req.actual < req->req.length)
+ break;
}
return sent;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 408/491] nvmet-tcp: fix use-before-check of sg in bounds validation
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 407/491] usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 409/491] usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Greg Kroah-Hartman
` (87 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YunJe Shin, Sagi Grimberg,
Keith Busch, linux-nvme, Cengiz Can, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cengiz Can <cengiz.can@canonical.com>
The stable backport of commit 52a0a9854934 ("nvmet-tcp: add bounds
checks in nvmet_tcp_build_pdu_iovec") placed the bounds checks after
the iov_len calculation:
while (length) {
u32 iov_len = min_t(u32, length, sg->length - sg_offset);
if (!sg_remaining) { /* too late: sg already dereferenced */
In mainline, the checks come first because C99 allows mid-block variable
declarations. The stable backport moved the declaration to the top of the
loop to satisfy C89 declaration rules, but this ended up placing the
sg->length dereference before the sg_remaining and sg->length guards.
If sg_next() returns NULL at the end of the scatterlist, the next
iteration dereferences a NULL pointer in the iov_len calculation before
the sg_remaining check can prevent it.
Fix this by moving the iov_len declaration to function scope and
keeping the assignment after the bounds checks, matching the ordering
in mainline.
Fixes: 043b4307a99f ("nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec")
Cc: stable@vger.kernel.org
Cc: YunJe Shin <ioerts@kookmin.ac.kr>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: Keith Busch <kbusch@kernel.org>
Cc: linux-nvme@lists.infradead.org
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 5d8e57e5fdb18..6db9dcdbb3c34 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -300,7 +300,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
{
struct bio_vec *iov = cmd->iov;
struct scatterlist *sg;
- u32 length, offset, sg_offset;
+ u32 length, offset, sg_offset, iov_len;
unsigned int sg_remaining;
int nr_pages;
@@ -317,8 +317,6 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
while (length) {
- u32 iov_len = min_t(u32, length, sg->length - sg_offset);
-
if (!sg_remaining) {
nvmet_tcp_fatal_error(cmd->queue);
return;
@@ -328,6 +326,8 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
return;
}
+ iov_len = min_t(u32, length, sg->length - sg_offset);
+
iov->bv_page = sg_page(sg);
iov->bv_len = iov_len;
iov->bv_offset = sg->offset + sg_offset;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 409/491] usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 408/491] nvmet-tcp: fix use-before-check of sg in bounds validation Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 410/491] usb: gadget: f_rndis: Protect RNDIS options with mutex Greg Kroah-Hartman
` (86 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuen-Han Tsai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
commit caa27923aacd8a5869207842f2ab1657c6c0c7bc upstream.
geth_alloc() increments the reference count, but geth_free() fails to
decrement it. This prevents the configuration of attributes via configfs
after unlinking the function.
Decrement the reference count in geth_free() to ensure proper cleanup.
Fixes: 02832e56f88a ("usb: gadget: f_subset: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_subset.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/gadget/function/f_subset.c
+++ b/drivers/usb/gadget/function/f_subset.c
@@ -6,6 +6,7 @@
* Copyright (C) 2008 Nokia Corporation
*/
+#include <linux/cleanup.h>
#include <linux/slab.h>
#include <linux/kernel.h>
#include <linux/module.h>
@@ -451,8 +452,14 @@ static struct usb_function_instance *get
static void geth_free(struct usb_function *f)
{
struct f_gether *eth;
+ struct f_gether_opts *opts;
+
+ opts = container_of(f->fi, struct f_gether_opts, func_inst);
eth = func_to_geth(f);
+ mutex_lock(&opts->lock);
+ opts->refcnt--;
+ mutex_unlock(&opts->lock);
kfree(eth);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 410/491] usb: gadget: f_rndis: Protect RNDIS options with mutex
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 409/491] usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 411/491] usb: gadget: f_uac1_legacy: validate control request size Greg Kroah-Hartman
` (85 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuen-Han Tsai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
commit 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e upstream.
The class/subclass/protocol options are suspectible to race conditions
as they can be accessed concurrently through configfs.
Use existing mutex to protect these options. This issue was identified
during code inspection.
Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-2-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_rndis.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -11,6 +11,7 @@
/* #define VERBOSE_DEBUG */
+#include <linux/cleanup.h>
#include <linux/slab.h>
#include <linux/kernel.h>
#include <linux/module.h>
@@ -690,9 +691,11 @@ rndis_bind(struct usb_configuration *c,
f->os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc;
}
+ mutex_lock(&rndis_opts->lock);
rndis_iad_descriptor.bFunctionClass = rndis_opts->class;
rndis_iad_descriptor.bFunctionSubClass = rndis_opts->subclass;
rndis_iad_descriptor.bFunctionProtocol = rndis_opts->protocol;
+ mutex_unlock(&rndis_opts->lock);
/*
* in drivers/usb/gadget/configfs.c:configfs_composite_bind()
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 411/491] usb: gadget: f_uac1_legacy: validate control request size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 410/491] usb: gadget: f_rndis: Protect RNDIS options with mutex Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 412/491] io_uring/tctx: work around xa_store() allocation error issue Greg Kroah-Hartman
` (84 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Taegu Ha, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taegu Ha <hataegu0826@gmail.com>
commit 6e0e34d85cd46ceb37d16054e97a373a32770f6c upstream.
f_audio_complete() copies req->length bytes into a 4-byte stack
variable:
u32 data = 0;
memcpy(&data, req->buf, req->length);
req->length is derived from the host-controlled USB request path,
which can lead to a stack out-of-bounds write.
Validate req->actual against the expected payload size for the
supported control selectors and decode only the expected amount
of data.
This avoids copying a host-influenced length into a fixed-size
stack object.
Signed-off-by: Taegu Ha <hataegu0826@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260401191311.3604898-1-hataegu0826@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uac1_legacy.c | 47 ++++++++++++++++++++++------
1 file changed, 37 insertions(+), 10 deletions(-)
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -360,19 +360,46 @@ static int f_audio_out_ep_complete(struc
static void f_audio_complete(struct usb_ep *ep, struct usb_request *req)
{
struct f_audio *audio = req->context;
- int status = req->status;
- u32 data = 0;
struct usb_ep *out_ep = audio->out_ep;
- switch (status) {
-
- case 0: /* normal completion? */
- if (ep == out_ep)
+ switch (req->status) {
+ case 0:
+ if (ep == out_ep) {
f_audio_out_ep_complete(ep, req);
- else if (audio->set_con) {
- memcpy(&data, req->buf, req->length);
- audio->set_con->set(audio->set_con, audio->set_cmd,
- le16_to_cpu(data));
+ } else if (audio->set_con) {
+ struct usb_audio_control *con = audio->set_con;
+ u8 type = con->type;
+ u32 data;
+ bool valid_request = false;
+
+ switch (type) {
+ case UAC_FU_MUTE: {
+ u8 value;
+
+ if (req->actual == sizeof(value)) {
+ memcpy(&value, req->buf, sizeof(value));
+ data = value;
+ valid_request = true;
+ }
+ break;
+ }
+ case UAC_FU_VOLUME: {
+ __le16 value;
+
+ if (req->actual == sizeof(value)) {
+ memcpy(&value, req->buf, sizeof(value));
+ data = le16_to_cpu(value);
+ valid_request = true;
+ }
+ break;
+ }
+ }
+
+ if (valid_request)
+ con->set(con, audio->set_cmd, data);
+ else
+ usb_ep_set_halt(ep);
+
audio->set_con = NULL;
}
break;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 412/491] io_uring/tctx: work around xa_store() allocation error issue
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 411/491] usb: gadget: f_uac1_legacy: validate control request size Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 413/491] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
` (83 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cc36d44ec9f368e443d3,
Jens Axboe, Robert Garcia
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 upstream.
syzbot triggered the following WARN_ON:
WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
which is the
WARN_ON_ONCE(!xa_empty(&tctx->xa));
sanity check in __io_uring_free() when a io_uring_task is going through
its final put. The syzbot test case includes injecting memory allocation
failures, and it very much looks like xa_store() can fail one of its
memory allocations and end up with ->head being non-NULL even though no
entries exist in the xarray.
Until this issue gets sorted out, work around it by attempting to
iterate entries in our xarray, and WARN_ON_ONCE() if one is found.
Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com
Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ Modify the function in io_uring.c because it's located here in v5.15. ]
Signed-off-by: Robert Garcia <rob_garcia@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -8524,8 +8524,19 @@ static int io_uring_alloc_task_context(s
void __io_uring_free(struct task_struct *tsk)
{
struct io_uring_task *tctx = tsk->io_uring;
+ struct io_tctx_node *node;
+ unsigned long index;
- WARN_ON_ONCE(!xa_empty(&tctx->xa));
+ /*
+ * Fault injection forcing allocation errors in the xa_store() path
+ * can lead to xa_empty() returning false, even though no actual
+ * node is stored in the xarray. Until that gets sorted out, attempt
+ * an iteration here and warn if any entries are found.
+ */
+ xa_for_each(&tctx->xa, index, node) {
+ WARN_ON_ONCE(1);
+ break;
+ }
WARN_ON_ONCE(tctx->io_wq);
WARN_ON_ONCE(tctx->cached_refs);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 413/491] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 412/491] io_uring/tctx: work around xa_store() allocation error issue Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 414/491] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
` (82 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream.
Since the ChaCha permutation is invertible, the local variable
'permuted_state' is sufficient to compute the original 'state', and thus
the key, even after the permutation has been done.
While the kernel is quite inconsistent about zeroizing secrets on the
stack (and some prominent userspace crypto libraries don't bother at all
since it's not guaranteed to work anyway), the kernel does try to do it
as a best practice, especially in cases involving the RNG.
Thus, explicitly zeroize 'permuted_state' before it goes out of scope.
Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/crypto/chacha.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/lib/crypto/chacha.c
+++ b/lib/crypto/chacha.c
@@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8
put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
state[12]++;
+
+ memzero_explicit(x, sizeof(x));
}
EXPORT_SYMBOL(chacha_block_generic);
@@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *st
memcpy(&stream[0], &x[0], 16);
memcpy(&stream[4], &x[12], 16);
+
+ memzero_explicit(x, sizeof(x));
}
EXPORT_SYMBOL(hchacha_block_generic);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 414/491] wifi: rt2x00usb: fix devres lifetime
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 413/491] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
@ 2026-04-13 16:00 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 415/491] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
` (81 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishal Thanki, Johan Hovold,
Stanislaw Gruszka, Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 25369b22223d1c56e42a0cd4ac9137349d5a898e upstream.
USB drivers bind to USB interfaces and any device managed resources
should have their lifetime tied to the interface rather than parent USB
device. This avoids issues like memory leaks when drivers are unbound
without their devices being physically disconnected (e.g. on probe
deferral or configuration changes).
Fix the USB anchor lifetime so that it is released on driver unbind.
Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
Cc: stable@vger.kernel.org # 4.7
Cc: Vishal Thanki <vishalthanki@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260327113219.1313748-1-johan@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
@@ -830,7 +830,7 @@ int rt2x00usb_probe(struct usb_interface
if (retval)
goto exit_free_device;
- rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
+ rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,
sizeof(struct usb_anchor),
GFP_KERNEL);
if (!rt2x00dev->anchor) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 415/491] xfrm_user: fix info leak in build_report()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-04-13 16:00 ` [PATCH 5.10 414/491] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 416/491] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
` (80 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d10119968d0e1f2b669604baf2a8b5fdb72fa6b4 upstream.
struct xfrm_user_report is a __u8 proto field followed by a struct
xfrm_selector which means there is three "empty" bytes of padding, but
the padding is never zeroed before copying to userspace. Fix that up by
zeroing the structure before setting individual member variables.
Cc: stable <stable@kernel.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3445,6 +3445,7 @@ static int build_report(struct sk_buff *
return -EMSGSIZE;
ur = nlmsg_data(nlh);
+ memset(ur, 0, sizeof(*ur));
ur->proto = proto;
memcpy(&ur->sel, sel, sizeof(ur->sel));
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 416/491] Input: uinput - fix circular locking dependency with ff-core
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 415/491] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 417/491] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
` (79 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikhail Gavrilov, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 upstream.
A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with uinput (for
example, playing ELDEN RING under Wine with a Flydigi Vader 5
controller):
ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
The cycle is caused by four lock acquisition paths:
1. ff upload: input_ff_upload() holds ff->mutex and calls
uinput_dev_upload_effect() -> uinput_request_submit() ->
uinput_request_send(), which acquires udev->mutex.
2. device create: uinput_ioctl_handler() holds udev->mutex and calls
uinput_create_device() -> input_register_device(), which acquires
input_mutex.
3. device register: input_register_device() holds input_mutex and
calls kbd_connect() -> input_register_handle(), which acquires
dev->mutex.
4. evdev release: evdev_release() calls input_flush_device() under
dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
Fix this by introducing a new state_lock spinlock to protect
udev->state and udev->dev access in uinput_request_send() instead of
acquiring udev->mutex. The function only needs to atomically check
device state and queue an input event into the ring buffer via
uinput_dev_event() -- both operations are safe under a spinlock
(ktime_get_ts64() and wake_up_interruptible() do not sleep). This
breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
the lock ordering and cannot form cycles with mutexes.
To keep state transitions visible to uinput_request_send(), protect
writes to udev->state in uinput_create_device() and
uinput_destroy_device() with the same state_lock spinlock.
Additionally, move init_completion(&request->done) from
uinput_request_send() to uinput_request_submit() before
uinput_request_reserve_slot(). Once the slot is allocated,
uinput_flush_requests() may call complete() on it at any time from
the destroy path, so the completion must be initialised before the
request becomes visible.
Lock ordering after the fix:
ff->mutex -> state_lock (spinlock, leaf)
udev->mutex -> state_lock (spinlock, leaf)
udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
Fixes: ff462551235d ("Input: uinput - switch to the new FF interface")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Link: https://patch.msgid.link/20260407075031.38351-1-mikhail.v.gavrilov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/uinput.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -56,6 +56,7 @@ struct uinput_device {
struct input_dev *dev;
struct mutex mutex;
enum uinput_state state;
+ spinlock_t state_lock;
wait_queue_head_t waitq;
unsigned char ready;
unsigned char head;
@@ -145,19 +146,15 @@ static void uinput_request_release_slot(
static int uinput_request_send(struct uinput_device *udev,
struct uinput_request *request)
{
- int retval;
+ int retval = 0;
- retval = mutex_lock_interruptible(&udev->mutex);
- if (retval)
- return retval;
+ spin_lock(&udev->state_lock);
if (udev->state != UIST_CREATED) {
retval = -ENODEV;
goto out;
}
- init_completion(&request->done);
-
/*
* Tell our userspace application about this new request
* by queueing an input event.
@@ -165,7 +162,7 @@ static int uinput_request_send(struct ui
uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
out:
- mutex_unlock(&udev->mutex);
+ spin_unlock(&udev->state_lock);
return retval;
}
@@ -174,6 +171,13 @@ static int uinput_request_submit(struct
{
int retval;
+ /*
+ * Initialize completion before allocating the request slot.
+ * Once the slot is allocated, uinput_flush_requests() may
+ * complete it at any time, so it must be initialized first.
+ */
+ init_completion(&request->done);
+
retval = uinput_request_reserve_slot(udev, request);
if (retval)
return retval;
@@ -288,7 +292,14 @@ static void uinput_destroy_device(struct
struct input_dev *dev = udev->dev;
enum uinput_state old_state = udev->state;
+ /*
+ * Update state under state_lock so that concurrent
+ * uinput_request_send() sees the state change before we
+ * flush pending requests and tear down the device.
+ */
+ spin_lock(&udev->state_lock);
udev->state = UIST_NEW_DEVICE;
+ spin_unlock(&udev->state_lock);
if (dev) {
name = dev->name;
@@ -365,7 +376,9 @@ static int uinput_create_device(struct u
if (error)
goto fail2;
+ spin_lock(&udev->state_lock);
udev->state = UIST_CREATED;
+ spin_unlock(&udev->state_lock);
return 0;
@@ -383,6 +396,7 @@ static int uinput_open(struct inode *ino
return -ENOMEM;
mutex_init(&newdev->mutex);
+ spin_lock_init(&newdev->state_lock);
spin_lock_init(&newdev->requests_lock);
init_waitqueue_head(&newdev->requests_waitq);
init_waitqueue_head(&newdev->waitq);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 417/491] Input: uinput - take event lock when submitting FF request "event"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 416/491] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 418/491] mm/hugetlb: fix skipping of unsharing of pmd page tables Greg Kroah-Hartman
` (78 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikhail Gavrilov, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit ff14dafde15c11403fac61367a34fea08926e9ee upstream.
To avoid racing with FF playback events and corrupting device's event
queue take event_lock spinlock when calling uinput_dev_event() when
submitting a FF upload or erase "event".
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Link: https://patch.msgid.link/adXkf6MWzlB8LA_s@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/uinput.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -25,8 +25,10 @@
#include <linux/module.h>
#include <linux/init.h>
#include <linux/fs.h>
+#include <linux/lockdep.h>
#include <linux/miscdevice.h>
#include <linux/overflow.h>
+#include <linux/spinlock.h>
#include <linux/input/mt.h>
#include "../input-compat.h"
@@ -75,6 +77,8 @@ static int uinput_dev_event(struct input
struct uinput_device *udev = input_get_drvdata(dev);
struct timespec64 ts;
+ lockdep_assert_held(&dev->event_lock);
+
ktime_get_ts64(&ts);
udev->buff[udev->head] = (struct input_event) {
@@ -146,6 +150,7 @@ static void uinput_request_release_slot(
static int uinput_request_send(struct uinput_device *udev,
struct uinput_request *request)
{
+ unsigned long flags;
int retval = 0;
spin_lock(&udev->state_lock);
@@ -159,7 +164,9 @@ static int uinput_request_send(struct ui
* Tell our userspace application about this new request
* by queueing an input event.
*/
+ spin_lock_irqsave(&udev->dev->event_lock, flags);
uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
+ spin_unlock_irqrestore(&udev->dev->event_lock, flags);
out:
spin_unlock(&udev->state_lock);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 418/491] mm/hugetlb: fix skipping of unsharing of pmd page tables
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 417/491] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable Greg Kroah-Hartman
` (77 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Arm), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Arm) <david@kernel.org>
In the 5.10 backport of commit b30c14cd6102 ("hugetlb: unshare some PMDs
when splitting VMAs") we seemed to have missed that huge_pmd_unshare()
still adjusts the address itself.
For this reason, commit 6dfeaff93be1 ("hugetlb/userfaultfd: unshare all
pmds for hugetlbfs when register wp") explicitly handled this case by
passing a temporary variable instead.
Fix it in 5.10 by doing the same thing.
Fixes: f1082f5f3d02 ("hugetlb: unshare some PMDs when splitting VMAs")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 8efe35ea0baa7..99a71943c1f69 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5787,11 +5787,14 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
i_mmap_assert_write_locked(vma->vm_file->f_mapping);
}
for (address = start; address < end; address += PUD_SIZE) {
+ unsigned long tmp = address;
+
ptep = huge_pte_offset(mm, address, sz);
if (!ptep)
continue;
ptl = huge_pte_lock(h, mm, ptep);
- huge_pmd_unshare(mm, vma, &address, ptep);
+ /* We don't want 'address' to be changed */
+ huge_pmd_unshare(mm, vma, &tmp, ptep);
spin_unlock(ptl);
}
flush_hugetlb_tlb_range(vma, start, end);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 418/491] mm/hugetlb: fix skipping of unsharing of pmd page tables Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 20:36 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Greg Kroah-Hartman
` (76 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaohe Lin, Lukas Bulwahn,
Mike Kravetz, Muchun Song, Andrew Morton, David Hildenbrand (Arm),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaohe Lin <linmiaohe@huawei.com>
If the pagetables are shared, we shouldn't copy or take references. Since
src could have unshared and dst shares with another vma, huge_pte_none()
is thus used to determine whether dst_pte is shared. But this check isn't
reliable. A shared pte could have pte none in pagetable in fact. The
page count of ptep page should be checked here in order to reliably
determine whether pte is shared.
[lukas.bulwahn@gmail.com: remove unused local variable dst_entry in copy_hugetlb_page_range()]
Link: https://lkml.kernel.org/r/20220822082525.26071-1-lukas.bulwahn@gmail.com
Link: https://lkml.kernel.org/r/20220816130553.31406-7-linmiaohe@huawei.com
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546)
[ David: We don't have 4eae4efa2c29 ("hugetlb: do early cow when page
pinned on src mm", so there are some contextual conflicts. ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 19 +++++++------------
1 file changed, 7 insertions(+), 12 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 99a71943c1f69..a2cab8f2190f8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3827,7 +3827,7 @@ static bool is_hugetlb_entry_hwpoisoned(pte_t pte)
int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
struct vm_area_struct *vma)
{
- pte_t *src_pte, *dst_pte, entry, dst_entry;
+ pte_t *src_pte, *dst_pte, entry;
struct page *ptepage;
unsigned long addr;
int cow;
@@ -3867,27 +3867,22 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
/*
* If the pagetables are shared don't copy or take references.
- * dst_pte == src_pte is the common case of src/dest sharing.
*
+ * dst_pte == src_pte is the common case of src/dest sharing.
* However, src could have 'unshared' and dst shares with
- * another vma. If dst_pte !none, this implies sharing.
- * Check here before taking page table lock, and once again
- * after taking the lock below.
+ * another vma. So page_count of ptep page is checked instead
+ * to reliably determine whether pte is shared.
*/
- dst_entry = huge_ptep_get(dst_pte);
- if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
+ if (page_count(virt_to_page(dst_pte)) > 1)
continue;
dst_ptl = huge_pte_lock(h, dst, dst_pte);
src_ptl = huge_pte_lockptr(h, src, src_pte);
spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
entry = huge_ptep_get(src_pte);
- dst_entry = huge_ptep_get(dst_pte);
- if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
+ if (huge_pte_none(entry)) {
/*
- * Skip if src entry none. Also, skip in the
- * unlikely case dst entry !none as this implies
- * sharing with another vma.
+ * Skip if src entry none.
*/
;
} else if (unlikely(is_hugetlb_entry_migration(entry) ||
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 20:37 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 421/491] mm/hugetlb: fix hugetlb_pmd_shared() Greg Kroah-Hartman
` (75 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jane Chu, Harry Yoo, Oscar Salvador,
David Hildenbrand, Jann Horn, Liu Shixin, Muchun Song,
Andrew Morton, David Hildenbrand (Arm), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <jane.chu@oracle.com>
commit 59d9094df3d79 ("mm: hugetlb: independent PMD page table shared
count") introduced ->pt_share_count dedicated to hugetlb PMD share count
tracking, but omitted fixing copy_hugetlb_page_range(), leaving the
function relying on page_count() for tracking that no longer works.
When lazy page table copy for hugetlb is disabled, that is, revert commit
bcd51a3c679d ("hugetlb: lazy page table copies in fork()") fork()'ing with
hugetlb PMD sharing quickly lockup -
[ 239.446559] watchdog: BUG: soft lockup - CPU#75 stuck for 27s!
[ 239.446611] RIP: 0010:native_queued_spin_lock_slowpath+0x7e/0x2e0
[ 239.446631] Call Trace:
[ 239.446633] <TASK>
[ 239.446636] _raw_spin_lock+0x3f/0x60
[ 239.446639] copy_hugetlb_page_range+0x258/0xb50
[ 239.446645] copy_page_range+0x22b/0x2c0
[ 239.446651] dup_mmap+0x3e2/0x770
[ 239.446654] dup_mm.constprop.0+0x5e/0x230
[ 239.446657] copy_process+0xd17/0x1760
[ 239.446660] kernel_clone+0xc0/0x3e0
[ 239.446661] __do_sys_clone+0x65/0xa0
[ 239.446664] do_syscall_64+0x82/0x930
[ 239.446668] ? count_memcg_events+0xd2/0x190
[ 239.446671] ? syscall_trace_enter+0x14e/0x1f0
[ 239.446676] ? syscall_exit_work+0x118/0x150
[ 239.446677] ? arch_exit_to_user_mode_prepare.constprop.0+0x9/0xb0
[ 239.446681] ? clear_bhb_loop+0x30/0x80
[ 239.446684] ? clear_bhb_loop+0x30/0x80
[ 239.446686] entry_SYSCALL_64_after_hwframe+0x76/0x7e
There are two options to resolve the potential latent issue:
1. warn against PMD sharing in copy_hugetlb_page_range(),
2. fix it.
This patch opts for the second option.
While at it, simplify the comment, the details are not actually relevant
anymore.
Link: https://lkml.kernel.org/r/20250916004520.1604530-1-jane.chu@oracle.com
Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: Jane Chu <jane.chu@oracle.com>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 14967a9c7d247841b0312c48dcf8cd29e55a4cc8)
[ David: We don't have ptdesc and the wrappers, so work directly on the
page->pt_share_count. CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING is still
called CONFIG_ARCH_WANT_HUGE_PMD_SHARE. ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a2cab8f2190f8..8fa34032bc173 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3865,16 +3865,11 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
break;
}
- /*
- * If the pagetables are shared don't copy or take references.
- *
- * dst_pte == src_pte is the common case of src/dest sharing.
- * However, src could have 'unshared' and dst shares with
- * another vma. So page_count of ptep page is checked instead
- * to reliably determine whether pte is shared.
- */
- if (page_count(virt_to_page(dst_pte)) > 1)
+#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
+ /* If the pagetables are shared, there is nothing to do */
+ if (atomic_read(&virt_to_page(dst_pte)->pt_share_count))
continue;
+#endif
dst_ptl = huge_pte_lock(h, dst, dst_pte);
src_ptl = huge_pte_lockptr(h, src, src_pte);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 421/491] mm/hugetlb: fix hugetlb_pmd_shared()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 422/491] mm/hugetlb: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
` (74 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Red Hat),
Rik van Riel, Lance Yang, Harry Yoo, Laurence Oberman,
Lorenzo Stoakes, Oscar Salvador, Liu Shixin, Uschakow, Stanislav,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Red Hat) <david@kernel.org>
Commit ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216 upstream.
Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using
mmu_gather)", v3.
One functional fix, one performance regression fix, and two related
comment fixes.
I cleaned up my prototype I recently shared [1] for the performance fix,
deferring most of the cleanups I had in the prototype to a later point.
While doing that I identified the other things.
The goal of this patch set is to be backported to stable trees "fairly"
easily. At least patch #1 and #4.
Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing
Patch #2 + #3 are simple comment fixes that patch #4 interacts with.
Patch #4 is a fix for the reported performance regression due to excessive
IPI broadcasts during fork()+exit().
The last patch is all about TLB flushes, IPIs and mmu_gather.
Read: complicated
There are plenty of cleanups in the future to be had + one reasonable
optimization on x86. But that's all out of scope for this series.
Runtime tested, with a focus on fixing the performance regression using
the original reproducer [2] on x86.
This patch (of 4):
We switched from (wrongly) using the page count to an independent shared
count. Now, shared page tables have a refcount of 1 (excluding
speculative references) and instead use ptdesc->pt_share_count to identify
sharing.
We didn't convert hugetlb_pmd_shared(), so right now, we would never
detect a shared PMD table as such, because sharing/unsharing no longer
touches the refcount of a PMD table.
Page migration, like mbind() or migrate_pages() would allow for migrating
folios mapped into such shared PMD tables, even though the folios are not
exclusive. In smaps we would account them as "private" although they are
"shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the
pagemap interface.
Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().
Link: https://lkml.kernel.org/r/20251223214037.580860-1-david@kernel.org
Link: https://lkml.kernel.org/r/20251223214037.580860-2-david@kernel.org
Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [1]
Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [2]
Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Tested-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216)
[ David: We don't have ptdesc and the wrappers, so work directly on
page->pt_share_count. ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/hugetlb.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 1c03935aa3d13..0d3fece27031c 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -955,7 +955,7 @@ static inline __init void hugetlb_cma_check(void)
#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
static inline bool hugetlb_pmd_shared(pte_t *pte)
{
- return page_count(virt_to_page(pte)) > 1;
+ return atomic_read(&virt_to_page(pte)->pt_share_count);
}
#else
static inline bool hugetlb_pmd_shared(pte_t *pte)
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 422/491] mm/hugetlb: fix two comments related to huge_pmd_unshare()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 421/491] mm/hugetlb: fix hugetlb_pmd_shared() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 423/491] mm/rmap: " Greg Kroah-Hartman
` (73 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Red Hat),
Rik van Riel, Laurence Oberman, Lorenzo Stoakes, Oscar Salvador,
Harry Yoo, Liu Shixin, Lance Yang, Uschakow, Stanislav,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Red Hat) <david@kernel.org>
Ever since we stopped using the page count to detect shared PMD page
tables, these comments are outdated.
The only reason we have to flush the TLB early is because once we drop the
i_mmap_rwsem, the previously shared page table could get freed (to then
get reallocated and used for other purpose). So we really have to flush
the TLB before that could happen.
So let's simplify the comments a bit.
The "If we unshared PMDs, the TLB flush was not recorded in mmu_gather."
part introduced as in commit a4a118f2eead ("hugetlbfs: flush TLBs
correctly after huge_pmd_unshare") was confusing: sure it is recorded in
the mmu_gather, otherwise tlb_flush_mmu_tlbonly() wouldn't do anything.
So let's drop that comment while at it as well.
We'll centralize these comments in a single helper as we rework the code
next.
Link: https://lkml.kernel.org/r/20251223214037.580860-3-david@kernel.org
Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 3937027caecb4f8251e82dd857ba1d749bb5a428)
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 24 ++++++++----------------
1 file changed, 8 insertions(+), 16 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 8fa34032bc173..33302279ab5ff 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4027,17 +4027,10 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
tlb_end_vma(tlb, vma);
/*
- * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We
- * could defer the flush until now, since by holding i_mmap_rwsem we
- * guaranteed that the last refernece would not be dropped. But we must
- * do the flushing before we return, as otherwise i_mmap_rwsem will be
- * dropped and the last reference to the shared PMDs page might be
- * dropped as well.
- *
- * In theory we could defer the freeing of the PMD pages as well, but
- * huge_pmd_unshare() relies on the exact page_count for the PMD page to
- * detect sharing, so we cannot defer the release of the page either.
- * Instead, do flush now.
+ * There is nothing protecting a previously-shared page table that we
+ * unshared through huge_pmd_unshare() from getting freed after we
+ * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare()
+ * succeeded, flush the range corresponding to the pud.
*/
if (force_flush)
tlb_flush_mmu_tlbonly(tlb);
@@ -5113,11 +5106,10 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
cond_resched();
}
/*
- * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
- * may have cleared our pud entry and done put_page on the page table:
- * once we release i_mmap_rwsem, another task can do the final put_page
- * and that page table be reused and filled with junk. If we actually
- * did unshare a page of pmds, flush the range corresponding to the pud.
+ * There is nothing protecting a previously-shared page table that we
+ * unshared through huge_pmd_unshare() from getting freed after we
+ * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare()
+ * succeeded, flush the range corresponding to the pud.
*/
if (shared_pmd)
flush_hugetlb_tlb_range(vma, range.start, range.end);
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 423/491] mm/rmap: fix two comments related to huge_pmd_unshare()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 422/491] mm/hugetlb: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 424/491] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather Greg Kroah-Hartman
` (72 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Red Hat),
Rik van Riel, Laurence Oberman, Lorenzo Stoakes, Oscar Salvador,
Liu Shixin, Harry Yoo, Lance Yang, Uschakow, Stanislav,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Red Hat) <david@kernel.org>
PMD page table unsharing no longer touches the refcount of a PMD page
table. Also, it is not about dropping the refcount of a "PMD page" but
the "PMD page table".
Let's just simplify by saying that the PMD page table was unmapped,
consequently also unmapping the folio that was mapped into this page.
This code should be deduplicated in the future.
Link: https://lkml.kernel.org/r/20251223214037.580860-4-david@kernel.org
Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit a8682d500f691b6dfaa16ae1502d990aeb86e8be)
[ David: We don't have 40549ba8f8e0 ("hugetlb: use new vma_lock
for pmd sharing synchronization") and a98a2f0c8ce1 ("mm/rmap: split
migration into its own so changes in mm/rmap.c looks quite different. ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/rmap.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/mm/rmap.c b/mm/rmap.c
index e6f840be18906..315d7ceb573ae 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1490,13 +1490,8 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
range.end);
/*
- * The ref count of the PMD page was dropped
- * which is part of the way map counting
- * is done for shared PMDs. Return 'true'
- * here. When there is no other sharing,
- * huge_pmd_unshare returns false and we will
- * unmap the actual page and drop map count
- * to zero.
+ * The PMD table was unmapped,
+ * consequently unmapping the folio.
*/
page_vma_mapped_walk_done(&pvmw);
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 424/491] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 423/491] mm/rmap: " Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 425/491] media: uvcvideo: Move guid to entity Greg Kroah-Hartman
` (71 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Red Hat),
Uschakow, Stanislav, Laurence Oberman, Harry Yoo, Lorenzo Stoakes,
Lance Yang, Liu Shixin, Oscar Salvador, Rik van Riel,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Red Hat) <david@kernel.org>
commit 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 upstream.
As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix
huge_pmd_unshare() vs GUP-fast race") we can end up in some situations
where we perform so many IPI broadcasts when unsharing hugetlb PMD page
tables that it severely regresses some workloads.
In particular, when we fork()+exit(), or when we munmap() a large
area backed by many shared PMD tables, we perform one IPI broadcast per
unshared PMD table.
There are two optimizations to be had:
(1) When we process (unshare) multiple such PMD tables, such as during
exit(), it is sufficient to send a single IPI broadcast (as long as
we respect locking rules) instead of one per PMD table.
Locking prevents that any of these PMD tables could get reused before
we drop the lock.
(2) When we are not the last sharer (> 2 users including us), there is
no need to send the IPI broadcast. The shared PMD tables cannot
become exclusive (fully unshared) before an IPI will be broadcasted
by the last sharer.
Concurrent GUP-fast could walk into a PMD table just before we
unshared it. It could then succeed in grabbing a page from the
shared page table even after munmap() etc succeeded (and supressed
an IPI). But there is not difference compared to GUP-fast just
sleeping for a while after grabbing the page and re-enabling IRQs.
Most importantly, GUP-fast will never walk into page tables that are
no-longer shared, because the last sharer will issue an IPI
broadcast.
(if ever required, checking whether the PUD changed in GUP-fast
after grabbing the page like we do in the PTE case could handle
this)
So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather
infrastructure so we can implement these optimizations and demystify the
code at least a bit. Extend the mmu_gather infrastructure to be able to
deal with our special hugetlb PMD table sharing implementation.
To make initialization of the mmu_gather easier when working on a single
VMA (in particular, when dealing with hugetlb), provide
tlb_gather_mmu_vma().
We'll consolidate the handling for (full) unsharing of PMD tables in
tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track
in "struct mmu_gather" whether we had (full) unsharing of PMD tables.
Because locking is very special (concurrent unsharing+reuse must be
prevented), we disallow deferring flushing to tlb_finish_mmu() and instead
require an explicit earlier call to tlb_flush_unshared_tables().
>From hugetlb code, we call huge_pmd_unshare_flush() where we make sure
that the expected lock protecting us from concurrent unsharing+reuse is
still held.
Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that
tlb_flush_unshared_tables() was properly called earlier.
Document it all properly.
Notes about tlb_remove_table_sync_one() interaction with unsharing:
There are two fairly tricky things:
(1) tlb_remove_table_sync_one() is a NOP on architectures without
CONFIG_MMU_GATHER_RCU_TABLE_FREE.
Here, the assumption is that the previous TLB flush would send an
IPI to all relevant CPUs. Careful: some architectures like x86 only
send IPIs to all relevant CPUs when tlb->freed_tables is set.
The relevant architectures should be selecting
MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable
kernels and it might have been problematic before this patch.
Also, the arch flushing behavior (independent of IPIs) is different
when tlb->freed_tables is set. Do we have to enlighten them to also
take care of tlb->unshared_tables? So far we didn't care, so
hopefully we are fine. Of course, we could be setting
tlb->freed_tables as well, but that might then unnecessarily flush
too much, because the semantics of tlb->freed_tables are a bit
fuzzy.
This patch changes nothing in this regard.
(2) tlb_remove_table_sync_one() is not a NOP on architectures with
CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync.
Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB)
we still issue IPIs during TLB flushes and don't actually need the
second tlb_remove_table_sync_one().
This optimized can be implemented on top of this, by checking e.g., in
tlb_remove_table_sync_one() whether we really need IPIs. But as
described in (1), it really must honor tlb->freed_tables then to
send IPIs to all relevant CPUs.
Notes on TLB flushing changes:
(1) Flushing for non-shared PMD tables
We're converting from flush_hugetlb_tlb_range() to
tlb_remove_huge_tlb_entry(). Given that we properly initialize the
MMU gather in tlb_gather_mmu_vma() to be hugetlb aware, similar to
__unmap_hugepage_range(), that should be fine.
(2) Flushing for shared PMD tables
We're converting from various things (flush_hugetlb_tlb_range(),
tlb_flush_pmd_range(), flush_tlb_range()) to tlb_flush_pmd_range().
tlb_flush_pmd_range() achieves the same that
tlb_remove_huge_tlb_entry() would achieve in these scenarios.
Note that tlb_remove_huge_tlb_entry() also calls
__tlb_remove_tlb_entry(), however that is only implemented on
powerpc, which does not support PMD table sharing.
Similar to (1), tlb_gather_mmu_vma() should make sure that TLB
flushing keeps on working as expected.
Further, note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a
concern, as we are holding the i_mmap_lock the whole time, preventing
concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed
separately as a cleanup later.
There are plenty more cleanups to be had, but they have to wait until
this is fixed.
[david@kernel.org: fix kerneldoc]
Link: https://lkml.kernel.org/r/f223dd74-331c-412d-93fc-69e360a5006c@kernel.org
Link: https://lkml.kernel.org/r/20251223214037.580860-5-david@kernel.org
Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reported-by: "Uschakow, Stanislav" <suschako@amazon.de>
Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/
Tested-by: Laurence Oberman <loberman@redhat.com>
Acked-by: Harry Yoo <harry.yoo@oracle.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Rik van Riel <riel@surriel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1)
[ David: We don't have ptdesc and the wrappers, so work directly on
page->pt_share_count and pass "struct page" instead of "struct ptdesc".
CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING is still called
CONFIG_ARCH_WANT_HUGE_PMD_SHARE and is set even without
CONFIG_HUGETLB_PAGE. We don't have 550a7d60bd5e ("mm, hugepages: add
mremap() support for hugepage backed vma"), so move_hugetlb_page_tables()
does not exist. We don't have 40549ba8f8e0 ("hugetlb: use new vma_lock
for pmd sharing synchronization") and a98a2f0c8ce1 ("mm/rmap: split
migration into its own so changes in mm/rmap.c looks quite different. We
don't have 4ddb4d91b82f ("hugetlb: do not update address
in huge_pmd_unshare"), so huge_pmd_unshare() still gets a pointer to
an address. tlb_gather_mmu() + tlb_finish_mmu() still consume ranges, so
also teach tlb_gather_mmu_vma() to forward ranges. Some smaller
contextual stuff, in particular, around tlb_gather_mmu_full(). ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/tlb.h | 77 ++++++++++++++++++++++++++-
include/linux/hugetlb.h | 15 ++++--
include/linux/mm_types.h | 2 +
mm/hugetlb.c | 108 ++++++++++++++++++++++----------------
mm/mmu_gather.c | 36 +++++++++++++
mm/rmap.c | 11 ++--
6 files changed, 195 insertions(+), 54 deletions(-)
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index f40c9534f20be..a80accdbcd255 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -46,7 +46,8 @@
*
* The mmu_gather API consists of:
*
- * - tlb_gather_mmu() / tlb_finish_mmu(); start and finish a mmu_gather
+ * - tlb_gather_mmu() / tlb_gather_mmu_vma() / tlb_finish_mmu(); start and
+ * finish a mmu_gather
*
* Finish in particular will issue a (final) TLB invalidate and free
* all (remaining) queued pages.
@@ -291,6 +292,20 @@ struct mmu_gather {
unsigned int vma_exec : 1;
unsigned int vma_huge : 1;
+ /*
+ * Did we unshare (unmap) any shared page tables? For now only
+ * used for hugetlb PMD table sharing.
+ */
+ unsigned int unshared_tables : 1;
+
+ /*
+ * Did we unshare any page tables such that they are now exclusive
+ * and could get reused+modified by the new owner? When setting this
+ * flag, "unshared_tables" will be set as well. For now only used
+ * for hugetlb PMD table sharing.
+ */
+ unsigned int fully_unshared_tables : 1;
+
unsigned int batch_count;
#ifndef CONFIG_MMU_GATHER_NO_GATHER
@@ -327,6 +342,7 @@ static inline void __tlb_reset_range(struct mmu_gather *tlb)
tlb->cleared_pmds = 0;
tlb->cleared_puds = 0;
tlb->cleared_p4ds = 0;
+ tlb->unshared_tables = 0;
/*
* Do not reset mmu_gather::vma_* fields here, we do not
* call into tlb_start_vma() again to set them if there is an
@@ -422,7 +438,7 @@ static inline void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
* these bits.
*/
if (!(tlb->freed_tables || tlb->cleared_ptes || tlb->cleared_pmds ||
- tlb->cleared_puds || tlb->cleared_p4ds))
+ tlb->cleared_puds || tlb->cleared_p4ds || tlb->unshared_tables))
return;
tlb_flush(tlb);
@@ -660,6 +676,63 @@ static inline void tlb_flush_p4d_range(struct mmu_gather *tlb,
} while (0)
#endif
+#if defined(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) && defined(CONFIG_HUGETLB_PAGE)
+static inline void tlb_unshare_pmd_ptdesc(struct mmu_gather *tlb, struct page *pt,
+ unsigned long addr)
+{
+ /*
+ * The caller must make sure that concurrent unsharing + exclusive
+ * reuse is impossible until tlb_flush_unshared_tables() was called.
+ */
+ VM_WARN_ON_ONCE(!atomic_read(&pt->pt_share_count));
+ atomic_dec(&pt->pt_share_count);
+
+ /* Clearing a PUD pointing at a PMD table with PMD leaves. */
+ tlb_flush_pmd_range(tlb, addr & PUD_MASK, PUD_SIZE);
+
+ /*
+ * If the page table is now exclusively owned, we fully unshared
+ * a page table.
+ */
+ if (!atomic_read(&pt->pt_share_count))
+ tlb->fully_unshared_tables = true;
+ tlb->unshared_tables = true;
+}
+
+static inline void tlb_flush_unshared_tables(struct mmu_gather *tlb)
+{
+ /*
+ * As soon as the caller drops locks to allow for reuse of
+ * previously-shared tables, these tables could get modified and
+ * even reused outside of hugetlb context, so we have to make sure that
+ * any page table walkers (incl. TLB, GUP-fast) are aware of that
+ * change.
+ *
+ * Even if we are not fully unsharing a PMD table, we must
+ * flush the TLB for the unsharer now.
+ */
+ if (tlb->unshared_tables)
+ tlb_flush_mmu_tlbonly(tlb);
+
+ /*
+ * Similarly, we must make sure that concurrent GUP-fast will not
+ * walk previously-shared page tables that are getting modified+reused
+ * elsewhere. So broadcast an IPI to wait for any concurrent GUP-fast.
+ *
+ * We only perform this when we are the last sharer of a page table,
+ * as the IPI will reach all CPUs: any GUP-fast.
+ *
+ * Note that on configs where tlb_remove_table_sync_one() is a NOP,
+ * the expectation is that the tlb_flush_mmu_tlbonly() would have issued
+ * required IPIs already for us.
+ */
+ if (tlb->fully_unshared_tables) {
+ tlb_remove_table_sync_one();
+ tlb->fully_unshared_tables = false;
+ }
+}
+#endif
+
#endif /* CONFIG_MMU */
#endif /* _ASM_GENERIC__TLB_H */
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 0d3fece27031c..dfb1afa3d2821 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -166,8 +166,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
unsigned long addr, unsigned long sz);
pte_t *huge_pte_offset(struct mm_struct *mm,
unsigned long addr, unsigned long sz);
-int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long *addr, pte_t *ptep);
+int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long *addr, pte_t *ptep);
+void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma);
void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
unsigned long *start, unsigned long *end);
struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
@@ -208,13 +209,17 @@ static inline struct address_space *hugetlb_page_mapping_lock_write(
return NULL;
}
-static inline int huge_pmd_unshare(struct mm_struct *mm,
- struct vm_area_struct *vma,
- unsigned long *addr, pte_t *ptep)
+static inline int huge_pmd_unshare(struct mmu_gather *tlb,
+ struct vm_area_struct *vma, unsigned long *addr, pte_t *ptep)
{
return 0;
}
+static inline void huge_pmd_unshare_flush(struct mmu_gather *tlb,
+ struct vm_area_struct *vma)
+{
+}
+
static inline void adjust_range_if_pmd_sharing_possible(
struct vm_area_struct *vma,
unsigned long *start, unsigned long *end)
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index b6cf570dc98cb..00a85b64e5241 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -610,6 +610,8 @@ static inline cpumask_t *mm_cpumask(struct mm_struct *mm)
struct mmu_gather;
extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
unsigned long start, unsigned long end);
+void tlb_gather_mmu_vma(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long start, unsigned long end);
extern void tlb_finish_mmu(struct mmu_gather *tlb,
unsigned long start, unsigned long end);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 33302279ab5ff..27fe947b8c697 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3938,7 +3938,6 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
struct hstate *h = hstate_vma(vma);
unsigned long sz = huge_page_size(h);
struct mmu_notifier_range range;
- bool force_flush = false;
WARN_ON(!is_vm_hugetlb_page(vma));
BUG_ON(start & ~huge_page_mask(h));
@@ -3965,10 +3964,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
continue;
ptl = huge_pte_lock(h, mm, ptep);
- if (huge_pmd_unshare(mm, vma, &address, ptep)) {
+ if (huge_pmd_unshare(tlb, vma, &address, ptep)) {
spin_unlock(ptl);
- tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE);
- force_flush = true;
continue;
}
@@ -4026,14 +4023,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
mmu_notifier_invalidate_range_end(&range);
tlb_end_vma(tlb, vma);
- /*
- * There is nothing protecting a previously-shared page table that we
- * unshared through huge_pmd_unshare() from getting freed after we
- * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare()
- * succeeded, flush the range corresponding to the pud.
- */
- if (force_flush)
- tlb_flush_mmu_tlbonly(tlb);
+ huge_pmd_unshare_flush(tlb, vma);
}
void __unmap_hugepage_range_final(struct mmu_gather *tlb,
@@ -5043,8 +5033,8 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
pte_t pte;
struct hstate *h = hstate_vma(vma);
unsigned long pages = 0;
- bool shared_pmd = false;
struct mmu_notifier_range range;
+ struct mmu_gather tlb;
/*
* In the case of shared PMDs, the area to flush could be beyond
@@ -5057,6 +5047,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
BUG_ON(address >= end);
flush_cache_range(vma, range.start, range.end);
+ tlb_gather_mmu_vma(&tlb, vma, range.start, range.end);
mmu_notifier_invalidate_range_start(&range);
i_mmap_lock_write(vma->vm_file->f_mapping);
@@ -5066,10 +5057,9 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
if (!ptep)
continue;
ptl = huge_pte_lock(h, mm, ptep);
- if (huge_pmd_unshare(mm, vma, &address, ptep)) {
+ if (huge_pmd_unshare(&tlb, vma, &address, ptep)) {
pages++;
spin_unlock(ptl);
- shared_pmd = true;
continue;
}
pte = huge_ptep_get(ptep);
@@ -5100,21 +5090,15 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
pte = arch_make_huge_pte(pte, vma, NULL, 0);
huge_ptep_modify_prot_commit(vma, address, ptep, old_pte, pte);
pages++;
+ tlb_remove_huge_tlb_entry(h, &tlb, ptep, address);
}
spin_unlock(ptl);
cond_resched();
}
- /*
- * There is nothing protecting a previously-shared page table that we
- * unshared through huge_pmd_unshare() from getting freed after we
- * release i_mmap_rwsem, so flush the TLB now. If huge_pmd_unshare()
- * succeeded, flush the range corresponding to the pud.
- */
- if (shared_pmd)
- flush_hugetlb_tlb_range(vma, range.start, range.end);
- else
- flush_hugetlb_tlb_range(vma, start, end);
+
+ tlb_flush_mmu_tlbonly(&tlb);
+ huge_pmd_unshare_flush(&tlb, vma);
/*
* No need to call mmu_notifier_invalidate_range() we are downgrading
* page table protection not changing it to point to a new page.
@@ -5123,6 +5107,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
*/
i_mmap_unlock_write(vma->vm_file->f_mapping);
mmu_notifier_invalidate_range_end(&range);
+ tlb_finish_mmu(&tlb, range.start, range.end);
return pages << h->order;
}
@@ -5449,18 +5434,27 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
return pte;
}
-/*
- * unmap huge page backed by shared pte.
+/**
+ * huge_pmd_unshare - Unmap a pmd table if it is shared by multiple users
+ * @tlb: the current mmu_gather.
+ * @vma: the vma covering the pmd table.
+ * @addr: pointer to the address we are trying to unshare.
+ * @ptep: pointer into the (pmd) page table.
*
- * Called with page table lock held.
+ * Called with the page table lock held, the i_mmap_rwsem held in write mode
+ * and the hugetlb vma lock held in write mode.
*
- * returns: 1 successfully unmapped a shared pte page
- * 0 the underlying pte page is not shared, or it is the last user
+ * Note: The caller must call huge_pmd_unshare_flush() before dropping the
+ * i_mmap_rwsem.
+ *
+ * Returns: 1 if it was a shared PMD table and it got unmapped, or 0 if it
+ * was not a shared PMD table.
*/
-int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long *addr, pte_t *ptep)
+int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long *addr, pte_t *ptep)
{
unsigned long sz = huge_page_size(hstate_vma(vma));
+ struct mm_struct *mm = vma->vm_mm;
pgd_t *pgd = pgd_offset(mm, *addr);
p4d_t *p4d = p4d_offset(pgd, *addr);
pud_t *pud = pud_offset(p4d, *addr);
@@ -5472,14 +5466,8 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
return 0;
pud_clear(pud);
- /*
- * Once our caller drops the rmap lock, some other process might be
- * using this page table as a normal, non-hugetlb page table.
- * Wait for pending gup_fast() in other threads to finish before letting
- * that happen.
- */
- tlb_remove_table_sync_one();
- atomic_dec(&virt_to_page(ptep)->pt_share_count);
+ tlb_unshare_pmd_ptdesc(tlb, virt_to_page(ptep), *addr);
+
mm_dec_nr_pmds(mm);
/*
* This update of passed address optimizes loops sequentially
@@ -5491,6 +5479,30 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
*addr |= PUD_SIZE - PMD_SIZE;
return 1;
}
+
+/*
+ * huge_pmd_unshare_flush - Complete a sequence of huge_pmd_unshare() calls
+ * @tlb: the current mmu_gather.
+ * @vma: the vma covering the pmd table.
+ *
+ * Perform necessary TLB flushes or IPI broadcasts to synchronize PMD table
+ * unsharing with concurrent page table walkers.
+ *
+ * This function must be called after a sequence of huge_pmd_unshare()
+ * calls while still holding the i_mmap_rwsem.
+ */
+void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma)
+{
+ /*
+ * We must synchronize page table unsharing such that nobody will
+ * try reusing a previously-shared page table while it might still
+ * be in use by previous sharers (TLB, GUP_fast).
+ */
+ i_mmap_assert_write_locked(vma->vm_file->f_mapping);
+
+ tlb_flush_unshared_tables(tlb);
+}
+
#define want_pmd_share() (1)
#else /* !CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
@@ -5498,12 +5510,16 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
return NULL;
}
-int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long *addr, pte_t *ptep)
+int huge_pmd_unshare(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long *addr, pte_t *ptep)
{
return 0;
}
+void huge_pmd_unshare_flush(struct mmu_gather *tlb, struct vm_area_struct *vma)
+{
+}
+
void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
unsigned long *start, unsigned long *end)
{
@@ -5745,6 +5761,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
unsigned long sz = huge_page_size(h);
struct mm_struct *mm = vma->vm_mm;
struct mmu_notifier_range range;
+ struct mmu_gather tlb;
unsigned long address;
spinlock_t *ptl;
pte_t *ptep;
@@ -5756,6 +5773,8 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
return;
flush_cache_range(vma, start, end);
+ tlb_gather_mmu_vma(&tlb, vma, start, end);
+
/*
* No need to call adjust_range_if_pmd_sharing_possible(), because
* we have already done the PUD_SIZE alignment.
@@ -5776,10 +5795,10 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
continue;
ptl = huge_pte_lock(h, mm, ptep);
/* We don't want 'address' to be changed */
- huge_pmd_unshare(mm, vma, &tmp, ptep);
+ huge_pmd_unshare(&tlb, vma, &tmp, ptep);
spin_unlock(ptl);
}
- flush_hugetlb_tlb_range(vma, start, end);
+ huge_pmd_unshare_flush(&tlb, vma);
if (take_locks) {
i_mmap_unlock_write(vma->vm_file->f_mapping);
}
@@ -5788,6 +5807,7 @@ static void hugetlb_unshare_pmds(struct vm_area_struct *vma,
* Documentation/mm/mmu_notifier.rst.
*/
mmu_notifier_invalidate_range_end(&range);
+ tlb_finish_mmu(&tlb, start, end);
}
#ifdef CONFIG_CMA
diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c
index 205fdbb5792a9..298972351a607 100644
--- a/mm/mmu_gather.c
+++ b/mm/mmu_gather.c
@@ -7,6 +7,7 @@
#include <linux/rcupdate.h>
#include <linux/smp.h>
#include <linux/swap.h>
+#include <linux/hugetlb.h>
#include <asm/pgalloc.h>
#include <asm/tlb.h>
@@ -281,10 +282,39 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
tlb->page_size = 0;
#endif
+ tlb->fully_unshared_tables = 0;
__tlb_reset_range(tlb);
inc_tlb_flush_pending(tlb->mm);
}
+/**
+ * tlb_gather_mmu_vma - initialize an mmu_gather structure for operating on a
+ * single VMA
+ * @tlb: the mmu_gather structure to initialize
+ * @vma: the vm_area_struct
+ * @start: start of the region that will be removed from the page-table
+ * @end: end of the region that will be removed from the page-table
+ *
+ * Called to initialize an (on-stack) mmu_gather structure for operating on
+ * a single VMA. In contrast to tlb_gather_mmu(), calling this function will
+ * not require another call to tlb_start_vma(). In contrast to tlb_start_vma(),
+ * this function will *not* call flush_cache_range().
+ *
+ * For hugetlb VMAs, this function will also initialize the mmu_gather
+ * page_size accordingly, not requiring a separate call to
+ * tlb_change_page_size().
+ *
+ */
+void tlb_gather_mmu_vma(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+{
+ tlb_gather_mmu(tlb, vma->vm_mm, start, end);
+ tlb_update_vma_flags(tlb, vma);
+ if (is_vm_hugetlb_page(vma))
+ /* All entries have the same size. */
+ tlb_change_page_size(tlb, huge_page_size(hstate_vma(vma)));
+}
+
/**
* tlb_finish_mmu - finish an mmu_gather structure
* @tlb: the mmu_gather structure to finish
@@ -297,6 +327,12 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
void tlb_finish_mmu(struct mmu_gather *tlb,
unsigned long start, unsigned long end)
{
+ /*
+ * We expect an earlier huge_pmd_unshare_flush() call to sort this out,
+ * due to complicated locking requirements with page table unsharing.
+ */
+ VM_WARN_ON_ONCE(tlb->fully_unshared_tables);
+
/*
* If there are parallel threads are doing PTE changes on same range
* under non-exclusive lock (e.g., mmap_lock read-side) but defer TLB
diff --git a/mm/rmap.c b/mm/rmap.c
index 315d7ceb573ae..a5da7abd15d3d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -73,7 +73,7 @@
#include <linux/memremap.h>
#include <linux/userfaultfd_k.h>
-#include <asm/tlbflush.h>
+#include <asm/tlb.h>
#include <trace/events/tlb.h>
@@ -1470,13 +1470,16 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
address = pvmw.address;
if (PageHuge(page) && !PageAnon(page)) {
+ struct mmu_gather tlb;
+
/*
* To call huge_pmd_unshare, i_mmap_rwsem must be
* held in write mode. Caller needs to explicitly
* do this outside rmap routines.
*/
VM_BUG_ON(!(flags & TTU_RMAP_LOCKED));
- if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) {
+ tlb_gather_mmu_vma(&tlb, vma, range.start, range.end);
+ if (huge_pmd_unshare(&tlb, vma, &address, pvmw.pte)) {
/*
* huge_pmd_unshare unmapped an entire PMD
* page. There is no way of knowing exactly
@@ -1485,9 +1488,10 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
* already adjusted above to cover this range.
*/
flush_cache_range(vma, range.start, range.end);
- flush_tlb_range(vma, range.start, range.end);
+ huge_pmd_unshare_flush(&tlb, vma);
mmu_notifier_invalidate_range(mm, range.start,
range.end);
+ tlb_finish_mmu(&tlb, range.start, range.end);
/*
* The PMD table was unmapped,
@@ -1496,6 +1500,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
page_vma_mapped_walk_done(&pvmw);
break;
}
+ tlb_finish_mmu(&tlb, range.start, range.end);
}
if (IS_ENABLED(CONFIG_MIGRATION) &&
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 425/491] media: uvcvideo: Move guid to entity
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 424/491] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 426/491] media: uvcvideo: Allow extra entities Greg Kroah-Hartman
` (70 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 351509c604dcb065305a165d7552058c2cbc447d ]
Instead of having multiple copies of the entity guid on the code, move
it to the entity structure.
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 30 ++++--------------------------
drivers/media/usb/uvc/uvc_driver.c | 25 +++++++++++++++++++++++--
drivers/media/usb/uvc/uvcvideo.h | 2 +-
3 files changed, 28 insertions(+), 29 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 4f67ba3a7c028..698bf5bb896ec 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -827,31 +827,10 @@ static void uvc_set_le_value(struct uvc_control_mapping *mapping,
* Terminal and unit management
*/
-static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
-static const u8 uvc_camera_guid[16] = UVC_GUID_UVC_CAMERA;
-static const u8 uvc_media_transport_input_guid[16] =
- UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
-
static int uvc_entity_match_guid(const struct uvc_entity *entity,
- const u8 guid[16])
+ const u8 guid[16])
{
- switch (UVC_ENTITY_TYPE(entity)) {
- case UVC_ITT_CAMERA:
- return memcmp(uvc_camera_guid, guid, 16) == 0;
-
- case UVC_ITT_MEDIA_TRANSPORT_INPUT:
- return memcmp(uvc_media_transport_input_guid, guid, 16) == 0;
-
- case UVC_VC_PROCESSING_UNIT:
- return memcmp(uvc_processing_guid, guid, 16) == 0;
-
- case UVC_VC_EXTENSION_UNIT:
- return memcmp(entity->extension.guidExtensionCode,
- guid, 16) == 0;
-
- default:
- return 0;
- }
+ return memcmp(entity->guid, guid, sizeof(entity->guid)) == 0;
}
/* ------------------------------------------------------------------------
@@ -1882,8 +1861,7 @@ static int uvc_ctrl_fill_xu_info(struct uvc_device *dev,
if (data == NULL)
return -ENOMEM;
- memcpy(info->entity, ctrl->entity->extension.guidExtensionCode,
- sizeof(info->entity));
+ memcpy(info->entity, ctrl->entity->guid, sizeof(info->entity));
info->index = ctrl->index;
info->selector = ctrl->index + 1;
@@ -1989,7 +1967,7 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
if (!found) {
uvc_trace(UVC_TRACE_CONTROL, "Control %pUl/%u not found.\n",
- entity->extension.guidExtensionCode, xqry->selector);
+ entity->guid, xqry->selector);
return -ENOENT;
}
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 419fbdbb7a3b8..15202269194ad 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1032,6 +1032,11 @@ static int uvc_parse_streaming(struct uvc_device *dev,
return ret;
}
+static const u8 uvc_camera_guid[16] = UVC_GUID_UVC_CAMERA;
+static const u8 uvc_media_transport_input_guid[16] =
+ UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
+static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
+
static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
unsigned int num_pads, unsigned int extra_size)
{
@@ -1054,6 +1059,22 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
entity->id = id;
entity->type = type;
+ /*
+ * Set the GUID for standard entity types. For extension units, the GUID
+ * is initialized by the caller.
+ */
+ switch (type) {
+ case UVC_ITT_CAMERA:
+ memcpy(entity->guid, uvc_camera_guid, 16);
+ break;
+ case UVC_ITT_MEDIA_TRANSPORT_INPUT:
+ memcpy(entity->guid, uvc_media_transport_input_guid, 16);
+ break;
+ case UVC_VC_PROCESSING_UNIT:
+ memcpy(entity->guid, uvc_processing_guid, 16);
+ break;
+ }
+
entity->num_links = 0;
entity->num_pads = num_pads;
entity->pads = ((void *)(entity + 1)) + extra_size;
@@ -1125,7 +1146,7 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
if (unit == NULL)
return -ENOMEM;
- memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
+ memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
memcpy(unit->baSourceID, &buffer[22], p);
unit->extension.bControlSize = buffer[22+p];
@@ -1376,7 +1397,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
if (unit == NULL)
return -ENOMEM;
- memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
+ memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
memcpy(unit->baSourceID, &buffer[22], p);
unit->extension.bControlSize = buffer[22+p];
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 60a8749c97a9d..656ab4d9356c2 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -305,6 +305,7 @@ struct uvc_entity {
u8 id;
u16 type;
char name[64];
+ u8 guid[16];
/* Media controller-related fields. */
struct video_device *vdev;
@@ -343,7 +344,6 @@ struct uvc_entity {
} selector;
struct {
- u8 guidExtensionCode[16];
u8 bNumControls;
u8 bControlSize;
u8 *bmControls;
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 426/491] media: uvcvideo: Allow extra entities
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 425/491] media: uvcvideo: Move guid to entity Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT Greg Kroah-Hartman
` (69 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit cae79e50d1222010fde8c522410c315f74d35c40 ]
Increase the size of the id, to avoid collisions with entities
implemented by the driver that are not part of the UVC device.
Entities exposed by the UVC device use IDs 0-255, extra entities
implemented by the driver (such as the GPIO entity) use IDs 256 and
up.
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_driver.c | 2 +-
drivers/media/usb/uvc/uvcvideo.h | 7 ++++++-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 15202269194ad..e1d3e753e80ed 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1037,7 +1037,7 @@ static const u8 uvc_media_transport_input_guid[16] =
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
-static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
unsigned int num_pads, unsigned int extra_size)
{
struct uvc_entity *entity;
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 656ab4d9356c2..0e4209dbf307f 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -302,7 +302,12 @@ struct uvc_entity {
* chain. */
unsigned int flags;
- u8 id;
+ /*
+ * Entities exposed by the UVC device use IDs 0-255, extra entities
+ * implemented by the driver (such as the GPIO entity) use IDs 256 and
+ * up.
+ */
+ u16 id;
u16 type;
char name[64];
u8 guid[16];
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 426/491] media: uvcvideo: Allow extra entities Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 20:43 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 428/491] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Greg Kroah-Hartman
` (68 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 2886477ff98740cc3333cf785e4de0b1ff3d7a28 ]
Some devices can implement a physical switch to disable the input of the
camera on demand. Think of it like an elegant privacy sticker.
The system can read the status of the privacy switch via a GPIO.
It is important to know the status of the switch, e.g. to notify the
user when the camera will produce black frames and a videochat
application is used.
In some systems, the GPIO is connected to the main SoC instead of the
camera controller, with the connection reported by the system firmware
(ACPI or DT). In that case, the UVC device isn't aware of the GPIO. We
need to implement a virtual entity to handle the GPIO fully on the
driver side.
For example, for ACPI-based systems, the GPIO is reported in the USB
device object:
Scope (\_SB.PCI0.XHCI.RHUB.HS07)
{
/.../
Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings
{
GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly,
"\\_SB.PCI0.GPIO", 0x00, ResourceConsumer, ,
)
{ // Pin list
0x0064
}
})
Name (_DSD, Package (0x02) // _DSD: Device-Specific Data
{
ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301") /* Device Properties for _DSD */,
Package (0x01)
{
Package (0x02)
{
"privacy-gpio",
Package (0x04)
{
\_SB.PCI0.XHCI.RHUB.HS07,
Zero,
Zero,
One
}
}
}
})
}
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 3 +
drivers/media/usb/uvc/uvc_driver.c | 127 +++++++++++++++++++++++++++++
drivers/media/usb/uvc/uvc_entity.c | 1 +
drivers/media/usb/uvc/uvcvideo.h | 16 ++++
4 files changed, 147 insertions(+)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 698bf5bb896ec..fc23e53c0d38b 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2378,6 +2378,9 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
} else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) {
bmControls = entity->camera.bmControls;
bControlSize = entity->camera.bControlSize;
+ } else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) {
+ bmControls = entity->gpio.bmControls;
+ bControlSize = entity->gpio.bControlSize;
}
/* Remove bogus/blacklisted controls */
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index e1d3e753e80ed..b86e46fa7c0af 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -7,6 +7,7 @@
*/
#include <linux/atomic.h>
+#include <linux/gpio/consumer.h>
#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/module.h>
@@ -1033,6 +1034,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
}
static const u8 uvc_camera_guid[16] = UVC_GUID_UVC_CAMERA;
+static const u8 uvc_gpio_guid[16] = UVC_GUID_EXT_GPIO_CONTROLLER;
static const u8 uvc_media_transport_input_guid[16] =
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
@@ -1064,6 +1066,9 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
* is initialized by the caller.
*/
switch (type) {
+ case UVC_EXT_GPIO_UNIT:
+ memcpy(entity->guid, uvc_gpio_guid, 16);
+ break;
case UVC_ITT_CAMERA:
memcpy(entity->guid, uvc_camera_guid, 16);
break;
@@ -1467,6 +1472,108 @@ static int uvc_parse_control(struct uvc_device *dev)
return 0;
}
+/* -----------------------------------------------------------------------------
+ * Privacy GPIO
+ */
+
+static void uvc_gpio_event(struct uvc_device *dev)
+{
+ struct uvc_entity *unit = dev->gpio_unit;
+ struct uvc_video_chain *chain;
+ u8 new_val;
+
+ if (!unit)
+ return;
+
+ new_val = gpiod_get_value_cansleep(unit->gpio.gpio_privacy);
+
+ /* GPIO entities are always on the first chain. */
+ chain = list_first_entry(&dev->chains, struct uvc_video_chain, list);
+ uvc_ctrl_status_event(chain, unit->controls, &new_val);
+}
+
+static int uvc_gpio_get_cur(struct uvc_device *dev, struct uvc_entity *entity,
+ u8 cs, void *data, u16 size)
+{
+ if (cs != UVC_CT_PRIVACY_CONTROL || size < 1)
+ return -EINVAL;
+
+ *(u8 *)data = gpiod_get_value_cansleep(entity->gpio.gpio_privacy);
+
+ return 0;
+}
+
+static int uvc_gpio_get_info(struct uvc_device *dev, struct uvc_entity *entity,
+ u8 cs, u8 *caps)
+{
+ if (cs != UVC_CT_PRIVACY_CONTROL)
+ return -EINVAL;
+
+ *caps = UVC_CONTROL_CAP_GET | UVC_CONTROL_CAP_AUTOUPDATE;
+ return 0;
+}
+
+static irqreturn_t uvc_gpio_irq(int irq, void *data)
+{
+ struct uvc_device *dev = data;
+
+ uvc_gpio_event(dev);
+ return IRQ_HANDLED;
+}
+
+static int uvc_gpio_parse(struct uvc_device *dev)
+{
+ struct uvc_entity *unit;
+ struct gpio_desc *gpio_privacy;
+ int irq;
+
+ gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy",
+ GPIOD_IN);
+ if (IS_ERR_OR_NULL(gpio_privacy))
+ return PTR_ERR_OR_ZERO(gpio_privacy);
+
+ unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
+ if (!unit)
+ return -ENOMEM;
+
+ irq = gpiod_to_irq(gpio_privacy);
+ if (irq < 0) {
+ if (irq != EPROBE_DEFER)
+ dev_err(&dev->udev->dev,
+ "No IRQ for privacy GPIO (%d)\n", irq);
+ return irq;
+ }
+
+ unit->gpio.gpio_privacy = gpio_privacy;
+ unit->gpio.irq = irq;
+ unit->gpio.bControlSize = 1;
+ unit->gpio.bmControls = (u8 *)unit + sizeof(*unit);
+ unit->gpio.bmControls[0] = 1;
+ unit->get_cur = uvc_gpio_get_cur;
+ unit->get_info = uvc_gpio_get_info;
+ strncpy(unit->name, "GPIO", sizeof(unit->name) - 1);
+
+ list_add_tail(&unit->list, &dev->entities);
+
+ dev->gpio_unit = unit;
+
+ return 0;
+}
+
+static int uvc_gpio_init_irq(struct uvc_device *dev)
+{
+ struct uvc_entity *unit = dev->gpio_unit;
+
+ if (!unit || unit->gpio.irq < 0)
+ return 0;
+
+ return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL,
+ uvc_gpio_irq,
+ IRQF_ONESHOT | IRQF_TRIGGER_FALLING |
+ IRQF_TRIGGER_RISING,
+ "uvc_privacy_gpio", dev);
+}
+
/* ------------------------------------------------------------------------
* UVC device scan
*/
@@ -1988,6 +2095,13 @@ static int uvc_scan_device(struct uvc_device *dev)
return -1;
}
+ /* Add GPIO entity to the first chain. */
+ if (dev->gpio_unit) {
+ chain = list_first_entry(&dev->chains,
+ struct uvc_video_chain, list);
+ list_add_tail(&dev->gpio_unit->chain, &chain->entities);
+ }
+
return 0;
}
@@ -2350,6 +2464,12 @@ static int uvc_probe(struct usb_interface *intf,
goto error;
}
+ /* Parse the associated GPIOs. */
+ if (uvc_gpio_parse(dev) < 0) {
+ uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC GPIOs\n");
+ goto error;
+ }
+
uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
dev->uvc_version >> 8, dev->uvc_version & 0xff,
udev->product ? udev->product : "<unnamed>",
@@ -2394,6 +2514,13 @@ static int uvc_probe(struct usb_interface *intf,
"supported.\n", ret);
}
+ ret = uvc_gpio_init_irq(dev);
+ if (ret < 0) {
+ dev_err(&dev->udev->dev,
+ "Unable to request privacy GPIO IRQ (%d)\n", ret);
+ goto error;
+ }
+
uvc_trace(UVC_TRACE_PROBE, "UVC device initialized.\n");
usb_enable_autosuspend(udev);
return 0;
diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
index 7c9895377118c..96e965a16d061 100644
--- a/drivers/media/usb/uvc/uvc_entity.c
+++ b/drivers/media/usb/uvc/uvc_entity.c
@@ -105,6 +105,7 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
case UVC_OTT_DISPLAY:
case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
case UVC_EXTERNAL_VENDOR_SPECIFIC:
+ case UVC_EXT_GPIO_UNIT:
default:
function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
break;
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 0e4209dbf307f..e9eef2170d866 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -6,6 +6,7 @@
#error "The uvcvideo.h header is deprecated, use linux/uvcvideo.h instead."
#endif /* __KERNEL__ */
+#include <linux/atomic.h>
#include <linux/kernel.h>
#include <linux/poll.h>
#include <linux/usb.h>
@@ -37,6 +38,8 @@
(UVC_ENTITY_IS_TERM(entity) && \
((entity)->type & 0x8000) == UVC_TERM_OUTPUT)
+#define UVC_EXT_GPIO_UNIT 0x7ffe
+#define UVC_EXT_GPIO_UNIT_ID 0x100
/* ------------------------------------------------------------------------
* GUIDs
@@ -56,6 +59,9 @@
#define UVC_GUID_UVC_SELECTOR \
{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02}
+#define UVC_GUID_EXT_GPIO_CONTROLLER \
+ {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03}
#define UVC_GUID_FORMAT_MJPEG \
{ 'M', 'J', 'P', 'G', 0x00, 0x00, 0x10, 0x00, \
@@ -213,6 +219,7 @@
* Structures.
*/
+struct gpio_desc;
struct uvc_device;
/* TODO: Put the most frequently accessed fields at the beginning of
@@ -354,6 +361,13 @@ struct uvc_entity {
u8 *bmControls;
u8 *bmControlsType;
} extension;
+
+ struct {
+ u8 bControlSize;
+ u8 *bmControls;
+ struct gpio_desc *gpio_privacy;
+ int irq;
+ } gpio;
};
u8 bNrInPins;
@@ -696,6 +710,8 @@ struct uvc_device {
struct uvc_control *ctrl;
const void *data;
} async_ctrl;
+
+ struct uvc_entity *gpio_unit;
};
enum uvc_handle_state {
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 428/491] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 429/491] media: uvcvideo: Use heuristic to find stream entity Greg Kroah-Hartman
` (67 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0584f746fde3d52b4675,
syzbot+dd320d114deb3f5bb79b, Youngjun Lee,
Thadeu Lima de Souza Cascardo, Ricardo Ribalda, Laurent Pinchart,
Hans de Goede, Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
[ Upstream commit 0e2ee70291e64a30fe36960c85294726d34a103e ]
Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
unique ID.
```
Each Unit and Terminal within the video function is assigned a unique
identification number, the Unit ID (UID) or Terminal ID (TID), contained in
the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
reserved for undefined ID,
```
If we add a new entity with id 0 or a duplicated ID, it will be marked
as UVC_INVALID_ENTITY_ID.
In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require
entities to have a non-zero unique ID"), we ignored all the invalid units,
this broke a lot of non-compatible cameras. Hopefully we are more lucky
this time.
This also prevents some syzkaller reproducers from triggering warnings due
to a chain of entities referring to themselves. In one particular case, an
Output Unit is connected to an Input Unit, both with the same ID of 1. But
when looking up for the source ID of the Output Unit, that same entity is
found instead of the input entity, which leads to such warnings.
In another case, a backward chain was considered finished as the source ID
was 0. Later on, that entity was found, but its pads were not valid.
Here is a sample stack trace for one of those cases.
[ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 20.830206] usb 1-1: Using ep0 maxpacket: 8
[ 20.833501] usb 1-1: config 0 descriptor??
[ 21.038518] usb 1-1: string descriptor 0 read error: -71
[ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
[ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
[ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
[ 21.042218] ------------[ cut here ]------------
[ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
[ 21.043195] Modules linked in:
[ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
[ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[ 21.044639] Workqueue: usb_hub_wq hub_event
[ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
[ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
[ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
[ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
[ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
[ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
[ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
[ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
[ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
[ 21.051136] PKRU: 55555554
[ 21.051331] Call Trace:
[ 21.051480] <TASK>
[ 21.051611] ? __warn+0xc4/0x210
[ 21.051861] ? media_create_pad_link+0x2c4/0x2e0
[ 21.052252] ? report_bug+0x11b/0x1a0
[ 21.052540] ? trace_hardirqs_on+0x31/0x40
[ 21.052901] ? handle_bug+0x3d/0x70
[ 21.053197] ? exc_invalid_op+0x1a/0x50
[ 21.053511] ? asm_exc_invalid_op+0x1a/0x20
[ 21.053924] ? media_create_pad_link+0x91/0x2e0
[ 21.054364] ? media_create_pad_link+0x2c4/0x2e0
[ 21.054834] ? media_create_pad_link+0x91/0x2e0
[ 21.055131] ? _raw_spin_unlock+0x1e/0x40
[ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210
[ 21.055837] uvc_mc_register_entities+0x358/0x400
[ 21.056144] uvc_register_chains+0x1fd/0x290
[ 21.056413] uvc_probe+0x380e/0x3dc0
[ 21.056676] ? __lock_acquire+0x5aa/0x26e0
[ 21.056946] ? find_held_lock+0x33/0xa0
[ 21.057196] ? kernfs_activate+0x70/0x80
[ 21.057533] ? usb_match_dynamic_id+0x1b/0x70
[ 21.057811] ? find_held_lock+0x33/0xa0
[ 21.058047] ? usb_match_dynamic_id+0x55/0x70
[ 21.058330] ? lock_release+0x124/0x260
[ 21.058657] ? usb_match_one_id_intf+0xa2/0x100
[ 21.058997] usb_probe_interface+0x1ba/0x330
[ 21.059399] really_probe+0x1ba/0x4c0
[ 21.059662] __driver_probe_device+0xb2/0x180
[ 21.059944] driver_probe_device+0x5a/0x100
[ 21.060170] __device_attach_driver+0xe9/0x160
[ 21.060427] ? __pfx___device_attach_driver+0x10/0x10
[ 21.060872] bus_for_each_drv+0xa9/0x100
[ 21.061312] __device_attach+0xed/0x190
[ 21.061812] device_initial_probe+0xe/0x20
[ 21.062229] bus_probe_device+0x4d/0xd0
[ 21.062590] device_add+0x308/0x590
[ 21.062912] usb_set_configuration+0x7b6/0xaf0
[ 21.063403] usb_generic_driver_probe+0x36/0x80
[ 21.063714] usb_probe_device+0x7b/0x130
[ 21.063936] really_probe+0x1ba/0x4c0
[ 21.064111] __driver_probe_device+0xb2/0x180
[ 21.064577] driver_probe_device+0x5a/0x100
[ 21.065019] __device_attach_driver+0xe9/0x160
[ 21.065403] ? __pfx___device_attach_driver+0x10/0x10
[ 21.065820] bus_for_each_drv+0xa9/0x100
[ 21.066094] __device_attach+0xed/0x190
[ 21.066535] device_initial_probe+0xe/0x20
[ 21.066992] bus_probe_device+0x4d/0xd0
[ 21.067250] device_add+0x308/0x590
[ 21.067501] usb_new_device+0x347/0x610
[ 21.067817] hub_event+0x156b/0x1e30
[ 21.068060] ? process_scheduled_works+0x48b/0xaf0
[ 21.068337] process_scheduled_works+0x5a3/0xaf0
[ 21.068668] worker_thread+0x3cf/0x560
[ 21.068932] ? kthread+0x109/0x1b0
[ 21.069133] kthread+0x197/0x1b0
[ 21.069343] ? __pfx_worker_thread+0x10/0x10
[ 21.069598] ? __pfx_kthread+0x10/0x10
[ 21.069908] ret_from_fork+0x32/0x40
[ 21.070169] ? __pfx_kthread+0x10/0x10
[ 21.070424] ret_from_fork_asm+0x1a/0x30
[ 21.070737] </TASK>
Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
Reported-by: Youngjun Lee <yjjuny.lee@samsung.com>
Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Co-developed-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_driver.c | 73 +++++++++++++++++++-----------
drivers/media/usb/uvc/uvcvideo.h | 2 +
2 files changed, 48 insertions(+), 27 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index b86e46fa7c0af..bf1456caae2d2 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -413,6 +413,9 @@ struct uvc_entity *uvc_entity_by_id(struct uvc_device *dev, int id)
{
struct uvc_entity *entity;
+ if (id == UVC_INVALID_ENTITY_ID)
+ return NULL;
+
list_for_each_entry(entity, &dev->entities, list) {
if (entity->id == id)
return entity;
@@ -1039,14 +1042,27 @@ static const u8 uvc_media_transport_input_guid[16] =
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
-static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
- unsigned int num_pads, unsigned int extra_size)
+static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
+ u16 id, unsigned int num_pads,
+ unsigned int extra_size)
{
struct uvc_entity *entity;
unsigned int num_inputs;
unsigned int size;
unsigned int i;
+ /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */
+ if (id == 0) {
+ dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n");
+ id = UVC_INVALID_ENTITY_ID;
+ }
+
+ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
+ if (uvc_entity_by_id(dev, id)) {
+ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
+ id = UVC_INVALID_ENTITY_ID;
+ }
+
extra_size = roundup(extra_size, sizeof(*entity->pads));
if (num_pads)
num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
@@ -1056,7 +1072,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
+ num_inputs;
entity = kzalloc(size, GFP_KERNEL);
if (entity == NULL)
- return NULL;
+ return ERR_PTR(-ENOMEM);
entity->id = id;
entity->type = type;
@@ -1146,10 +1162,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
break;
}
- unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
- p + 1, 2*n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT,
+ buffer[3], p + 1, 2 * n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1260,10 +1276,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return -EINVAL;
}
- term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
- 1, n + p);
- if (term == NULL)
- return -ENOMEM;
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT,
+ buffer[3], 1, n + p);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
term->camera.bControlSize = n;
@@ -1319,10 +1335,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return 0;
}
- term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
- 1, 0);
- if (term == NULL)
- return -ENOMEM;
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
+ buffer[3], 1, 0);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
memcpy(term->baSourceID, &buffer[7], 1);
@@ -1343,9 +1359,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
+ p + 1, 0);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->baSourceID, &buffer[5], p);
@@ -1367,9 +1384,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->baSourceID, &buffer[4], 1);
unit->processing.wMaxMultiplier =
@@ -1398,9 +1415,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
+ p + 1, n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1532,9 +1550,10 @@ static int uvc_gpio_parse(struct uvc_device *dev)
if (IS_ERR_OR_NULL(gpio_privacy))
return PTR_ERR_OR_ZERO(gpio_privacy);
- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
- if (!unit)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT,
+ UVC_EXT_GPIO_UNIT_ID, 0, 1);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
irq = gpiod_to_irq(gpio_privacy);
if (irq < 0) {
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index e9eef2170d866..895db550f11db 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -41,6 +41,8 @@
#define UVC_EXT_GPIO_UNIT 0x7ffe
#define UVC_EXT_GPIO_UNIT_ID 0x100
+#define UVC_INVALID_ENTITY_ID 0xffff
+
/* ------------------------------------------------------------------------
* GUIDs
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 429/491] media: uvcvideo: Use heuristic to find stream entity
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 428/491] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 430/491] apparmor: validate DFA start states are in bounds in unpack_pdb Greg Kroah-Hartman
` (66 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angel4005, Ricardo Ribalda,
Hans de Goede, Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 758dbc756aad429da11c569c0d067f7fd032bcf7 ]
Some devices, like the Grandstream GUV3100 webcam, have an invalid UVC
descriptor where multiple entities share the same ID, this is invalid
and makes it impossible to make a proper entity tree without heuristics.
We have recently introduced a change in the way that we handle invalid
entities that has caused a regression on broken devices.
Implement a new heuristic to handle these devices properly.
Reported-by: Angel4005 <ooara1337@gmail.com>
Closes: https://lore.kernel.org/linux-media/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=DaA@mail.gmail.com/
Fixes: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_driver.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index bf1456caae2d2..5c07e79430e93 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -443,13 +443,26 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev,
static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
{
- struct uvc_streaming *stream;
+ struct uvc_streaming *stream, *last_stream;
+ unsigned int count = 0;
list_for_each_entry(stream, &dev->streams, list) {
+ count += 1;
+ last_stream = stream;
if (stream->header.bTerminalLink == id)
return stream;
}
+ /*
+ * If the streaming entity is referenced by an invalid ID, notify the
+ * user and use heuristics to guess the correct entity.
+ */
+ if (count == 1 && id == UVC_INVALID_ENTITY_ID) {
+ dev_warn(&dev->intf->dev,
+ "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one.");
+ return last_stream;
+ }
+
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 524+ messages in thread
* [PATCH 5.10 430/491] apparmor: validate DFA start states are in bounds in unpack_pdb
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 429/491] media: uvcvideo: Use heuristic to find stream entity Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 431/491] apparmor: fix memory leak in verify_header Greg Kroah-Hartman
` (65 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can,
Massimiliano Pellizzer, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
commit 9063d7e2615f4a7ab321de6b520e23d370e58816 upstream.
Backport for conflicts caused by
ad596ea74e74 ("apparmor: group dfa policydb unpacking")
- rearrange and consolidated the unpack.
b11e51dd7094 ("apparmor: test: make static symbols visible during kunit testing")
- rename function and make it visible to kunit tests
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
==================================================================
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Fixes: ad5ff3db53c6 ("AppArmor: Add ability to load extended policy")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/policy_unpack.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -841,9 +841,18 @@ static struct aa_profile *unpack_profile
error = -EPROTO;
goto fail;
}
- if (!unpack_u32(e, &profile->policy.start[0], "start"))
+ if (!unpack_u32(e, &profile->policy.start[0], "start")) {
/* default start state */
profile->policy.start[0] = DFA_START;
+ } else {
+ size_t state_count = profile->policy.dfa->tables[YYTD_ID_BASE]->td_lolen;
+
+ if (profile->policy.start[0] >= state_count) {
+ info = "invalid dfa start state";
+ goto fail;
+ }
+ }
+
/* setup class index */
for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
profile->policy.start[i] =
@@ -864,9 +873,17 @@ static struct aa_profile *unpack_profile
info = "failed to unpack profile file rules";
goto fail;
} else if (profile->file.dfa) {
- if (!unpack_u32(e, &profile->file.start, "dfa_start"))
+ if (!unpack_u32(e, &profile->file.start, "dfa_start")) {
/* default start state */
profile->file.start = DFA_START;
+ } else {
+ size_t state_count = profile->file.dfa->tables[YYTD_ID_BASE]->td_lolen;
+
+ if (profile->file.start >= state_count) {
+ info = "invalid dfa start state";
+ goto fail;
+ }
+ }
} else if (profile->policy.dfa &&
profile->policy.start[AA_CLASS_FILE]) {
profile->file.dfa = aa_get_dfa(profile->policy.dfa);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 431/491] apparmor: fix memory leak in verify_header
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 430/491] apparmor: validate DFA start states are in bounds in unpack_pdb Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 432/491] apparmor: replace recursive profile removal with iterative approach Greg Kroah-Hartman
` (64 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can,
Massimiliano Pellizzer, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
commit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.
The function sets `*ns = NULL` on every call, leaking the namespace
string allocated in previous iterations when multiple profiles are
unpacked. This also breaks namespace consistency checking since *ns
is always NULL when the comparison is made.
Remove the incorrect assignment.
The caller (aa_unpack) initializes *ns to NULL once before the loop,
which is sufficient.
Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/policy_unpack.c | 1 -
1 file changed, 1 deletion(-)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -976,7 +976,6 @@ static int verify_header(struct aa_ext *
{
int error = -EPROTONOSUPPORT;
const char *name = NULL;
- *ns = NULL;
/* get the interface version */
if (!unpack_u32(e, &e->version, "version")) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 432/491] apparmor: replace recursive profile removal with iterative approach
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 431/491] apparmor: fix memory leak in verify_header Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 433/491] apparmor: fix: limit the number of levels of policy namespaces Greg Kroah-Hartman
` (63 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can,
Massimiliano Pellizzer, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.
Reproducer:
$ pf='a'; for ((i=0; i<1024; i++)); do
echo -e "profile $pf { \n }" | apparmor_parser -K -a;
pf="$pf//x";
done
$ echo -n a > /sys/kernel/security/apparmor/.remove
Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes leaf profiles until the entire subtree is removed,
maintaining the same removal semantic without recursion.
Fixes: c88d4c7b049e ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/policy.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -146,19 +146,43 @@ static void __list_remove_profile(struct
}
/**
- * __remove_profile - remove old profile, and children
- * @profile: profile to be replaced (NOT NULL)
+ * __remove_profile - remove profile, and children
+ * @profile: profile to be removed (NOT NULL)
*
* Requires: namespace list lock be held, or list not be shared
*/
static void __remove_profile(struct aa_profile *profile)
{
+ struct aa_profile *curr, *to_remove;
+
AA_BUG(!profile);
AA_BUG(!profile->ns);
AA_BUG(!mutex_is_locked(&profile->ns->lock));
/* release any children lists first */
- __aa_profile_list_release(&profile->base.profiles);
+ if (!list_empty(&profile->base.profiles)) {
+ curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list);
+
+ while (curr != profile) {
+
+ while (!list_empty(&curr->base.profiles))
+ curr = list_first_entry(&curr->base.profiles,
+ struct aa_profile, base.list);
+
+ to_remove = curr;
+ if (!list_is_last(&to_remove->base.list,
+ &aa_deref_parent(curr)->base.profiles))
+ curr = list_next_entry(to_remove, base.list);
+ else
+ curr = aa_deref_parent(curr);
+
+ /* released by free_profile */
+ aa_label_remove(&to_remove->label);
+ __aafs_profile_rmdir(to_remove);
+ __list_remove_profile(to_remove);
+ }
+ }
+
/* released by free_profile */
aa_label_remove(&profile->label);
__aafs_profile_rmdir(profile);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 433/491] apparmor: fix: limit the number of levels of policy namespaces
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 432/491] apparmor: replace recursive profile removal with iterative approach Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 434/491] apparmor: fix side-effect bug in match_char() macro usage Greg Kroah-Hartman
` (62 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory, Ryan Lee,
Cengiz Can, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.
Hard cap policy namespaces to the same depth as user namespaces.
Fixes: c88d4c7b049e8 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/policy_ns.h | 2 ++
security/apparmor/policy_ns.c | 2 ++
2 files changed, 4 insertions(+)
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -18,6 +18,8 @@
#include "label.h"
#include "policy.h"
+/* Match max depth of user namespaces */
+#define MAX_NS_DEPTH 32
/* struct aa_ns_acct - accounting of profiles in namespace
* @max_size: maximum space allowed for all profiles in namespace
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -249,6 +249,8 @@ static struct aa_ns *__aa_create_ns(stru
AA_BUG(!name);
AA_BUG(!mutex_is_locked(&parent->lock));
+ if (parent->level > MAX_NS_DEPTH)
+ return ERR_PTR(-ENOSPC);
ns = alloc_ns(parent->base.hname, name);
if (!ns)
return ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 434/491] apparmor: fix side-effect bug in match_char() macro usage
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 433/491] apparmor: fix: limit the number of levels of policy namespaces Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 435/491] apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Greg Kroah-Hartman
` (61 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can,
Massimiliano Pellizzer, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
commit 8756b68edae37ff546c02091989a4ceab3f20abd upstream.
The match_char() macro evaluates its character parameter multiple
times when traversing differential encoding chains. When invoked
with *str++, the string pointer advances on each iteration of the
inner do-while loop, causing the DFA to check different characters
at each iteration and therefore skip input characters.
This results in out-of-bounds reads when the pointer advances past
the input buffer boundary.
[ 94.984676] ==================================================================
[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760
[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976
[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)
[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.986329] Call Trace:
[ 94.986341] <TASK>
[ 94.986347] dump_stack_lvl+0x5e/0x80
[ 94.986374] print_report+0xc8/0x270
[ 94.986384] ? aa_dfa_match+0x5ae/0x760
[ 94.986388] kasan_report+0x118/0x150
[ 94.986401] ? aa_dfa_match+0x5ae/0x760
[ 94.986405] aa_dfa_match+0x5ae/0x760
[ 94.986408] __aa_path_perm+0x131/0x400
[ 94.986418] aa_path_perm+0x219/0x2f0
[ 94.986424] apparmor_file_open+0x345/0x570
[ 94.986431] security_file_open+0x5c/0x140
[ 94.986442] do_dentry_open+0x2f6/0x1120
[ 94.986450] vfs_open+0x38/0x2b0
[ 94.986453] ? may_open+0x1e2/0x2b0
[ 94.986466] path_openat+0x231b/0x2b30
[ 94.986469] ? __x64_sys_openat+0xf8/0x130
[ 94.986477] do_file_open+0x19d/0x360
[ 94.986487] do_sys_openat2+0x98/0x100
[ 94.986491] __x64_sys_openat+0xf8/0x130
[ 94.986499] do_syscall_64+0x8e/0x660
[ 94.986515] ? count_memcg_events+0x15f/0x3c0
[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0
[ 94.986551] ? vma_start_read+0xf0/0x320
[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0
[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0
[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5
[ 94.986588] ? irqentry_exit+0x3c/0x590
[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 94.986597] RIP: 0033:0x7fda4a79c3ea
Fix by extracting the character value before invoking match_char,
ensuring single evaluation per outer loop.
Fixes: 074c1cd798cb ("apparmor: dfa move character match into a macro")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/match.c | 30 ++++++++++++++++++++----------
1 file changed, 20 insertions(+), 10 deletions(-)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -452,13 +452,18 @@ unsigned int aa_dfa_match_len(struct aa_
if (dfa->tables[YYTD_ID_EC]) {
/* Equivalence class table defined */
u8 *equiv = EQUIV_TABLE(dfa);
- for (; len; len--)
- match_char(state, def, base, next, check,
- equiv[(u8) *str++]);
+ for (; len; len--) {
+ u8 c = equiv[(u8) *str];
+
+ match_char(state, def, base, next, check, c);
+ str++;
+ }
} else {
/* default is direct to next state */
- for (; len; len--)
- match_char(state, def, base, next, check, (u8) *str++);
+ for (; len; len--) {
+ match_char(state, def, base, next, check, (u8) *str);
+ str++;
+ }
}
return state;
@@ -493,13 +498,18 @@ unsigned int aa_dfa_match(struct aa_dfa
/* Equivalence class table defined */
u8 *equiv = EQUIV_TABLE(dfa);
/* default is direct to next state */
- while (*str)
- match_char(state, def, base, next, check,
- equiv[(u8) *str++]);
+ while (*str) {
+ u8 c = equiv[(u8) *str];
+
+ match_char(state, def, base, next, check, c);
+ str++;
+ }
} else {
/* default is direct to next state */
- while (*str)
- match_char(state, def, base, next, check, (u8) *str++);
+ while (*str) {
+ match_char(state, def, base, next, check, (u8) *str);
+ str++;
+ }
}
return state;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 435/491] apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 434/491] apparmor: fix side-effect bug in match_char() macro usage Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 436/491] apparmor: Fix double free of ns_name in aa_replace_profiles() Greg Kroah-Hartman
` (60 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can,
Massimiliano Pellizzer, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
commit d352873bbefa7eb39995239d0b44ccdf8aaa79a4 upstream.
The verify_dfa() function only checks DEFAULT_TABLE bounds when the state
is not differentially encoded.
When the verification loop traverses the differential encoding chain,
it reads k = DEFAULT_TABLE[j] and uses k as an array index without
validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count,
therefore, causes both out-of-bounds reads and writes.
[ 57.179855] ==================================================================
[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660
[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993
[ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)
[ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 57.181563] Call Trace:
[ 57.181572] <TASK>
[ 57.181577] dump_stack_lvl+0x5e/0x80
[ 57.181596] print_report+0xc8/0x270
[ 57.181605] ? verify_dfa+0x59a/0x660
[ 57.181608] kasan_report+0x118/0x150
[ 57.181620] ? verify_dfa+0x59a/0x660
[ 57.181623] verify_dfa+0x59a/0x660
[ 57.181627] aa_dfa_unpack+0x1610/0x1740
[ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470
[ 57.181640] unpack_pdb+0x86d/0x46b0
[ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181656] ? aa_unpack_nameX+0x1a8/0x300
[ 57.181659] aa_unpack+0x20b0/0x4c30
[ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181664] ? stack_depot_save_flags+0x33/0x700
[ 57.181681] ? kasan_save_track+0x4f/0x80
[ 57.181683] ? kasan_save_track+0x3e/0x80
[ 57.181686] ? __kasan_kmalloc+0x93/0xb0
[ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780
[ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130
[ 57.181697] ? policy_update+0x154/0x330
[ 57.181704] aa_replace_profiles+0x15a/0x1dd0
[ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780
[ 57.181712] ? aa_loaddata_alloc+0x77/0x140
[ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5
[ 57.181717] ? _copy_from_user+0x2a/0x70
[ 57.181730] policy_update+0x17a/0x330
[ 57.181733] profile_replace+0x153/0x1a0
[ 57.181735] ? rw_verify_area+0x93/0x2d0
[ 57.181740] vfs_write+0x235/0xab0
[ 57.181745] ksys_write+0xb0/0x170
[ 57.181748] do_syscall_64+0x8e/0x660
[ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 57.181765] RIP: 0033:0x7f6192792eb2
Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE
entries unconditionally.
Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/match.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -204,9 +204,10 @@ static int verify_dfa(struct aa_dfa *dfa
if (state_count == 0)
goto out;
for (i = 0; i < state_count; i++) {
- if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&
- (DEFAULT_TABLE(dfa)[i] >= state_count))
+ if (DEFAULT_TABLE(dfa)[i] >= state_count) {
+ pr_err("AppArmor DFA default state out of bounds");
goto out;
+ }
if (BASE_TABLE(dfa)[i] & MATCH_FLAGS_INVALID) {
pr_err("AppArmor DFA state with invalid match flags");
goto out;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 436/491] apparmor: Fix double free of ns_name in aa_replace_profiles()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 435/491] apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 437/491] apparmor: fix unprivileged local user can do privileged policy management Greg Kroah-Hartman
` (59 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream.
if ns_name is NULL after
1071 error = aa_unpack(udata, &lh, &ns_name);
and if ent->ns_name contains an ns_name in
1089 } else if (ent->ns_name) {
then ns_name is assigned the ent->ns_name
1095 ns_name = ent->ns_name;
however ent->ns_name is freed at
1262 aa_load_ent_free(ent);
and then again when freeing ns_name at
1270 kfree(ns_name);
Fix this by NULLing out ent->ns_name after it is transferred to ns_name
Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load
")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/policy.c | 1 +
1 file changed, 1 insertion(+)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -917,6 +917,7 @@ ssize_t aa_replace_profiles(struct aa_ns
goto fail;
}
ns_name = ent->ns_name;
+ ent->ns_name = NULL;
} else
count++;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 437/491] apparmor: fix unprivileged local user can do privileged policy management
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 436/491] apparmor: Fix double free of ns_name in aa_replace_profiles() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 438/491] apparmor: fix differential encoding verification Greg Kroah-Hartman
` (58 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit 6601e13e82841879406bf9f369032656f441a425 upstream.
Backport for api changes introduced in
- 90c436a64a6e ("apparmor: pass cred through to audit info.")
- 92de220a7f33 ("apparmor: update policy capable checks to use a label")
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.
The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.
Fixes: b7fd2c0340eac ("apparmor: add per policy ns .load, .replace, .remove interface files")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/apparmorfs.c | 19 +++++++++++-------
security/apparmor/include/policy.h | 5 ++--
security/apparmor/policy.c | 39 +++++++++++++++++++++++++++++++++++--
3 files changed, 52 insertions(+), 11 deletions(-)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -409,7 +409,8 @@ static struct aa_loaddata *aa_simple_wri
}
static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
- loff_t *pos, struct aa_ns *ns)
+ loff_t *pos, struct aa_ns *ns,
+ const struct cred *ocred)
{
struct aa_loaddata *data;
struct aa_label *label;
@@ -420,7 +421,7 @@ static ssize_t policy_update(u32 mask, c
/* high level check about policy management - fine grained in
* below after unpack
*/
- error = aa_may_manage_policy(label, ns, mask);
+ error = aa_may_manage_policy(current_cred(), label, ns, ocred, mask);
if (error)
goto end_section;
@@ -441,7 +442,8 @@ static ssize_t profile_load(struct file
loff_t *pos)
{
struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
- int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
+ int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns,
+ f->f_cred);
aa_put_ns(ns);
@@ -459,7 +461,7 @@ static ssize_t profile_replace(struct fi
{
struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
- buf, size, pos, ns);
+ buf, size, pos, ns, f->f_cred);
aa_put_ns(ns);
return error;
@@ -483,7 +485,8 @@ static ssize_t profile_remove(struct fil
/* high level check about policy management - fine grained in
* below after unpack
*/
- error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);
+ error = aa_may_manage_policy(current_cred(), label, ns,
+ f->f_cred, AA_MAY_REMOVE_POLICY);
if (error)
goto out;
@@ -1796,7 +1799,8 @@ static int ns_mkdir_op(struct inode *dir
int error;
label = begin_current_label_crit_section();
- error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
+ error = aa_may_manage_policy(current_cred(), label, NULL, NULL,
+ AA_MAY_LOAD_POLICY);
end_current_label_crit_section(label);
if (error)
return error;
@@ -1845,7 +1849,8 @@ static int ns_rmdir_op(struct inode *dir
int error;
label = begin_current_label_crit_section();
- error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
+ error = aa_may_manage_policy(current_cred(), label, NULL, NULL,
+ AA_MAY_LOAD_POLICY);
end_current_label_crit_section(label);
if (error)
return error;
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -303,7 +303,8 @@ static inline int AUDIT_MODE(struct aa_p
bool policy_view_capable(struct aa_ns *ns);
bool policy_admin_capable(struct aa_ns *ns);
-int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns,
- u32 mask);
+int aa_may_manage_policy(const struct cred *subj_cred,
+ struct aa_label *label, struct aa_ns *ns,
+ const struct cred *ocred, u32 mask);
#endif /* __AA_POLICY_H */
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -695,14 +695,44 @@ bool policy_admin_capable(struct aa_ns *
return policy_view_capable(ns) && capable && !aa_g_lock_policy;
}
+static bool is_subset_of_obj_privilege(const struct cred *cred,
+ struct aa_label *label,
+ const struct cred *ocred)
+{
+ if (cred == ocred)
+ return true;
+
+ if (!aa_label_is_subset(label, cred_label(ocred)))
+ return false;
+ /* don't allow crossing userns for now */
+ if (cred->user_ns != ocred->user_ns)
+ return false;
+ if (!cap_issubset(cred->cap_inheritable, ocred->cap_inheritable))
+ return false;
+ if (!cap_issubset(cred->cap_permitted, ocred->cap_permitted))
+ return false;
+ if (!cap_issubset(cred->cap_effective, ocred->cap_effective))
+ return false;
+ if (!cap_issubset(cred->cap_bset, ocred->cap_bset))
+ return false;
+ if (!cap_issubset(cred->cap_ambient, ocred->cap_ambient))
+ return false;
+ return true;
+}
+
+
/**
* aa_may_manage_policy - can the current task manage policy
+ * @subj_cred; subjects cred
* @label: label to check if it can manage policy
- * @op: the policy manipulation operation being done
+ * @ns: namespace being managed by @label (may be NULL if @label's ns)
+ * @ocred: object cred if request is coming from an open object
+ * @mask: contains the policy manipulation operation being done
*
* Returns: 0 if the task is allowed to manipulate policy else error
*/
-int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask)
+int aa_may_manage_policy(const struct cred *subj_cred, struct aa_label *label,
+ struct aa_ns *ns, const struct cred *ocred, u32 mask)
{
const char *op;
@@ -718,6 +748,11 @@ int aa_may_manage_policy(struct aa_label
return audit_policy(label, op, NULL, NULL, "policy_locked",
-EACCES);
+ if (ocred && !is_subset_of_obj_privilege(subj_cred, label, ocred))
+ return audit_policy(label, op, NULL, NULL,
+ "not privileged for target profile",
+ -EACCES);
+
if (!policy_admin_capable(ns))
return audit_policy(label, op, NULL, NULL, "not policy admin",
-EACCES);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 438/491] apparmor: fix differential encoding verification
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 437/491] apparmor: fix unprivileged local user can do privileged policy management Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 439/491] apparmor: fix race on rawdata dereference Greg Kroah-Hartman
` (57 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Salvatore Bonaccorso, Georgia Garcia, Cengiz Can, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.
Differential encoding allows loops to be created if it is abused. To
prevent this the unpack should verify that a diff-encode chain
terminates.
Unfortunately the differential encode verification had two bugs.
1. it conflated states that had gone through check and already been
marked, with states that were currently being checked and marked.
This means that loops in the current chain being verified are treated
as a chain that has already been verified.
2. the order bailout on already checked states compared current chain
check iterators j,k instead of using the outer loop iterator i.
Meaning a step backwards in states in the current chain verification
was being mistaken for moving to an already verified state.
Move to a double mark scheme where already verified states get a
different mark, than the current chain being kept. This enables us
to also drop the backwards verification check that was the cause of
the second error as any already verified state is already marked.
Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/match.h | 1 +
security/apparmor/match.c | 23 +++++++++++++++++++----
2 files changed, 20 insertions(+), 4 deletions(-)
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -190,6 +190,7 @@ static inline void aa_put_dfa(struct aa_
#define MATCH_FLAG_DIFF_ENCODE 0x80000000
#define MARK_DIFF_ENCODE 0x40000000
#define MATCH_FLAG_OOB_TRANSITION 0x20000000
+#define MARK_DIFF_ENCODE_VERIFIED 0x10000000
#define MATCH_FLAGS_MASK 0xff000000
#define MATCH_FLAGS_VALID (MATCH_FLAG_DIFF_ENCODE | MATCH_FLAG_OOB_TRANSITION)
#define MATCH_FLAGS_INVALID (MATCH_FLAGS_MASK & ~MATCH_FLAGS_VALID)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -246,16 +246,31 @@ static int verify_dfa(struct aa_dfa *dfa
size_t j, k;
for (j = i;
- (BASE_TABLE(dfa)[j] & MATCH_FLAG_DIFF_ENCODE) &&
- !(BASE_TABLE(dfa)[j] & MARK_DIFF_ENCODE);
+ ((BASE_TABLE(dfa)[j] & MATCH_FLAG_DIFF_ENCODE) &&
+ !(BASE_TABLE(dfa)[j] & MARK_DIFF_ENCODE_VERIFIED));
j = k) {
+ if (BASE_TABLE(dfa)[j] & MARK_DIFF_ENCODE)
+ /* loop in current chain */
+ goto out;
k = DEFAULT_TABLE(dfa)[j];
if (j == k)
+ /* self loop */
goto out;
- if (k < j)
- break; /* already verified */
BASE_TABLE(dfa)[j] |= MARK_DIFF_ENCODE;
}
+ /* move mark to verified */
+ for (j = i;
+ (BASE_TABLE(dfa)[j] & MATCH_FLAG_DIFF_ENCODE);
+ j = k) {
+ k = DEFAULT_TABLE(dfa)[j];
+ if (j < i)
+ /* jumps to state/chain that has been
+ * verified
+ */
+ break;
+ BASE_TABLE(dfa)[j] &= ~MARK_DIFF_ENCODE;
+ BASE_TABLE(dfa)[j] |= MARK_DIFF_ENCODE_VERIFIED;
+ }
}
error = 0;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 439/491] apparmor: fix race on rawdata dereference
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 438/491] apparmor: fix differential encoding verification Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 440/491] apparmor: fix race between freeing data and fs accessing it Greg Kroah-Hartman
` (56 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Georgia Garcia, Maxime Bélair, Cengiz Can,
Salvatore Bonaccorso, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit a0b7091c4de45a7325c8780e6934a894f92ac86b upstream.
Backport for conflicts introdued by
d61c57fde819 ("apparmor: make export of raw binary profile to userspace optional")
which nests the conflicting code inside an if condition
There is a race condition that leads to a use-after-free situation:
because the rawdata inodes are not refcounted, an attacker can start
open()ing one of the rawdata files, and at the same time remove the
last reference to this rawdata (by removing the corresponding profile,
for example), which frees its struct aa_loaddata; as a result, when
seq_rawdata_open() is reached, i_private is a dangling pointer and
freed memory is accessed.
The rawdata inodes weren't refcounted to avoid a circular refcount and
were supposed to be held by the profile rawdata reference. However
during profile removal there is a window where the vfs and profile
destruction race, resulting in the use after free.
Fix this by moving to a double refcount scheme. Where the profile
refcount on rawdata is used to break the circular dependency. Allowing
for freeing of the rawdata once all inode references to the rawdata
are put.
Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/apparmorfs.c | 36 +++++++++------
security/apparmor/include/policy_unpack.h | 71 ++++++++++++++++++------------
security/apparmor/policy.c | 12 ++---
security/apparmor/policy_unpack.c | 32 +++++++++----
4 files changed, 94 insertions(+), 57 deletions(-)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -77,7 +77,7 @@ static void rawdata_f_data_free(struct r
if (!private)
return;
- aa_put_loaddata(private->loaddata);
+ aa_put_i_loaddata(private->loaddata);
kvfree(private);
}
@@ -401,7 +401,9 @@ static struct aa_loaddata *aa_simple_wri
data->size = copy_size;
if (copy_from_user(data->data, userbuf, copy_size)) {
- aa_put_loaddata(data);
+ /* trigger free - don't need to put pcount */
+ aa_put_i_loaddata(data);
+
return ERR_PTR(-EFAULT);
}
@@ -429,7 +431,10 @@ static ssize_t policy_update(u32 mask, c
error = PTR_ERR(data);
if (!IS_ERR(data)) {
error = aa_replace_profiles(ns, label, mask, data);
- aa_put_loaddata(data);
+ /* put pcount, which will put count and free if no
+ * profiles referencing it.
+ */
+ aa_put_profile_loaddata(data);
}
end_section:
end_current_label_crit_section(label);
@@ -500,7 +505,7 @@ static ssize_t profile_remove(struct fil
if (!IS_ERR(data)) {
data->data[size] = 0;
error = aa_remove_profiles(ns, label, data->data, size);
- aa_put_loaddata(data);
+ aa_put_profile_loaddata(data);
}
out:
end_current_label_crit_section(label);
@@ -1225,18 +1230,17 @@ static const struct file_operations seq_
static int seq_rawdata_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_loaddata *data = __aa_get_loaddata(inode->i_private);
+ struct aa_loaddata *data = aa_get_i_loaddata(inode->i_private);
int error;
if (!data)
- /* lost race this ent is being reaped */
return -ENOENT;
error = single_open(file, show, data);
if (error) {
AA_BUG(file->private_data &&
((struct seq_file *)file->private_data)->private);
- aa_put_loaddata(data);
+ aa_put_i_loaddata(data);
}
return error;
@@ -1247,7 +1251,7 @@ static int seq_rawdata_release(struct in
struct seq_file *seq = (struct seq_file *) file->private_data;
if (seq)
- aa_put_loaddata(seq->private);
+ aa_put_i_loaddata(seq->private);
return single_release(inode, file);
}
@@ -1366,9 +1370,8 @@ static int rawdata_open(struct inode *in
if (!policy_view_capable(NULL))
return -EACCES;
- loaddata = __aa_get_loaddata(inode->i_private);
+ loaddata = aa_get_i_loaddata(inode->i_private);
if (!loaddata)
- /* lost race: this entry is being reaped */
return -ENOENT;
private = rawdata_f_data_alloc(loaddata->size);
@@ -1393,7 +1396,7 @@ fail_decompress:
return error;
fail_private_alloc:
- aa_put_loaddata(loaddata);
+ aa_put_i_loaddata(loaddata);
return error;
}
@@ -1410,9 +1413,9 @@ static void remove_rawdata_dents(struct
for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
- /* no refcounts on i_private */
aafs_remove(rawdata->dents[i]);
rawdata->dents[i] = NULL;
+ aa_put_i_loaddata(rawdata);
}
}
}
@@ -1451,18 +1454,21 @@ int __aa_fs_create_rawdata(struct aa_ns
if (IS_ERR(dir))
/* ->name freed when rawdata freed */
return PTR_ERR(dir);
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DIR] = dir;
dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
&seq_rawdata_abi_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_ABI] = dent;
dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
&seq_rawdata_revision_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
if (aa_g_hash_policy) {
@@ -1470,6 +1476,7 @@ int __aa_fs_create_rawdata(struct aa_ns
rawdata, &seq_rawdata_hash_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_HASH] = dent;
}
@@ -1478,24 +1485,25 @@ int __aa_fs_create_rawdata(struct aa_ns
&seq_rawdata_compressed_size_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
dent = aafs_create_file("raw_data", S_IFREG | 0444,
dir, rawdata, &rawdata_fops);
if (IS_ERR(dent))
goto fail;
+ aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DATA] = dent;
d_inode(dent)->i_size = rawdata->size;
rawdata->ns = aa_get_ns(ns);
list_add(&rawdata->list, &ns->rawdata_list);
- /* no refcount on inode rawdata */
return 0;
fail:
remove_rawdata_dents(rawdata);
-
+ aa_put_i_loaddata(rawdata);
return PTR_ERR(dent);
}
--- a/security/apparmor/include/policy_unpack.h
+++ b/security/apparmor/include/policy_unpack.h
@@ -46,17 +46,29 @@ enum {
AAFS_LOADDATA_NDENTS /* count of entries */
};
-/*
- * struct aa_loaddata - buffer of policy raw_data set
+/* struct aa_loaddata - buffer of policy raw_data set
+ * @count: inode/filesystem refcount - use aa_get_i_loaddata()
+ * @pcount: profile refcount - use aa_get_profile_loaddata()
+ * @list: list the loaddata is on
+ * @work: used to do a delayed cleanup
+ * @dents: refs to dents created in aafs
+ * @ns: the namespace this loaddata was loaded into
+ * @name:
+ * @size: the size of the data that was loaded
+ * @compressed_size: the size of the data when it is compressed
+ * @revision: unique revision count that this data was loaded as
+ * @abi: the abi number the loaddata uses
+ * @hash: a hash of the loaddata, used to help dedup data
*
- * there is no loaddata ref for being on ns list, nor a ref from
- * d_inode(@dentry) when grab a ref from these, @ns->lock must be held
- * && __aa_get_loaddata() needs to be used, and the return value
- * checked, if NULL the loaddata is already being reaped and should be
- * considered dead.
+ * There is no loaddata ref for being on ns->rawdata_list, so
+ * @ns->lock must be held when walking the list. Dentries and
+ * inode opens hold refs on @count; profiles hold refs on @pcount.
+ * When the last @pcount drops, do_ploaddata_rmfs() removes the
+ * fs entries and drops the associated @count ref.
*/
struct aa_loaddata {
struct kref count;
+ struct kref pcount;
struct list_head list;
struct work_struct work;
struct dentry *dents[AAFS_LOADDATA_NDENTS];
@@ -78,50 +90,53 @@ struct aa_loaddata {
int aa_unpack(struct aa_loaddata *udata, struct list_head *lh, const char **ns);
/**
- * __aa_get_loaddata - get a reference count to uncounted data reference
+ * aa_get_loaddata - get a reference count from a counted data reference
* @data: reference to get a count on
*
- * Returns: pointer to reference OR NULL if race is lost and reference is
- * being repeated.
- * Requires: @data->ns->lock held, and the return code MUST be checked
- *
- * Use only from inode->i_private and @data->list found references
+ * Returns: pointer to reference
+ * Requires: @data to have a valid reference count on it. It is a bug
+ * if the race to reap can be encountered when it is used.
*/
static inline struct aa_loaddata *
-__aa_get_loaddata(struct aa_loaddata *data)
+aa_get_i_loaddata(struct aa_loaddata *data)
{
- if (data && kref_get_unless_zero(&(data->count)))
- return data;
- return NULL;
+ if (data)
+ kref_get(&(data->count));
+ return data;
}
+
/**
- * aa_get_loaddata - get a reference count from a counted data reference
+ * aa_get_profile_loaddata - get a profile reference count on loaddata
* @data: reference to get a count on
*
- * Returns: point to reference
- * Requires: @data to have a valid reference count on it. It is a bug
- * if the race to reap can be encountered when it is used.
+ * Returns: pointer to reference
+ * Requires: @data to have a valid reference count on it.
*/
static inline struct aa_loaddata *
-aa_get_loaddata(struct aa_loaddata *data)
+aa_get_profile_loaddata(struct aa_loaddata *data)
{
- struct aa_loaddata *tmp = __aa_get_loaddata(data);
-
- AA_BUG(data && !tmp);
-
- return tmp;
+ if (data)
+ kref_get(&(data->pcount));
+ return data;
}
void __aa_loaddata_update(struct aa_loaddata *data, long revision);
bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r);
void aa_loaddata_kref(struct kref *kref);
+void aa_ploaddata_kref(struct kref *kref);
struct aa_loaddata *aa_loaddata_alloc(size_t size);
-static inline void aa_put_loaddata(struct aa_loaddata *data)
+static inline void aa_put_i_loaddata(struct aa_loaddata *data)
{
if (data)
kref_put(&data->count, aa_loaddata_kref);
}
+static inline void aa_put_profile_loaddata(struct aa_loaddata *data)
+{
+ if (data)
+ kref_put(&data->pcount, aa_ploaddata_kref);
+}
+
#endif /* __POLICY_INTERFACE_H */
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -265,7 +265,7 @@ void aa_free_profile(struct aa_profile *
}
kfree_sensitive(profile->hash);
- aa_put_loaddata(profile->rawdata);
+ aa_put_profile_loaddata(profile->rawdata);
aa_label_destroy(&profile->label);
kfree_sensitive(profile);
@@ -925,7 +925,7 @@ ssize_t aa_replace_profiles(struct aa_ns
LIST_HEAD(lh);
op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
- aa_get_loaddata(udata);
+ aa_get_profile_loaddata(udata);
/* released below */
error = aa_unpack(udata, &lh, &ns_name);
if (error)
@@ -976,10 +976,10 @@ ssize_t aa_replace_profiles(struct aa_ns
if (aa_rawdata_eq(rawdata_ent, udata)) {
struct aa_loaddata *tmp;
- tmp = __aa_get_loaddata(rawdata_ent);
+ tmp = aa_get_profile_loaddata(rawdata_ent);
/* check we didn't fail the race */
if (tmp) {
- aa_put_loaddata(udata);
+ aa_put_profile_loaddata(udata);
udata = tmp;
break;
}
@@ -989,7 +989,7 @@ ssize_t aa_replace_profiles(struct aa_ns
list_for_each_entry(ent, &lh, list) {
struct aa_policy *policy;
- ent->new->rawdata = aa_get_loaddata(udata);
+ ent->new->rawdata = aa_get_profile_loaddata(udata);
error = __lookup_replace(ns, ent->new->base.hname,
!(mask & AA_MAY_REPLACE_POLICY),
&ent->old, &info);
@@ -1103,7 +1103,7 @@ ssize_t aa_replace_profiles(struct aa_ns
out:
aa_put_ns(ns);
- aa_put_loaddata(udata);
+ aa_put_profile_loaddata(udata);
kfree(ns_name);
if (error)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -147,34 +147,47 @@ bool aa_rawdata_eq(struct aa_loaddata *l
return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
}
+static void do_loaddata_free(struct aa_loaddata *d)
+{
+ kfree_sensitive(d->hash);
+ kfree_sensitive(d->name);
+ kvfree(d->data);
+ kfree_sensitive(d);
+}
+
+void aa_loaddata_kref(struct kref *kref)
+{
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+
+ do_loaddata_free(d);
+}
+
/*
* need to take the ns mutex lock which is NOT safe most places that
* put_loaddata is called, so we have to delay freeing it
*/
-static void do_loaddata_free(struct work_struct *work)
+static void do_ploaddata_rmfs(struct work_struct *work)
{
struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
struct aa_ns *ns = aa_get_ns(d->ns);
if (ns) {
mutex_lock_nested(&ns->lock, ns->level);
+ /* remove fs ref to loaddata */
__aa_fs_remove_rawdata(d);
mutex_unlock(&ns->lock);
aa_put_ns(ns);
}
-
- kfree_sensitive(d->hash);
- kfree_sensitive(d->name);
- kvfree(d->data);
- kfree_sensitive(d);
+ /* called by dropping last pcount, so drop its associated icount */
+ aa_put_i_loaddata(d);
}
-void aa_loaddata_kref(struct kref *kref)
+void aa_ploaddata_kref(struct kref *kref)
{
- struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata, pcount);
if (d) {
- INIT_WORK(&d->work, do_loaddata_free);
+ INIT_WORK(&d->work, do_ploaddata_rmfs);
schedule_work(&d->work);
}
}
@@ -192,6 +205,7 @@ struct aa_loaddata *aa_loaddata_alloc(si
return ERR_PTR(-ENOMEM);
}
kref_init(&d->count);
+ kref_init(&d->pcount);
INIT_LIST_HEAD(&d->list);
return d;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 440/491] apparmor: fix race between freeing data and fs accessing it
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 439/491] apparmor: fix race on rawdata dereference Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 441/491] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
` (55 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qualys Security Advisory,
Georgia Garcia, Maxime Bélair, Cengiz Can, John Johansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
commit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 upstream.
Backport for conflicts introdued by
- conversion from sha1 to sha256 introduced in
e44a4dc4b36c ("apparmor: switch SECURITY_APPARMOR_HASH from sha1 to sha256
")
- adding of conditioanl that nests the conflicting code inside an if
condition
d61c57fde819 ("apparmor: make export of raw binary profile to userspace optional")
AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can and does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.
While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.
Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.
Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/apparmorfs.c | 193 +++++++++++++++++-------------
security/apparmor/include/label.h | 16 +-
security/apparmor/include/lib.h | 12 +
security/apparmor/include/policy.h | 8 -
security/apparmor/include/policy_unpack.h | 6
security/apparmor/label.c | 12 +
security/apparmor/policy_unpack.c | 6
7 files changed, 152 insertions(+), 101 deletions(-)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -32,6 +32,7 @@
#include "include/crypto.h"
#include "include/ipc.h"
#include "include/label.h"
+#include "include/lib.h"
#include "include/policy.h"
#include "include/policy_ns.h"
#include "include/resource.h"
@@ -61,6 +62,7 @@
* securityfs and apparmorfs filesystems.
*/
+#define IREF_POISON 101
/*
* support fns
@@ -150,6 +152,71 @@ static int aafs_show_path(struct seq_fil
return 0;
}
+static struct aa_ns *get_ns_common_ref(struct aa_common_ref *ref)
+{
+ if (ref) {
+ struct aa_label *reflabel = container_of(ref, struct aa_label,
+ count);
+ return aa_get_ns(labels_ns(reflabel));
+ }
+
+ return NULL;
+}
+
+static struct aa_proxy *get_proxy_common_ref(struct aa_common_ref *ref)
+{
+ if (ref)
+ return aa_get_proxy(container_of(ref, struct aa_proxy, count));
+
+ return NULL;
+}
+
+static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
+{
+ if (ref)
+ return aa_get_i_loaddata(container_of(ref, struct aa_loaddata,
+ count));
+ return NULL;
+}
+
+static void aa_put_common_ref(struct aa_common_ref *ref)
+{
+ if (!ref)
+ return;
+
+ switch (ref->reftype) {
+ case REF_RAWDATA:
+ aa_put_i_loaddata(container_of(ref, struct aa_loaddata,
+ count));
+ break;
+ case REF_PROXY:
+ aa_put_proxy(container_of(ref, struct aa_proxy,
+ count));
+ break;
+ case REF_NS:
+ /* ns count is held on its unconfined label */
+ aa_put_ns(labels_ns(container_of(ref, struct aa_label, count)));
+ break;
+ default:
+ AA_BUG(true, "unknown refcount type");
+ break;
+ }
+}
+
+static void aa_get_common_ref(struct aa_common_ref *ref)
+{
+ kref_get(&ref->count);
+}
+
+static void aafs_evict(struct inode *inode)
+{
+ struct aa_common_ref *ref = inode->i_private;
+
+ clear_inode(inode);
+ aa_put_common_ref(ref);
+ inode->i_private = (void *) IREF_POISON;
+}
+
static void aafs_free_inode(struct inode *inode)
{
if (S_ISLNK(inode->i_mode))
@@ -159,6 +226,7 @@ static void aafs_free_inode(struct inode
static const struct super_operations aafs_super_ops = {
.statfs = simple_statfs,
+ .evict_inode = aafs_evict,
.free_inode = aafs_free_inode,
.show_path = aafs_show_path,
};
@@ -259,7 +327,8 @@ static int __aafs_setup_d_inode(struct i
* aafs_remove(). Will return ERR_PTR on failure.
*/
static struct dentry *aafs_create(const char *name, umode_t mode,
- struct dentry *parent, void *data, void *link,
+ struct dentry *parent,
+ struct aa_common_ref *data, void *link,
const struct file_operations *fops,
const struct inode_operations *iops)
{
@@ -296,6 +365,9 @@ static struct dentry *aafs_create(const
goto fail_dentry;
inode_unlock(dir);
+ if (data)
+ aa_get_common_ref(data);
+
return dentry;
fail_dentry:
@@ -320,7 +392,8 @@ fail_lock:
* see aafs_create
*/
static struct dentry *aafs_create_file(const char *name, umode_t mode,
- struct dentry *parent, void *data,
+ struct dentry *parent,
+ struct aa_common_ref *data,
const struct file_operations *fops)
{
return aafs_create(name, mode, parent, data, NULL, fops, NULL);
@@ -446,7 +519,7 @@ end_section:
static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
loff_t *pos)
{
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns,
f->f_cred);
@@ -464,7 +537,7 @@ static const struct file_operations aa_f
static ssize_t profile_replace(struct file *f, const char __user *buf,
size_t size, loff_t *pos)
{
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
buf, size, pos, ns, f->f_cred);
aa_put_ns(ns);
@@ -484,7 +557,7 @@ static ssize_t profile_remove(struct fil
struct aa_loaddata *data;
struct aa_label *label;
ssize_t error;
- struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
+ struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
label = begin_current_label_crit_section();
/* high level check about policy management - fine grained in
@@ -574,7 +647,7 @@ static int ns_revision_open(struct inode
if (!rev)
return -ENOMEM;
- rev->ns = aa_get_ns(inode->i_private);
+ rev->ns = get_ns_common_ref(inode->i_private);
if (!rev->ns)
rev->ns = aa_get_current_ns();
file->private_data = rev;
@@ -1052,7 +1125,7 @@ static const struct file_operations seq_
static int seq_profile_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_proxy *proxy = aa_get_proxy(inode->i_private);
+ struct aa_proxy *proxy = get_proxy_common_ref(inode->i_private);
int error = single_open(file, show, proxy);
if (error) {
@@ -1230,7 +1303,7 @@ static const struct file_operations seq_
static int seq_rawdata_open(struct inode *inode, struct file *file,
int (*show)(struct seq_file *, void *))
{
- struct aa_loaddata *data = aa_get_i_loaddata(inode->i_private);
+ struct aa_loaddata *data = get_loaddata_common_ref(inode->i_private);
int error;
if (!data)
@@ -1370,7 +1443,7 @@ static int rawdata_open(struct inode *in
if (!policy_view_capable(NULL))
return -EACCES;
- loaddata = aa_get_i_loaddata(inode->i_private);
+ loaddata = get_loaddata_common_ref(inode->i_private);
if (!loaddata)
return -ENOENT;
@@ -1415,7 +1488,6 @@ static void remove_rawdata_dents(struct
if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
aafs_remove(rawdata->dents[i]);
rawdata->dents[i] = NULL;
- aa_put_i_loaddata(rawdata);
}
}
}
@@ -1454,45 +1526,41 @@ int __aa_fs_create_rawdata(struct aa_ns
if (IS_ERR(dir))
/* ->name freed when rawdata freed */
return PTR_ERR(dir);
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DIR] = dir;
- dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
+ dent = aafs_create_file("abi", S_IFREG | 0444, dir, &rawdata->count,
&seq_rawdata_abi_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_ABI] = dent;
- dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
- &seq_rawdata_revision_fops);
+ dent = aafs_create_file("revision", S_IFREG | 0444, dir,
+ &rawdata->count,
+ &seq_rawdata_revision_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
if (aa_g_hash_policy) {
dent = aafs_create_file("sha1", S_IFREG | 0444, dir,
- rawdata, &seq_rawdata_hash_fops);
+ &rawdata->count,
+ &seq_rawdata_hash_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_HASH] = dent;
}
dent = aafs_create_file("compressed_size", S_IFREG | 0444, dir,
- rawdata,
+ &rawdata->count,
&seq_rawdata_compressed_size_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
- dent = aafs_create_file("raw_data", S_IFREG | 0444,
- dir, rawdata, &rawdata_fops);
+ dent = aafs_create_file("raw_data", S_IFREG | 0444, dir,
+ &rawdata->count, &rawdata_fops);
if (IS_ERR(dent))
goto fail;
- aa_get_i_loaddata(rawdata);
rawdata->dents[AAFS_LOADDATA_DATA] = dent;
d_inode(dent)->i_size = rawdata->size;
@@ -1503,7 +1571,6 @@ int __aa_fs_create_rawdata(struct aa_ns
fail:
remove_rawdata_dents(rawdata);
- aa_put_i_loaddata(rawdata);
return PTR_ERR(dent);
}
@@ -1525,13 +1592,10 @@ void __aafs_profile_rmdir(struct aa_prof
__aafs_profile_rmdir(child);
for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
- struct aa_proxy *proxy;
if (!profile->dents[i])
continue;
- proxy = d_inode(profile->dents[i])->i_private;
aafs_remove(profile->dents[i]);
- aa_put_proxy(proxy);
profile->dents[i] = NULL;
}
}
@@ -1561,14 +1625,7 @@ static struct dentry *create_profile_fil
struct aa_profile *profile,
const struct file_operations *fops)
{
- struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy);
- struct dentry *dent;
-
- dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops);
- if (IS_ERR(dent))
- aa_put_proxy(proxy);
-
- return dent;
+ return aafs_create_file(name, S_IFREG | 0444, dir, &profile->label.proxy->count, fops);
}
static int profile_depth(struct aa_profile *profile)
@@ -1618,7 +1675,8 @@ static const char *rawdata_get_link_base
struct delayed_call *done,
const char *name)
{
- struct aa_proxy *proxy = inode->i_private;
+ struct aa_common_ref *ref = inode->i_private;
+ struct aa_proxy *proxy = container_of(ref, struct aa_proxy, count);
struct aa_label *label;
struct aa_profile *profile;
char *target;
@@ -1758,27 +1816,23 @@ int __aafs_profile_mkdir(struct aa_profi
if (profile->rawdata) {
dent = aafs_create("raw_sha1", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
+ &profile->label.proxy->count, NULL, NULL,
&rawdata_link_sha1_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_HASH] = dent;
-
dent = aafs_create("raw_abi", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
+ &profile->label.proxy->count, NULL, NULL,
&rawdata_link_abi_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_ABI] = dent;
dent = aafs_create("raw_data", S_IFLNK | 0444, dir,
- profile->label.proxy, NULL, NULL,
+ &profile->label.proxy->count, NULL, NULL,
&rawdata_link_data_iops);
if (IS_ERR(dent))
goto fail;
- aa_get_proxy(profile->label.proxy);
profile->dents[AAFS_PROF_RAW_DATA] = dent;
}
@@ -1813,7 +1867,7 @@ static int ns_mkdir_op(struct inode *dir
if (error)
return error;
- parent = aa_get_ns(dir->i_private);
+ parent = get_ns_common_ref(dir->i_private);
AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
/* we have to unlock and then relock to get locking order right
@@ -1863,7 +1917,7 @@ static int ns_rmdir_op(struct inode *dir
if (error)
return error;
- parent = aa_get_ns(dir->i_private);
+ parent = get_ns_common_ref(dir->i_private);
/* rmdir calls the generic securityfs functions to remove files
* from the apparmor dir. It is up to the apparmor ns locking
* to avoid races.
@@ -1933,27 +1987,6 @@ void __aafs_ns_rmdir(struct aa_ns *ns)
__aa_fs_list_remove_rawdata(ns);
- if (ns_subns_dir(ns)) {
- sub = d_inode(ns_subns_dir(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subload(ns)) {
- sub = d_inode(ns_subload(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subreplace(ns)) {
- sub = d_inode(ns_subreplace(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subremove(ns)) {
- sub = d_inode(ns_subremove(ns))->i_private;
- aa_put_ns(sub);
- }
- if (ns_subrevision(ns)) {
- sub = d_inode(ns_subrevision(ns))->i_private;
- aa_put_ns(sub);
- }
-
for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
aafs_remove(ns->dents[i]);
ns->dents[i] = NULL;
@@ -1978,40 +2011,40 @@ static int __aafs_ns_mkdir_entries(struc
return PTR_ERR(dent);
ns_subdata_dir(ns) = dent;
- dent = aafs_create_file("revision", 0444, dir, ns,
+ dent = aafs_create_file("revision", 0444, dir,
+ &ns->unconfined->label.count,
&aa_fs_ns_revision_fops);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subrevision(ns) = dent;
- dent = aafs_create_file(".load", 0640, dir, ns,
- &aa_fs_profile_load);
+ dent = aafs_create_file(".load", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_load);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subload(ns) = dent;
- dent = aafs_create_file(".replace", 0640, dir, ns,
- &aa_fs_profile_replace);
+ dent = aafs_create_file(".replace", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_replace);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subreplace(ns) = dent;
- dent = aafs_create_file(".remove", 0640, dir, ns,
- &aa_fs_profile_remove);
+ dent = aafs_create_file(".remove", 0640, dir,
+ &ns->unconfined->label.count,
+ &aa_fs_profile_remove);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subremove(ns) = dent;
/* use create_dentry so we can supply private data */
- dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL,
- &ns_dir_inode_operations);
+ dent = aafs_create("namespaces", S_IFDIR | 0755, dir,
+ &ns->unconfined->label.count,
+ NULL, NULL, &ns_dir_inode_operations);
if (IS_ERR(dent))
return PTR_ERR(dent);
- aa_get_ns(ns);
ns_subns_dir(ns) = dent;
return 0;
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -103,7 +103,7 @@ enum label_flags {
struct aa_label;
struct aa_proxy {
- struct kref count;
+ struct aa_common_ref count;
struct aa_label __rcu *label;
};
@@ -123,7 +123,7 @@ struct label_it {
* @ent: set of profiles for label, actual size determined by @size
*/
struct aa_label {
- struct kref count;
+ struct aa_common_ref count;
struct rb_node node;
struct rcu_head rcu;
struct aa_proxy *proxy;
@@ -373,7 +373,7 @@ int aa_label_match(struct aa_profile *pr
*/
static inline struct aa_label *__aa_get_label(struct aa_label *l)
{
- if (l && kref_get_unless_zero(&l->count))
+ if (l && kref_get_unless_zero(&l->count.count))
return l;
return NULL;
@@ -382,7 +382,7 @@ static inline struct aa_label *__aa_get_
static inline struct aa_label *aa_get_label(struct aa_label *l)
{
if (l)
- kref_get(&(l->count));
+ kref_get(&(l->count.count));
return l;
}
@@ -402,7 +402,7 @@ static inline struct aa_label *aa_get_la
rcu_read_lock();
do {
c = rcu_dereference(*l);
- } while (c && !kref_get_unless_zero(&c->count));
+ } while (c && !kref_get_unless_zero(&c->count.count));
rcu_read_unlock();
return c;
@@ -442,7 +442,7 @@ static inline struct aa_label *aa_get_ne
static inline void aa_put_label(struct aa_label *l)
{
if (l)
- kref_put(&l->count, aa_label_kref);
+ kref_put(&l->count.count, aa_label_kref);
}
@@ -452,7 +452,7 @@ void aa_proxy_kref(struct kref *kref);
static inline struct aa_proxy *aa_get_proxy(struct aa_proxy *proxy)
{
if (proxy)
- kref_get(&(proxy->count));
+ kref_get(&(proxy->count.count));
return proxy;
}
@@ -460,7 +460,7 @@ static inline struct aa_proxy *aa_get_pr
static inline void aa_put_proxy(struct aa_proxy *proxy)
{
if (proxy)
- kref_put(&proxy->count, aa_proxy_kref);
+ kref_put(&proxy->count.count, aa_proxy_kref);
}
void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new);
--- a/security/apparmor/include/lib.h
+++ b/security/apparmor/include/lib.h
@@ -60,6 +60,18 @@ void aa_info_message(const char *str);
/* Security blob offsets */
extern struct lsm_blob_sizes apparmor_blob_sizes;
+enum reftype {
+ REF_NS,
+ REF_PROXY,
+ REF_RAWDATA,
+};
+
+/* common reference count used by data the shows up in aafs */
+struct aa_common_ref {
+ struct kref count;
+ enum reftype reftype;
+};
+
/**
* aa_strneq - compare null terminated @str to a non null terminated substring
* @str: a null terminated string
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -243,7 +243,7 @@ static inline unsigned int PROFILE_MEDIA
static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
{
if (p)
- kref_get(&(p->label.count));
+ kref_get(&(p->label.count.count));
return p;
}
@@ -257,7 +257,7 @@ static inline struct aa_profile *aa_get_
*/
static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p)
{
- if (p && kref_get_unless_zero(&p->label.count))
+ if (p && kref_get_unless_zero(&p->label.count.count))
return p;
return NULL;
@@ -277,7 +277,7 @@ static inline struct aa_profile *aa_get_
rcu_read_lock();
do {
c = rcu_dereference(*p);
- } while (c && !kref_get_unless_zero(&c->label.count));
+ } while (c && !kref_get_unless_zero(&c->label.count.count));
rcu_read_unlock();
return c;
@@ -290,7 +290,7 @@ static inline struct aa_profile *aa_get_
static inline void aa_put_profile(struct aa_profile *p)
{
if (p)
- kref_put(&p->label.count, aa_label_kref);
+ kref_put(&p->label.count.count, aa_label_kref);
}
static inline int AUDIT_MODE(struct aa_profile *profile)
--- a/security/apparmor/include/policy_unpack.h
+++ b/security/apparmor/include/policy_unpack.h
@@ -67,7 +67,7 @@ enum {
* fs entries and drops the associated @count ref.
*/
struct aa_loaddata {
- struct kref count;
+ struct aa_common_ref count;
struct kref pcount;
struct list_head list;
struct work_struct work;
@@ -102,7 +102,7 @@ aa_get_i_loaddata(struct aa_loaddata *da
{
if (data)
- kref_get(&(data->count));
+ kref_get(&(data->count.count));
return data;
}
@@ -130,7 +130,7 @@ struct aa_loaddata *aa_loaddata_alloc(si
static inline void aa_put_i_loaddata(struct aa_loaddata *data)
{
if (data)
- kref_put(&data->count, aa_loaddata_kref);
+ kref_put(&data->count.count, aa_loaddata_kref);
}
static inline void aa_put_profile_loaddata(struct aa_loaddata *data)
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -52,7 +52,8 @@ static void free_proxy(struct aa_proxy *
void aa_proxy_kref(struct kref *kref)
{
- struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
+ struct aa_proxy *proxy = container_of(kref, struct aa_proxy,
+ count.count);
free_proxy(proxy);
}
@@ -63,7 +64,8 @@ struct aa_proxy *aa_alloc_proxy(struct a
new = kzalloc(sizeof(struct aa_proxy), gfp);
if (new) {
- kref_init(&new->count);
+ kref_init(&new->count.count);
+ new->count.reftype = REF_PROXY;
rcu_assign_pointer(new->label, aa_get_label(label));
}
return new;
@@ -366,7 +368,8 @@ static void label_free_rcu(struct rcu_he
void aa_label_kref(struct kref *kref)
{
- struct aa_label *label = container_of(kref, struct aa_label, count);
+ struct aa_label *label = container_of(kref, struct aa_label,
+ count.count);
struct aa_ns *ns = labels_ns(label);
if (!ns) {
@@ -403,7 +406,8 @@ bool aa_label_init(struct aa_label *labe
label->size = size; /* doesn't include null */
label->vec[size] = NULL; /* null terminate */
- kref_init(&label->count);
+ kref_init(&label->count.count);
+ label->count.reftype = REF_NS; /* for aafs purposes */
RB_CLEAR_NODE(&label->node);
return true;
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -157,7 +157,8 @@ static void do_loaddata_free(struct aa_l
void aa_loaddata_kref(struct kref *kref)
{
- struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
+ struct aa_loaddata *d = container_of(kref, struct aa_loaddata,
+ count.count);
do_loaddata_free(d);
}
@@ -204,7 +205,8 @@ struct aa_loaddata *aa_loaddata_alloc(si
kfree(d);
return ERR_PTR(-ENOMEM);
}
- kref_init(&d->count);
+ kref_init(&d->count.count);
+ d->count.reftype = REF_RAWDATA;
kref_init(&d->pcount);
INIT_LIST_HEAD(&d->list);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 441/491] netfilter: nft_ct: fix use-after-free in timeout object destroy
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 440/491] apparmor: fix race between freeing data and fs accessing it Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 442/491] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
` (54 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tuan Do, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuan Do <tuan@calif.io>
commit f8dca15a1b190787bbd03285304b569631160eda upstream.
nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without waiting for an RCU grace
period. Concurrent packet processing on other CPUs may still hold
RCU-protected references to the timeout object obtained via
rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
freeing until after an RCU grace period, matching the approach already
used in nfnetlink_cttimeout.c.
KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace:
nf_conntrack_tcp_packet+0x1381/0x29d0
nf_conntrack_in+0x612/0x8b0
nf_hook_slow+0x70/0x100
__ip_local_out+0x1b2/0x210
tcp_sendmsg_locked+0x722/0x1580
__sys_sendto+0x2d8/0x320
Allocated by task 75:
nft_ct_timeout_obj_init+0xf6/0x290
nft_obj_init+0x107/0x1b0
nf_tables_newobj+0x680/0x9c0
nfnetlink_rcv_batch+0xc29/0xe00
Freed by task 26:
nft_obj_destroy+0x3f/0xa0
nf_tables_trans_destroy_work+0x51c/0x5c0
process_one_work+0x2c4/0x5a0
Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
Cc: stable@vger.kernel.org
Signed-off-by: Tuan Do <tuan@calif.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/netfilter/nf_conntrack_timeout.h | 1 +
net/netfilter/nft_ct.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
--- a/include/net/netfilter/nf_conntrack_timeout.h
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -14,6 +14,7 @@
struct nf_ct_timeout {
__u16 l3num;
const struct nf_conntrack_l4proto *l4proto;
+ struct rcu_head rcu;
char data[];
};
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -935,7 +935,7 @@ static void nft_ct_timeout_obj_destroy(c
nf_queue_nf_hook_drop(ctx->net);
nf_ct_untimeout(ctx->net, timeout);
nf_ct_netns_put(ctx->net, ctx->family);
- kfree(priv->timeout);
+ kfree_rcu(priv->timeout, rcu);
}
static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 442/491] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 441/491] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 443/491] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
` (53 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleh Konko, Tung Nguyen,
Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleh Konko <security@1seal.org>
commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream.
The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
bc_ackers on every inbound group ACK, even when the same member has
already acknowledged the current broadcast round.
Because bc_ackers is a u16, a duplicate ACK received after the last
legitimate ACK wraps the counter to 65535. Once wrapped,
tipc_group_bc_cong() keeps reporting congestion and later group
broadcasts on the affected socket stay blocked until the group is
recreated.
Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
prevents the underflow path.
Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/group.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -745,6 +745,7 @@ void tipc_group_proto_rcv(struct tipc_gr
u32 port = msg_origport(hdr);
struct tipc_member *m, *pm;
u16 remitted, in_flight;
+ u16 acked;
if (!grp)
return;
@@ -797,7 +798,10 @@ void tipc_group_proto_rcv(struct tipc_gr
case GRP_ACK_MSG:
if (!m)
return;
- m->bc_acked = msg_grp_bc_acked(hdr);
+ acked = msg_grp_bc_acked(hdr);
+ if (less_eq(acked, m->bc_acked))
+ return;
+ m->bc_acked = acked;
if (--grp->bc_ackers)
return;
list_del_init(&m->small_win);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 443/491] wifi: brcmsmac: Fix dma_free_coherent() size
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 442/491] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 444/491] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
` (52 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Arend van Spriel,
Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
commit 12cd7632757a54ce586e36040210b1a738a0fc53 upstream.
dma_alloc_consistent() may change the size to align it. The new size is
saved in alloced.
Change the free size to match the allocation size.
Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260218130741.46566-3-fourier.thomas@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
@@ -483,7 +483,7 @@ static void *dma_ringalloc(struct dma_in
if (((desc_strtaddr + size - 1) & boundary) != (desc_strtaddr
& boundary)) {
*alignbits = dma_align_sizetobits(size);
- dma_free_coherent(di->dmadev, size, va, *descpa);
+ dma_free_coherent(di->dmadev, *alloced, va, *descpa);
va = dma_alloc_consistent(di, size, *alignbits,
alloced, descpa);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 444/491] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 443/491] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 445/491] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
` (51 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn Guo, Wei Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <shawnguo@kernel.org>
commit c1f2b0f2b5e37b2c27540a175aea2755a3799433 upstream.
The PCIe reset GPIO on Poplar is actually active low. The active high
worked before because kernel driver didn't respect the setting from DT.
This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using
gpiod API"), and thus PCIe on Poplar got brken since then.
Fix the problem by correcting the polarity.
Fixes: 32fa01761bd9 ("arm64: dts: hi3798cv200: enable PCIe support for poplar board")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts
@@ -179,7 +179,7 @@
};
&pcie {
- reset-gpios = <&gpio4 4 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpio4 4 GPIO_ACTIVE_LOW>;
vpcie-supply = <®_pcie>;
status = "okay";
};
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 445/491] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 444/491] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 446/491] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
` (50 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn Guo, Wei Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <shawnguo@kernel.org>
commit 1af997cad473d505248df6d9577183bb91f69670 upstream.
Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm:
Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively
changes zone_dma_bits from 30 to 32 for arm64 platforms that do not
properly define dma-ranges in device tree. It's unclear how Poplar reboot
gets broken by this change exactly, but a dma-ranges limiting zone_dma to
the first 1 GB fixes the regression.
Fixes: 2f20182ed670 ("arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
@@ -81,6 +81,7 @@
#address-cells = <1>;
#size-cells = <1>;
ranges = <0x0 0x0 0xf0000000 0x10000000>;
+ dma-ranges = <0x0 0x0 0x0 0x40000000>;
crg: clock-reset-controller@8a22000 {
compatible = "hisilicon,hi3798cv200-crg", "syscon", "simple-mfd";
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 446/491] nfc: pn533: allocate rx skb before consuming bytes
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 445/491] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 447/491] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
` (49 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit c71ba669b570c7b3f86ec875be222ea11dacb352 upstream.
pn532_receive_buf() reports the number of accepted bytes to the serdev
core. The current code consumes bytes into recv_skb and may already hand
a complete frame to pn533_recv_frame() before allocating a fresh receive
buffer.
If that alloc_skb() fails, the callback returns 0 even though it has
already consumed bytes, and it leaves recv_skb as NULL for the next
receive callback. That breaks the receive_buf() accounting contract and
can also lead to a NULL dereference on the next skb_put_u8().
Allocate the receive skb lazily before consuming the next byte instead.
If allocation fails, return the number of bytes already accepted.
Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260405094003.3-pn533-v2-pengpeng@iscas.ac.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/pn533/uart.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/nfc/pn533/uart.c
+++ b/drivers/nfc/pn533/uart.c
@@ -211,6 +211,13 @@ static int pn532_receive_buf(struct serd
del_timer(&dev->cmd_timeout);
for (i = 0; i < count; i++) {
+ if (!dev->recv_skb) {
+ dev->recv_skb = alloc_skb(PN532_UART_SKB_BUFF_LEN,
+ GFP_KERNEL);
+ if (!dev->recv_skb)
+ return i;
+ }
+
if (unlikely(!skb_tailroom(dev->recv_skb)))
skb_trim(dev->recv_skb, 0);
@@ -219,9 +226,7 @@ static int pn532_receive_buf(struct serd
continue;
pn533_recv_frame(dev->priv, dev->recv_skb, 0);
- dev->recv_skb = alloc_skb(PN532_UART_SKB_BUFF_LEN, GFP_KERNEL);
- if (!dev->recv_skb)
- return 0;
+ dev->recv_skb = NULL;
}
return i;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 447/491] batman-adv: reject oversized global TT response buffers
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 446/491] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 448/491] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
` (48 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Yuan Tan,
Xin Liu, Ren Wei, Ruide Cao, Ren Wei, Sven Eckelmann,
Simon Wunderlich
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruide Cao <caoruide123@gmail.com>
commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream.
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a remote originator
advertises a large enough global TT, the TT payload length plus the VLAN
header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when
it fills tt_change, so the wrapped allocation is too small and
batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in
the 16-bit TVLV payload length field.
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -849,8 +849,8 @@ batadv_tt_prepare_tvlv_global_data(struc
{
u16 num_vlan = 0;
u16 num_entries = 0;
- u16 change_offset;
- u16 tvlv_len;
+ u16 tvlv_len = 0;
+ unsigned int change_offset;
struct batadv_tvlv_tt_vlan_data *tt_vlan;
struct batadv_orig_node_vlan *vlan;
u8 *tt_change_ptr;
@@ -868,6 +868,11 @@ batadv_tt_prepare_tvlv_global_data(struc
if (*tt_len < 0)
*tt_len = batadv_tt_len(num_entries);
+ if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) {
+ *tt_len = 0;
+ goto out;
+ }
+
tvlv_len = *tt_len;
tvlv_len += change_offset;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 448/491] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 447/491] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 449/491] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
` (47 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Carlier, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
commit 6dede3967619b5944003227a5d09fdc21ed57d10 upstream.
When dma_map_single() fails in tse_start_xmit(), the function returns
NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the
stack the packet was consumed, the skb is never freed, leaking memory
on every DMA mapping failure.
Add dev_kfree_skb_any() before returning to properly free the skb.
Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260401211218.279185-1-devnexen@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/altera/altera_tse_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -591,6 +591,7 @@ static netdev_tx_t tse_start_xmit(struct
DMA_TO_DEVICE);
if (dma_mapping_error(priv->device, dma_addr)) {
netdev_err(priv->dev, "%s: DMA mapping error\n", __func__);
+ dev_kfree_skb_any(skb);
ret = NETDEV_TX_OK;
goto out;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 449/491] mmc: vub300: fix NULL-deref on disconnect
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 448/491] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 450/491] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
` (46 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit dff34ef879c5e73298443956a8b391311ba78d57 upstream.
Make sure to deregister the controller before dropping the reference to
the driver data on disconnect to avoid NULL-pointer dereferences or
use-after-free.
Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/vub300.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2371,8 +2371,8 @@ static void vub300_disconnect(struct usb
usb_set_intfdata(interface, NULL);
/* prevent more I/O from starting */
vub300->interface = NULL;
- kref_put(&vub300->kref, vub300_delete);
mmc_remove_host(mmc);
+ kref_put(&vub300->kref, vub300_delete);
pr_info("USB vub300 remote SDIO host controller[%d]"
" now disconnected", ifnum);
return;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 450/491] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 449/491] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 451/491] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
` (45 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Stefan Wahren,
Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit b76254c55dc8f23edc089027dd3f8792554c69fb upstream.
qca_tty_receive() consumes each input byte before checking whether a
completed frame needs a fresh receive skb. When the current byte completes
a frame, the driver delivers that frame and then allocates a new skb for
the next one.
If that allocation fails, the current code returns i even though data[i]
has already been consumed and may already have completed the delivered
frame. Since serdev interprets the return value as the number of accepted
bytes, this under-reports progress by one byte and can replay the final
byte of the completed frame into a fresh parser state on the next call.
Return i + 1 in that failure path so the accepted-byte count matches the
actual receive-state progress.
Fixes: dfc768fbe618 ("net: qualcomm: add QCA7000 UART driver")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260402071207.4036-1-pengpeng@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_uart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qualcomm/qca_uart.c
+++ b/drivers/net/ethernet/qualcomm/qca_uart.c
@@ -115,7 +115,7 @@ qca_tty_receive(struct serdev_device *se
if (!qca->rx_skb) {
netdev_dbg(netdev, "recv: out of RX resources\n");
n_stats->rx_errors++;
- return i;
+ return i + 1;
}
}
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 451/491] net: stmmac: fix integer underflow in chain mode
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 450/491] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 452/491] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
` (44 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tyllis Xu, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyllis Xu <livelycarpet87@gmail.com>
commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67 upstream.
The jumbo_frm() chain-mode implementation unconditionally computes
len = nopaged_len - bmax;
where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is
BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()
decides to invoke jumbo_frm() based on skb->len (total length including
page fragments):
is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);
When a packet has a small linear portion (nopaged_len <= bmax) but a
large total length due to page fragments (skb->len > bmax), the
subtraction wraps as an unsigned integer, producing a huge len value
(~0xFFFFxxxx). This causes the while (len != 0) loop to execute
hundreds of thousands of iterations, passing skb->data + bmax * i
pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less
SoCs (the typical deployment for stmmac), this maps arbitrary kernel
memory to the DMA engine, constituting a kernel memory disclosure and
potential memory corruption from hardware.
Fix this by introducing a buf_len local variable clamped to
min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then
always safe: it is zero when the linear portion fits within a single
descriptor, causing the while (len != 0) loop to be skipped naturally,
and the fragment loop in stmmac_xmit() handles page fragments afterward.
Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)")
Cc: stable@vger.kernel.org
Signed-off-by: Tyllis Xu <LivelyCarpet87@gmail.com>
Link: https://patch.msgid.link/20260401044708.1386919-1-LivelyCarpet87@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -20,7 +20,7 @@ static int jumbo_frm(void *p, struct sk_
unsigned int nopaged_len = skb_headlen(skb);
struct stmmac_priv *priv = tx_q->priv_data;
unsigned int entry = tx_q->cur_tx;
- unsigned int bmax, des2;
+ unsigned int bmax, buf_len, des2;
unsigned int i = 1, len;
struct dma_desc *desc;
@@ -31,17 +31,18 @@ static int jumbo_frm(void *p, struct sk_
else
bmax = BUF_SIZE_2KiB;
- len = nopaged_len - bmax;
+ buf_len = min_t(unsigned int, nopaged_len, bmax);
+ len = nopaged_len - buf_len;
des2 = dma_map_single(priv->device, skb->data,
- bmax, DMA_TO_DEVICE);
+ buf_len, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
if (dma_mapping_error(priv->device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
- tx_q->tx_skbuff_dma[entry].len = bmax;
+ tx_q->tx_skbuff_dma[entry].len = buf_len;
/* do not close the descriptor and do not set own bit */
- stmmac_prepare_tx_desc(priv, desc, 1, bmax, csum, STMMAC_CHAIN_MODE,
+ stmmac_prepare_tx_desc(priv, desc, 1, buf_len, csum, STMMAC_CHAIN_MODE,
0, false, skb->len);
while (len != 0) {
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 452/491] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 451/491] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 453/491] xen/privcmd: unregister xenstore notifier on module exit Greg Kroah-Hartman
` (43 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Anderson Nascimento, Luxiao Xu, Yuan Tan, Simon Horman, linux-afs,
stable, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f upstream.
An AF_RXRPC socket can be both client and server at the same time. When
sending new calls (ie. it's acting as a client), it uses rx->key to set the
security, and when accepting incoming calls (ie. it's acting as a server),
it uses rx->securities.
setsockopt(RXRPC_SECURITY_KEY) sets rx->key to point to an rxrpc-type key
and setsockopt(RXRPC_SECURITY_KEYRING) sets rx->securities to point to a
keyring of rxrpc_s-type keys.
Now, it should be possible to use both rx->key and rx->securities on the
same socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt()
prevents that.
Fix this by:
(1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING)
makes on rx->key.
(2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on
rx->key down into rxrpc_request_key().
(3) Remove rxrpc_request_key()'s check on rx->securities.
This (in combination with a previous patch) pushes the checks down into the
functions that set those pointers and removes the cross-checks that prevent
both key and keyring being set.
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Anderson Nascimento <anderson@allelesecurity.com>
cc: Luxiao Xu <rakukuip@gmail.com>
cc: Yuan Tan <yuantan098@gmail.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-16-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/af_rxrpc.c | 6 ------
net/rxrpc/key.c | 2 +-
2 files changed, 1 insertion(+), 7 deletions(-)
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -614,9 +614,6 @@ static int rxrpc_setsockopt(struct socke
goto success;
case RXRPC_SECURITY_KEY:
- ret = -EINVAL;
- if (rx->key)
- goto error;
ret = -EISCONN;
if (rx->sk.sk_state != RXRPC_UNBOUND)
goto error;
@@ -624,9 +621,6 @@ static int rxrpc_setsockopt(struct socke
goto error;
case RXRPC_SECURITY_KEYRING:
- ret = -EINVAL;
- if (rx->key)
- goto error;
ret = -EISCONN;
if (rx->sk.sk_state != RXRPC_UNBOUND)
goto error;
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -903,7 +903,7 @@ int rxrpc_request_key(struct rxrpc_sock
_enter("");
- if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities)
+ if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->key)
return -EINVAL;
description = memdup_sockptr_nul(optval, optlen);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 453/491] xen/privcmd: unregister xenstore notifier on module exit
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 452/491] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 454/491] ASoC: soc-core: dont use discriminatory terms on snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
` (42 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, GuoHan Zhao, Juergen Gross
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: GuoHan Zhao <zhaoguohan@kylinos.cn>
commit cd7e1fef5a1ca1c4fcd232211962ac2395601636 upstream.
Commit 453b8fb68f36 ("xen/privcmd: restrict usage in
unprivileged domU") added a xenstore notifier to defer setting the
restriction target until Xenstore is ready.
XEN_PRIVCMD can be built as a module, but privcmd_exit() leaves that
notifier behind. Balance the notifier lifecycle by unregistering it on
module exit.
This is harmless even if xenstore was already ready at registration
time and the notifier was never queued on the chain.
Fixes: 453b8fb68f3641fe ("xen/privcmd: restrict usage in unprivileged domU")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260325120246.252899-1-zhaoguohan@kylinos.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/privcmd.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1069,6 +1069,9 @@ static int __init privcmd_init(void)
static void __exit privcmd_exit(void)
{
+ if (!xen_initial_domain())
+ unregister_xenstore_notifier(&xenstore_notifier);
+
misc_deregister(&privcmd_dev);
misc_deregister(&xen_privcmdbuf_dev);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 454/491] ASoC: soc-core: dont use discriminatory terms on snd_soc_runtime_get_dai_fmt()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 453/491] xen/privcmd: unregister xenstore notifier on module exit Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 455/491] ASoC: tegra: Fix Master Volume Control Greg Kroah-Hartman
` (41 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
commit 640eac4c849d6390f272862ba8db14f28d423670 upstream.
snd_soc_runtime_get_dai_fmt() is using discriminatory terms.
This patch fixup it.
Fixes: ba9e82a1c891 ("ASoC: soc-core: add snd_soc_runtime_get_dai_fmt()")
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/874ke9dxkp.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1209,8 +1209,8 @@ found:
mask |= SND_SOC_DAIFMT_CLOCK_MASK;
if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_INV_MASK))
mask |= SND_SOC_DAIFMT_INV_MASK;
- if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_MASTER_MASK))
- mask |= SND_SOC_DAIFMT_MASTER_MASK;
+ if (!(dai_link->dai_fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK))
+ mask |= SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK;
dai_link->dai_fmt |= (dai_fmt & mask);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 455/491] ASoC: tegra: Fix Master Volume Control
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 454/491] ASoC: soc-core: dont use discriminatory terms on snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 456/491] netlink: add nla be16/32 types to minlen array Greg Kroah-Hartman
` (40 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jon Hunter, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
commit f9fd804aa0a36f15a35ca070ec4c52650876cc29 upstream.
Commit 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations") corrected
the PCM wait_time calculations and in doing so reduced the calculated
wait_time. This exposed an issue with the Tegra Master Volume Control
(MVC) device where the reduced wait_time caused the MVC to fail. For now
fix this by setting the default wait_time for Tegra to be 500ms.
Fixes: 3ed2b549b39f ("ALSA: pcm: fix wait_time calculations")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20230613093453.13927-1-jonathanh@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/tegra/tegra_pcm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -111,6 +111,9 @@ int tegra_pcm_open(struct snd_soc_compon
return ret;
}
+ /* Set wait time to 500ms by default */
+ substream->wait_time = 500;
+
return 0;
}
EXPORT_SYMBOL_GPL(tegra_pcm_open);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 456/491] netlink: add nla be16/32 types to minlen array
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 455/491] ASoC: tegra: Fix Master Volume Control Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 457/491] cpufreq: governor: Free dbs_data directly when gov->init() fails Greg Kroah-Hartman
` (39 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3f497b07aa3baf2fb4d0,
xingwei lee, Florian Westphal, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 9a0d18853c280f6a0ee99f91619f2442a17a323a upstream.
BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline]
BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline]
BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline]
BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631
nla_validate_range_unsigned lib/nlattr.c:222 [inline]
nla_validate_int_range lib/nlattr.c:336 [inline]
validate_nla lib/nlattr.c:575 [inline]
...
The message in question matches this policy:
[NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255),
but because NLA_BE32 size in minlen array is 0, the validation
code will read past the malformed (too small) attribute.
Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing:
those likely should be added too.
Reported-by: syzbot+3f497b07aa3baf2fb4d0@syzkaller.appspotmail.com
Reported-by: xingwei lee <xrivendell7@gmail.com>
Closes: https://lore.kernel.org/all/CABOYnLzFYHSnvTyS6zGa-udNX55+izqkOt2sB9WDqUcEGW6n8w@mail.gmail.com/raw
Fixes: ecaf75ffd5f5 ("netlink: introduce bigendian integer types")
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20240221172740.5092-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/nlattr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -30,6 +30,8 @@ static const u8 nla_attr_len[NLA_TYPE_MA
[NLA_S16] = sizeof(s16),
[NLA_S32] = sizeof(s32),
[NLA_S64] = sizeof(s64),
+ [NLA_BE16] = sizeof(__be16),
+ [NLA_BE32] = sizeof(__be32),
};
static const u8 nla_attr_minlen[NLA_TYPE_MAX+1] = {
@@ -43,6 +45,8 @@ static const u8 nla_attr_minlen[NLA_TYPE
[NLA_S16] = sizeof(s16),
[NLA_S32] = sizeof(s32),
[NLA_S64] = sizeof(s64),
+ [NLA_BE16] = sizeof(__be16),
+ [NLA_BE32] = sizeof(__be32),
};
/*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 457/491] cpufreq: governor: Free dbs_data directly when gov->init() fails
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 456/491] netlink: add nla be16/32 types to minlen array Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 458/491] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Greg Kroah-Hartman
` (38 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liao Chang, Viresh Kumar,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chang <liaochang1@huawei.com>
[ Upstream commit 916f13884042f615cfbfc0b42cc68dadee826f2a ]
Due to the kobject embedded in the dbs_data doest not has a release()
method yet, it needs to use kfree() to free dbs_data directly when
governor fails to allocate the tunner field of dbs_data.
Signed-off-by: Liao Chang <liaochang1@huawei.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 6dcf9d0064ce ("cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq_governor.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -430,7 +430,7 @@ int cpufreq_dbs_governor_init(struct cpu
ret = gov->init(dbs_data);
if (ret)
- goto free_policy_dbs_info;
+ goto free_dbs_data;
/*
* The sampling interval should not be less than the transition latency
@@ -464,6 +464,8 @@ int cpufreq_dbs_governor_init(struct cpu
if (!have_governor_per_policy())
gov->gdbs_data = NULL;
gov->exit(dbs_data);
+
+free_dbs_data:
kfree(dbs_data);
free_policy_dbs_info:
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 458/491] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 457/491] cpufreq: governor: Free dbs_data directly when gov->init() fails Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 459/491] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
` (37 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Zhongqiu Han,
Viresh Kumar, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e ]
When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls
kobject_put(&dbs_data->attr_set.kobj).
The kobject release callback cpufreq_dbs_data_release() calls
gov->exit(dbs_data) and kfree(dbs_data), but the current error path
then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a
double free.
Keep the direct kfree(dbs_data) for the gov->init() failure path, but
after kobject_init_and_add() has been called, let kobject_put() handle
the cleanup through cpufreq_dbs_data_release().
Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq_governor.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -457,13 +457,13 @@ int cpufreq_dbs_governor_init(struct cpu
/* Failure, so roll back. */
pr_err("initialization failed (dbs_data kobject init error %d)\n", ret);
- kobject_put(&dbs_data->attr_set.kobj);
-
policy->governor_data = NULL;
if (!have_governor_per_policy())
gov->gdbs_data = NULL;
- gov->exit(dbs_data);
+
+ kobject_put(&dbs_data->attr_set.kobj);
+ goto free_policy_dbs_info;
free_dbs_data:
kfree(dbs_data);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 459/491] seg6: separate dst_cache for input and output paths in seg6 lwtunnel
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 458/491] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 460/491] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
` (36 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Mayer, Nicolas Dichtel,
Justin Iurman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Mayer <andrea.mayer@uniroma2.it>
[ Upstream commit c3812651b522fe8437ebb7063b75ddb95b571643 ]
The seg6 lwtunnel uses a single dst_cache per encap route, shared
between seg6_input_core() and seg6_output_core(). These two paths
can perform the post-encap SID lookup in different routing contexts
(e.g., ip rules matching on the ingress interface, or VRF table
separation). Whichever path runs first populates the cache, and the
other reuses it blindly, bypassing its own lookup.
Fix this by splitting the cache into cache_input and cache_output,
so each path maintains its own cached dst independently.
Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260404004405.4057-2-andrea.mayer@uniroma2.it
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ adapted cache field references ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/seg6_iptunnel.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -45,7 +45,8 @@ static size_t seg6_lwt_headroom(struct s
}
struct seg6_lwt {
- struct dst_cache cache;
+ struct dst_cache cache_input;
+ struct dst_cache cache_output;
struct seg6_iptunnel_encap tuninfo[];
};
@@ -326,7 +327,7 @@ static int seg6_input(struct sk_buff *sk
slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
local_bh_disable();
- dst = dst_cache_get(&slwt->cache);
+ dst = dst_cache_get(&slwt->cache_input);
skb_dst_drop(skb);
@@ -334,7 +335,7 @@ static int seg6_input(struct sk_buff *sk
ip6_route_input(skb);
dst = skb_dst(skb);
if (!dst->error) {
- dst_cache_set_ip6(&slwt->cache, dst,
+ dst_cache_set_ip6(&slwt->cache_input, dst,
&ipv6_hdr(skb)->saddr);
}
} else {
@@ -363,7 +364,7 @@ static int seg6_output(struct net *net,
slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
local_bh_disable();
- dst = dst_cache_get(&slwt->cache);
+ dst = dst_cache_get(&slwt->cache_output);
local_bh_enable();
if (unlikely(!dst)) {
@@ -384,7 +385,7 @@ static int seg6_output(struct net *net,
}
local_bh_disable();
- dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);
+ dst_cache_set_ip6(&slwt->cache_output, dst, &fl6.saddr);
local_bh_enable();
}
@@ -461,11 +462,13 @@ static int seg6_build_state(struct net *
slwt = seg6_lwt_lwtunnel(newts);
- err = dst_cache_init(&slwt->cache, GFP_ATOMIC);
- if (err) {
- kfree(newts);
- return err;
- }
+ err = dst_cache_init(&slwt->cache_input, GFP_ATOMIC);
+ if (err)
+ goto err_free_newts;
+
+ err = dst_cache_init(&slwt->cache_output, GFP_ATOMIC);
+ if (err)
+ goto err_destroy_input;
memcpy(&slwt->tuninfo, tuninfo, tuninfo_len);
@@ -480,11 +483,20 @@ static int seg6_build_state(struct net *
*ts = newts;
return 0;
+
+err_destroy_input:
+ dst_cache_destroy(&slwt->cache_input);
+err_free_newts:
+ kfree(newts);
+ return err;
}
static void seg6_destroy_state(struct lwtunnel_state *lwt)
{
- dst_cache_destroy(&seg6_lwt_lwtunnel(lwt)->cache);
+ struct seg6_lwt *slwt = seg6_lwt_lwtunnel(lwt);
+
+ dst_cache_destroy(&slwt->cache_input);
+ dst_cache_destroy(&slwt->cache_output);
}
static int seg6_fill_encap_info(struct sk_buff *skb,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 460/491] net: rfkill: prevent unlimited numbers of rfkill events from being created
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 459/491] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 461/491] usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman
` (35 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, stable, Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit ea245d78dec594372e27d8c79616baf49e98a4a1 ]
Userspace can create an unlimited number of rfkill events if the system
is so configured, while not consuming them from the rfkill file
descriptor, causing a potential out of memory situation. Prevent this
from bounding the number of pending rfkill events at a "large" number
(i.e. 1000) to prevent abuses like this.
Cc: Johannes Berg <johannes@sipsolutions.net>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026033013-disfigure-scroll-e25e@gregkh
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ replaced `rfkill_event_ext` with `rfkill_event`, `scoped_guard` with explicit mutex calls, and removed outer `data->mtx` lock in `rfkill_fop_open` to avoid deadlock with new internal locking ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rfkill/core.c | 40 +++++++++++++++++++++++++++-------------
1 file changed, 27 insertions(+), 13 deletions(-)
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -71,11 +71,14 @@ struct rfkill_int_event {
struct rfkill_event ev;
};
+/* Max rfkill events that can be "in-flight" for one data source */
+#define MAX_RFKILL_EVENT 1000
struct rfkill_data {
struct list_head list;
struct list_head events;
struct mutex mtx;
wait_queue_head_t read_wait;
+ u32 event_count;
bool input_handler;
};
@@ -252,9 +255,12 @@ static void rfkill_global_led_trigger_un
}
#endif /* CONFIG_RFKILL_LEDS */
-static void rfkill_fill_event(struct rfkill_event *ev, struct rfkill *rfkill,
- enum rfkill_operation op)
+static int rfkill_fill_event(struct rfkill_int_event *int_ev,
+ struct rfkill *rfkill,
+ struct rfkill_data *data,
+ enum rfkill_operation op)
{
+ struct rfkill_event *ev = &int_ev->ev;
unsigned long flags;
ev->idx = rfkill->idx;
@@ -266,6 +272,16 @@ static void rfkill_fill_event(struct rfk
ev->soft = !!(rfkill->state & (RFKILL_BLOCK_SW |
RFKILL_BLOCK_SW_PREV));
spin_unlock_irqrestore(&rfkill->lock, flags);
+
+ mutex_lock(&data->mtx);
+ if (data->event_count++ > MAX_RFKILL_EVENT) {
+ data->event_count--;
+ mutex_unlock(&data->mtx);
+ return -ENOSPC;
+ }
+ list_add_tail(&int_ev->list, &data->events);
+ mutex_unlock(&data->mtx);
+ return 0;
}
static void rfkill_send_events(struct rfkill *rfkill, enum rfkill_operation op)
@@ -277,10 +293,10 @@ static void rfkill_send_events(struct rf
ev = kzalloc(sizeof(*ev), GFP_KERNEL);
if (!ev)
continue;
- rfkill_fill_event(&ev->ev, rfkill, op);
- mutex_lock(&data->mtx);
- list_add_tail(&ev->list, &data->events);
- mutex_unlock(&data->mtx);
+ if (rfkill_fill_event(ev, rfkill, data, op)) {
+ kfree(ev);
+ continue;
+ }
wake_up_interruptible(&data->read_wait);
}
}
@@ -1118,21 +1134,19 @@ static int rfkill_fop_open(struct inode
init_waitqueue_head(&data->read_wait);
mutex_lock(&rfkill_global_mutex);
- mutex_lock(&data->mtx);
/*
- * start getting events from elsewhere but hold mtx to get
- * startup events added first
+ * start getting events from elsewhere but hold rfkill_global_mutex
+ * to get startup events added first
*/
list_for_each_entry(rfkill, &rfkill_list, node) {
ev = kzalloc(sizeof(*ev), GFP_KERNEL);
if (!ev)
goto free;
- rfkill_fill_event(&ev->ev, rfkill, RFKILL_OP_ADD);
- list_add_tail(&ev->list, &data->events);
+ if (rfkill_fill_event(ev, rfkill, data, RFKILL_OP_ADD))
+ kfree(ev);
}
list_add(&data->list, &rfkill_fds);
- mutex_unlock(&data->mtx);
mutex_unlock(&rfkill_global_mutex);
file->private_data = data;
@@ -1140,7 +1154,6 @@ static int rfkill_fop_open(struct inode
return stream_open(inode, file);
free:
- mutex_unlock(&data->mtx);
mutex_unlock(&rfkill_global_mutex);
mutex_destroy(&data->mtx);
list_for_each_entry_safe(ev, tmp, &data->events, list)
@@ -1200,6 +1213,7 @@ static ssize_t rfkill_fop_read(struct fi
ret = -EFAULT;
list_del(&ev->list);
+ data->event_count--;
kfree(ev);
out:
mutex_unlock(&data->mtx);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 461/491] usb: gadget: f_hid: move list and spinlock inits from bind to alloc
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 460/491] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 462/491] usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Greg Kroah-Hartman
` (34 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Zimmermann, stable,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Zimmermann <sigmaepsilon92@gmail.com>
[ Upstream commit 4e0a88254ad59f6c53a34bf5fa241884ec09e8b2 ]
There was an issue when you did the following:
- setup and bind an hid gadget
- open /dev/hidg0
- use the resulting fd in EPOLL_CTL_ADD
- unbind the UDC
- bind the UDC
- use the fd in EPOLL_CTL_DEL
When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported
within remove_wait_queue (via ep_remove_wait_queue). After some
debugging I found out that the queues, which f_hid registers via
poll_wait were the problem. These were initialized using
init_waitqueue_head inside hidg_bind. So effectively, the bind function
re-initialized the queues while there were still items in them.
The solution is to move the initialization from hidg_bind to hidg_alloc
to extend their lifetimes to the lifetime of the function instance.
Additionally, I found many other possibly problematic init calls in the
bind function, which I moved as well.
Signed-off-by: Michael Zimmermann <sigmaepsilon92@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260331184844.2388761-1-sigmaepsilon92@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_hid.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -996,13 +996,8 @@ static int hidg_bind(struct usb_configur
if (status)
goto fail;
- spin_lock_init(&hidg->write_spinlock);
hidg->write_pending = 1;
hidg->req = NULL;
- spin_lock_init(&hidg->read_spinlock);
- init_waitqueue_head(&hidg->write_queue);
- init_waitqueue_head(&hidg->read_queue);
- INIT_LIST_HEAD(&hidg->completed_out_req);
/* create char device */
cdev_init(&hidg->cdev, &f_hidg_fops);
@@ -1272,6 +1267,12 @@ static struct usb_function *hidg_alloc(s
mutex_lock(&opts->lock);
++opts->refcnt;
+ spin_lock_init(&hidg->write_spinlock);
+ spin_lock_init(&hidg->read_spinlock);
+ init_waitqueue_head(&hidg->write_queue);
+ init_waitqueue_head(&hidg->read_queue);
+ INIT_LIST_HEAD(&hidg->completed_out_req);
+
device_initialize(&hidg->dev);
hidg->dev.release = hidg_release;
hidg->dev.class = hidg_class;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 462/491] usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 461/491] usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 463/491] usb: gadget: uvc: fix NULL pointer dereference during unbind race Greg Kroah-Hartman
` (33 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Kuen-Han Tsai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
[ Upstream commit e1eabb072c75681f78312c484ccfffb7430f206e ]
A race condition between gether_disconnect() and eth_stop() leads to a
NULL pointer dereference. Specifically, if eth_stop() is triggered
concurrently while gether_disconnect() is tearing down the endpoints,
eth_stop() attempts to access the cleared endpoint descriptor, causing
the following NPE:
Unable to handle kernel NULL pointer dereference
Call trace:
__dwc3_gadget_ep_enable+0x60/0x788
dwc3_gadget_ep_enable+0x70/0xe4
usb_ep_enable+0x60/0x15c
eth_stop+0xb8/0x108
Because eth_stop() crashes while holding the dev->lock, the thread
running gether_disconnect() fails to acquire the same lock and spins
forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7)
Call trace:
queued_spin_lock_slowpath+0x94/0x488
_raw_spin_lock+0x64/0x6c
gether_disconnect+0x19c/0x1e8
ncm_set_alt+0x68/0x1a0
composite_setup+0x6a0/0xc50
The root cause is that the clearing of dev->port_usb in
gether_disconnect() is delayed until the end of the function.
Move the clearing of dev->port_usb to the very beginning of
gether_disconnect() while holding dev->lock. This cuts off the link
immediately, ensuring eth_stop() will see dev->port_usb as NULL and
safely bail out.
Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
Cc: stable <stable@kernel.org>
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/u_ether.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -1141,6 +1141,10 @@ void gether_disconnect(struct gether *li
DBG(dev, "%s\n", __func__);
+ spin_lock(&dev->lock);
+ dev->port_usb = NULL;
+ spin_unlock(&dev->lock);
+
netif_stop_queue(dev->net);
netif_carrier_off(dev->net);
@@ -1178,10 +1182,6 @@ void gether_disconnect(struct gether *li
dev->header_len = 0;
dev->unwrap = NULL;
dev->wrap = NULL;
-
- spin_lock(&dev->lock);
- dev->port_usb = NULL;
- spin_unlock(&dev->lock);
}
EXPORT_SYMBOL_GPL(gether_disconnect);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 463/491] usb: gadget: uvc: fix NULL pointer dereference during unbind race
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 462/491] usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 464/491] net: macb: Move devm_{free,request}_irq() out of spin lock area Greg Kroah-Hartman
` (32 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alan Stern, Jimmy Hu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hu <hhhuuu@google.com>
[ Upstream commit eba2936bbe6b752a31725a9eb5c674ecbf21ee7d ]
Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly
shutdown") introduced two stages of synchronization waits totaling 1500ms
in uvc_function_unbind() to prevent several types of kernel panics.
However, this timing-based approach is insufficient during power
management (PM) transitions.
When the PM subsystem starts freezing user space processes, the
wait_event_interruptible_timeout() is aborted early, which allows the
unbind thread to proceed and nullify the gadget pointer
(cdev->gadget = NULL):
[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()
[ 814.178583][ T3173] PM: suspend entry (deep)
[ 814.192487][ T3173] Freezing user space processes
[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release
When the PM subsystem resumes or aborts the suspend and tasks are
restarted, the V4L2 release path is executed and attempts to access the
already nullified gadget pointer, triggering a kernel panic:
[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake
[ 814.386727][ T3173] Restarting tasks ...
[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4
[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94
[ 814.404078][ T4558] Call trace:
[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4
[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94
[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c
[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac
[ 814.404095][ T4558] v4l2_release+0xcc/0x130
Address the race condition and NULL pointer dereference by:
1. State Synchronization (flag + mutex)
Introduce a 'func_unbound' flag in struct uvc_device. This allows
uvc_function_disconnect() to safely skip accessing the nullified
cdev->gadget pointer. As suggested by Alan Stern, this flag is protected
by a new mutex (uvc->lock) to ensure proper memory ordering and prevent
instruction reordering or speculative loads. This mutex is also used to
protect 'func_connected' for consistent state management.
2. Explicit Synchronization (completion)
Use a completion to synchronize uvc_function_unbind() with the
uvc_vdev_release() callback. This prevents Use-After-Free (UAF) by
ensuring struct uvc_device is freed after all video device resources
are released.
Fixes: b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly shutdown")
Cc: stable <stable@kernel.org>
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://patch.msgid.link/20260320065427.1374555-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ replaced guard()/scoped_guard() macros ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uvc.c | 46 ++++++++++++++++++++++++++++++---
drivers/usb/gadget/function/uvc.h | 3 ++
drivers/usb/gadget/function/uvc_v4l2.c | 13 +++++++--
3 files changed, 56 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -393,6 +393,14 @@ uvc_function_disconnect(struct uvc_devic
{
int ret;
+ mutex_lock(&uvc->lock);
+ if (uvc->func_unbound) {
+ dev_dbg(&uvc->vdev.dev, "skipping function deactivate (unbound)\n");
+ mutex_unlock(&uvc->lock);
+ return;
+ }
+ mutex_unlock(&uvc->lock);
+
if ((ret = usb_function_deactivate(&uvc->func)) < 0)
uvcg_info(&uvc->func, "UVC disconnect failed with %d\n", ret);
}
@@ -411,6 +419,15 @@ static ssize_t function_name_show(struct
static DEVICE_ATTR_RO(function_name);
+static void uvc_vdev_release(struct video_device *vdev)
+{
+ struct uvc_device *uvc = video_get_drvdata(vdev);
+
+ /* Signal uvc_function_unbind() that the video device has been released */
+ if (uvc->vdev_release_done)
+ complete(uvc->vdev_release_done);
+}
+
static int
uvc_register_video(struct uvc_device *uvc)
{
@@ -421,7 +438,7 @@ uvc_register_video(struct uvc_device *uv
uvc->vdev.v4l2_dev = &uvc->v4l2_dev;
uvc->vdev.fops = &uvc_v4l2_fops;
uvc->vdev.ioctl_ops = &uvc_v4l2_ioctl_ops;
- uvc->vdev.release = video_device_release_empty;
+ uvc->vdev.release = uvc_vdev_release;
uvc->vdev.vfl_dir = VFL_DIR_TX;
uvc->vdev.lock = &uvc->video.mutex;
uvc->vdev.device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
@@ -595,6 +612,9 @@ uvc_function_bind(struct usb_configurati
int ret = -EINVAL;
uvcg_info(f, "%s()\n", __func__);
+ mutex_lock(&uvc->lock);
+ uvc->func_unbound = false;
+ mutex_unlock(&uvc->lock);
opts = fi_to_f_uvc_opts(f->fi);
/* Sanity check the streaming endpoint module parameters.
@@ -887,18 +907,25 @@ static void uvc_free(struct usb_function
static void uvc_function_unbind(struct usb_configuration *c,
struct usb_function *f)
{
+ DECLARE_COMPLETION_ONSTACK(vdev_release_done);
struct usb_composite_dev *cdev = c->cdev;
struct uvc_device *uvc = to_uvc(f);
long wait_ret = 1;
+ bool connected;
uvcg_info(f, "%s()\n", __func__);
+ mutex_lock(&uvc->lock);
+ uvc->func_unbound = true;
+ uvc->vdev_release_done = &vdev_release_done;
+ connected = uvc->func_connected;
+ mutex_unlock(&uvc->lock);
/* If we know we're connected via v4l2, then there should be a cleanup
* of the device from userspace either via UVC_EVENT_DISCONNECT or
* though the video device removal uevent. Allow some time for the
* application to close out before things get deleted.
*/
- if (uvc->func_connected) {
+ if (connected) {
uvcg_dbg(f, "waiting for clean disconnect\n");
wait_ret = wait_event_interruptible_timeout(uvc->func_connected_queue,
uvc->func_connected == false, msecs_to_jiffies(500));
@@ -909,8 +936,13 @@ static void uvc_function_unbind(struct u
video_unregister_device(&uvc->vdev);
v4l2_device_unregister(&uvc->v4l2_dev);
- if (uvc->func_connected) {
- /* Wait for the release to occur to ensure there are no longer any
+ mutex_lock(&uvc->lock);
+ connected = uvc->func_connected;
+ mutex_unlock(&uvc->lock);
+
+ if (connected) {
+ /*
+ * Wait for the release to occur to ensure there are no longer any
* pending operations that may cause panics when resources are cleaned
* up.
*/
@@ -920,6 +952,10 @@ static void uvc_function_unbind(struct u
uvcg_dbg(f, "done waiting for release with ret: %ld\n", wait_ret);
}
+ /* Wait for the video device to be released */
+ wait_for_completion(&vdev_release_done);
+ uvc->vdev_release_done = NULL;
+
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
kfree(uvc->control_buf);
@@ -937,6 +973,8 @@ static struct usb_function *uvc_alloc(st
return ERR_PTR(-ENOMEM);
mutex_init(&uvc->video.mutex);
+ mutex_init(&uvc->lock);
+ uvc->func_unbound = true;
uvc->state = UVC_STATE_DISCONNECTED;
init_waitqueue_head(&uvc->func_connected_queue);
opts = fi_to_f_uvc_opts(fi);
--- a/drivers/usb/gadget/function/uvc.h
+++ b/drivers/usb/gadget/function/uvc.h
@@ -118,6 +118,9 @@ struct uvc_device {
enum uvc_state state;
struct usb_function func;
struct uvc_video video;
+ struct completion *vdev_release_done;
+ struct mutex lock; /* protects func_unbound and func_connected */
+ bool func_unbound;
bool func_connected;
wait_queue_head_t func_connected_queue;
--- a/drivers/usb/gadget/function/uvc_v4l2.c
+++ b/drivers/usb/gadget/function/uvc_v4l2.c
@@ -234,12 +234,18 @@ uvc_v4l2_subscribe_event(struct v4l2_fh
if (sub->type < UVC_EVENT_FIRST || sub->type > UVC_EVENT_LAST)
return -EINVAL;
- if (sub->type == UVC_EVENT_SETUP && uvc->func_connected)
+ mutex_lock(&uvc->lock);
+
+ if (sub->type == UVC_EVENT_SETUP && uvc->func_connected) {
+ mutex_unlock(&uvc->lock);
return -EBUSY;
+ }
ret = v4l2_event_subscribe(fh, sub, 2, NULL);
- if (ret < 0)
+ if (ret < 0) {
+ mutex_unlock(&uvc->lock);
return ret;
+ }
if (sub->type == UVC_EVENT_SETUP) {
uvc->func_connected = true;
@@ -247,6 +253,7 @@ uvc_v4l2_subscribe_event(struct v4l2_fh
uvc_function_connect(uvc);
}
+ mutex_unlock(&uvc->lock);
return 0;
}
@@ -255,7 +262,9 @@ static void uvc_v4l2_disable(struct uvc_
uvc_function_disconnect(uvc);
uvcg_video_enable(&uvc->video, 0);
uvcg_free_buffers(&uvc->video.queue);
+ mutex_lock(&uvc->lock);
uvc->func_connected = false;
+ mutex_unlock(&uvc->lock);
wake_up_interruptible(&uvc->func_connected_queue);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 464/491] net: macb: Move devm_{free,request}_irq() out of spin lock area
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 463/491] usb: gadget: uvc: fix NULL pointer dereference during unbind race Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 465/491] mm/huge_memory: fix folio isnt locked in softleaf_to_folio() Greg Kroah-Hartman
` (31 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Théo Lebrun, Kevin Hao,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit 317e49358ebbf6390fa439ef3c142f9239dd25fb ]
The devm_free_irq() and devm_request_irq() functions should not be
executed in an atomic context.
During device suspend, all userspace processes and most kernel threads
are frozen. Additionally, we flush all tx/rx status, disable all macb
interrupts, and halt rx operations. Therefore, it is safe to split the
region protected by bp->lock into two independent sections, allowing
devm_free_irq() and devm_request_irq() to run in a non-atomic context.
This modification resolves the following lockdep warning:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake
preempt_count: 1, expected: 0
RCU nest depth: 1, expected: 0
7 locks held by rtcwake/501:
#0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368
#1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8
#2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8
#3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290
#4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0
#5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48
#6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558
irq event stamp: 8682
hardirqs last enabled at (8681): [<ffff8000813c7d7c>] _raw_spin_unlock_irqrestore+0x44/0x88
hardirqs last disabled at (8682): [<ffff8000813c7b58>] _raw_spin_lock_irqsave+0x38/0x98
softirqs last enabled at (7322): [<ffff8000800f1b4c>] handle_softirqs+0x52c/0x588
softirqs last disabled at (7317): [<ffff800080010310>] __do_softirq+0x20/0x2c
CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT
Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
Call trace:
show_stack+0x24/0x38 (C)
__dump_stack+0x28/0x38
dump_stack_lvl+0x64/0x88
dump_stack+0x18/0x24
__might_resched+0x200/0x218
__might_sleep+0x38/0x98
__mutex_lock_common+0x7c/0x1378
mutex_lock_nested+0x38/0x50
free_irq+0x68/0x2b0
devm_irq_release+0x24/0x38
devres_release+0x40/0x80
devm_free_irq+0x48/0x88
macb_suspend+0x298/0x558
device_suspend+0x218/0x4f0
dpm_suspend+0x244/0x3a0
dpm_suspend_start+0x50/0x78
suspend_devices_and_enter+0xec/0x560
pm_suspend+0x194/0x290
state_store+0x110/0x158
kobj_attr_store+0x1c/0x30
sysfs_kf_write+0xa8/0xd0
kernfs_fop_write_iter+0x11c/0x1c8
vfs_write+0x248/0x368
ksys_write+0x7c/0xf8
__arm64_sys_write+0x28/0x40
invoke_syscall+0x4c/0xe8
el0_svc_common+0x98/0xf0
do_el0_svc+0x28/0x40
el0_svc+0x54/0x1e0
el0t_64_sync_handler+0x84/0x130
el0t_64_sync+0x198/0x1a0
Fixes: 558e35ccfe95 ("net: macb: WoL support for GEM type of Ethernet controller")
Cc: stable@vger.kernel.org
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Link: https://patch.msgid.link/20260318-macb-irq-v2-1-f1179768ab24@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ adapted WoL register writes to use MACB_BIT(MAG) instead of tmp variable ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cadence/macb_main.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -4734,6 +4734,8 @@ static int __maybe_unused macb_suspend(s
if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
queue_writel(queue, ISR, -1);
}
+ spin_unlock_irqrestore(&bp->lock, flags);
+
/* Change interrupt handler and
* Enable WoL IRQ on queue 0
*/
@@ -4745,11 +4747,12 @@ static int __maybe_unused macb_suspend(s
dev_err(dev,
"Unable to request IRQ %d (error %d)\n",
bp->queues[0].irq, err);
- spin_unlock_irqrestore(&bp->lock, flags);
return err;
}
+ spin_lock_irqsave(&bp->lock, flags);
queue_writel(bp->queues, IER, GEM_BIT(WOL));
gem_writel(bp, WOL, MACB_BIT(MAG));
+ spin_unlock_irqrestore(&bp->lock, flags);
} else {
err = devm_request_irq(dev, bp->queues[0].irq, macb_wol_interrupt,
IRQF_SHARED, netdev->name, bp->queues);
@@ -4757,13 +4760,13 @@ static int __maybe_unused macb_suspend(s
dev_err(dev,
"Unable to request IRQ %d (error %d)\n",
bp->queues[0].irq, err);
- spin_unlock_irqrestore(&bp->lock, flags);
return err;
}
+ spin_lock_irqsave(&bp->lock, flags);
queue_writel(bp->queues, IER, MACB_BIT(WOL));
macb_writel(bp, WOL, MACB_BIT(MAG));
+ spin_unlock_irqrestore(&bp->lock, flags);
}
- spin_unlock_irqrestore(&bp->lock, flags);
enable_irq_wake(bp->queues[0].irq);
}
@@ -4825,6 +4828,8 @@ static int __maybe_unused macb_resume(st
queue_readl(bp->queues, ISR);
if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
queue_writel(bp->queues, ISR, -1);
+ spin_unlock_irqrestore(&bp->lock, flags);
+
/* Replace interrupt handler on queue 0 */
devm_free_irq(dev, bp->queues[0].irq, bp->queues);
err = devm_request_irq(dev, bp->queues[0].irq, macb_interrupt,
@@ -4833,10 +4838,8 @@ static int __maybe_unused macb_resume(st
dev_err(dev,
"Unable to request IRQ %d (error %d)\n",
bp->queues[0].irq, err);
- spin_unlock_irqrestore(&bp->lock, flags);
return err;
}
- spin_unlock_irqrestore(&bp->lock, flags);
disable_irq_wake(bp->queues[0].irq);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 465/491] mm/huge_memory: fix folio isnt locked in softleaf_to_folio()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 464/491] net: macb: Move devm_{free,request}_irq() out of spin lock area Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 466/491] ext4: fix the might_sleep() warnings in kvfree() Greg Kroah-Hartman
` (30 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjiang Tu, David Hildenbrand (Arm),
Lorenzo Stoakes (Oracle), Barry Song, Kefeng Wang, Liam Howlett,
Michal Hocko, Mike Rapoport, Nanyong Sun, Ryan Roberts,
Suren Baghdasaryan, Vlastimil Babka, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjiang Tu <tujinjiang@huawei.com>
[ Upstream commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 ]
On arm64 server, we found folio that get from migration entry isn't locked
in softleaf_to_folio(). This issue triggers when mTHP splitting and
zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes()
lock folio
split_folio()
unmap_folio()
change ptes to migration entries
__split_folio_to_order() softleaf_to_folio()
set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))
smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))
prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
are visible before the tail page becomes non-compound. smp_wmb() should
be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a
result, if zap_nonpresent_ptes() accesses migration entry that stores tail
pfn, softleaf_to_folio() may see the updated compound_head of tail page
before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
because of the race between folio split and zap_nonpresent_ptes()
leading to a folio incorrectly undergoing modification without a folio
lock being held.
This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further
swapops predicates"), which in merged in v6.19-rc1.
To fix it, add missing smp_rmb() if the softleaf entry is migration entry
in softleaf_to_folio() and softleaf_to_page().
[tujinjiang@huawei.com: update function name and comments]
Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com
Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com
Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ adapted upstream leafops.h changes to swapops.h ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/swapops.h | 6 ++++++
1 file changed, 6 insertions(+)
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -198,6 +198,12 @@ static inline struct page *migration_ent
{
struct page *p = pfn_to_page(swp_offset(entry));
/*
+ * Ensure we do not race with split, which might alter tail pages
+ * into new folios and thus result in observing an unlocked page.
+ * This matches the write barrier in __split_huge_page_tail().
+ */
+ smp_rmb();
+ /*
* Any use of migration entries may only occur while the
* corresponding page is locked
*/
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 466/491] ext4: fix the might_sleep() warnings in kvfree()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 465/491] mm/huge_memory: fix folio isnt locked in softleaf_to_folio() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 467/491] xfs: save ailp before dropping the AIL lock in push callbacks Greg Kroah-Hartman
` (29 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zqiang, Baokun Li, Theodore Tso,
stable, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <qiang.zhang@linux.dev>
[ Upstream commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa ]
Use the kvfree() in the RCU read critical section can trigger
the following warnings:
EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.
WARNING: suspicious RCU usage
./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
Call Trace:
<TASK>
dump_stack_lvl+0xbb/0xd0
dump_stack+0x14/0x20
lockdep_rcu_suspicious+0x15a/0x1b0
__might_resched+0x375/0x4d0
? put_object.part.0+0x2c/0x50
__might_sleep+0x108/0x160
vfree+0x58/0x910
? ext4_group_desc_free+0x27/0x270
kvfree+0x23/0x40
ext4_group_desc_free+0x111/0x270
ext4_put_super+0x3c8/0xd40
generic_shutdown_super+0x14c/0x4a0
? __pfx_shrinker_free+0x10/0x10
kill_block_super+0x40/0x90
ext4_kill_sb+0x6d/0xb0
deactivate_locked_super+0xb4/0x180
deactivate_super+0x7e/0xa0
cleanup_mnt+0x296/0x3e0
__cleanup_mnt+0x16/0x20
task_work_run+0x157/0x250
? __pfx_task_work_run+0x10/0x10
? exit_to_user_mode_loop+0x6a/0x550
exit_to_user_mode_loop+0x102/0x550
do_syscall_64+0x44a/0x500
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
BUG: sleeping function called from invalid context at mm/vmalloc.c:3441
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount
preempt_count: 1, expected: 0
CPU: 3 UID: 0 PID: 556 Comm: umount
Call Trace:
<TASK>
dump_stack_lvl+0xbb/0xd0
dump_stack+0x14/0x20
__might_resched+0x275/0x4d0
? put_object.part.0+0x2c/0x50
__might_sleep+0x108/0x160
vfree+0x58/0x910
? ext4_group_desc_free+0x27/0x270
kvfree+0x23/0x40
ext4_group_desc_free+0x111/0x270
ext4_put_super+0x3c8/0xd40
generic_shutdown_super+0x14c/0x4a0
? __pfx_shrinker_free+0x10/0x10
kill_block_super+0x40/0x90
ext4_kill_sb+0x6d/0xb0
deactivate_locked_super+0xb4/0x180
deactivate_super+0x7e/0xa0
cleanup_mnt+0x296/0x3e0
__cleanup_mnt+0x16/0x20
task_work_run+0x157/0x250
? __pfx_task_work_run+0x10/0x10
? exit_to_user_mode_loop+0x6a/0x550
exit_to_user_mode_loop+0x102/0x550
do_syscall_64+0x44a/0x500
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The above scenarios occur in initialization failures and teardown
paths, there are no parallel operations on the resources released
by kvfree(), this commit therefore remove rcu_read_lock/unlock() and
use rcu_access_pointer() instead of rcu_dereference() operations.
Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access")
Fixes: df3da4ea5a0f ("ext4: fix potential race between s_group_info online resizing and access")
Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260319094545.19291-1-qiang.zhang@linux.dev
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
[ adapted inline rcu_read_lock/rcu_dereference/rcu_read_unlock removal ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 10 +++-------
fs/ext4/super.c | 6 ++----
2 files changed, 5 insertions(+), 11 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2894,9 +2894,7 @@ err_freebuddy:
rcu_read_unlock();
iput(sbi->s_buddy_cache);
err_freesgi:
- rcu_read_lock();
- kvfree(rcu_dereference(sbi->s_group_info));
- rcu_read_unlock();
+ kvfree(rcu_access_pointer(sbi->s_group_info));
return -ENOMEM;
}
@@ -3088,7 +3086,8 @@ int ext4_mb_release(struct super_block *
struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
int count;
- if (sbi->s_group_info) {
+ group_info = rcu_access_pointer(sbi->s_group_info);
+ if (group_info) {
for (i = 0; i < ngroups; i++) {
cond_resched();
grinfo = ext4_get_group_info(sb, i);
@@ -3106,12 +3105,9 @@ int ext4_mb_release(struct super_block *
num_meta_group_infos = (ngroups +
EXT4_DESC_PER_BLOCK(sb) - 1) >>
EXT4_DESC_PER_BLOCK_BITS(sb);
- rcu_read_lock();
- group_info = rcu_dereference(sbi->s_group_info);
for (i = 0; i < num_meta_group_infos; i++)
kfree(group_info[i]);
kvfree(group_info);
- rcu_read_unlock();
}
kfree(sbi->s_mb_offsets);
kfree(sbi->s_mb_maxs);
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1207,18 +1207,16 @@ static void ext4_put_super(struct super_
if (!sb_rdonly(sb))
ext4_commit_super(sb, 1);
- rcu_read_lock();
- group_desc = rcu_dereference(sbi->s_group_desc);
+ group_desc = rcu_access_pointer(sbi->s_group_desc);
for (i = 0; i < sbi->s_gdb_count; i++)
brelse(group_desc[i]);
kvfree(group_desc);
- flex_groups = rcu_dereference(sbi->s_flex_groups);
+ flex_groups = rcu_access_pointer(sbi->s_flex_groups);
if (flex_groups) {
for (i = 0; i < sbi->s_flex_groups_allocated; i++)
kvfree(flex_groups[i]);
kvfree(flex_groups);
}
- rcu_read_unlock();
percpu_counter_destroy(&sbi->s_freeclusters_counter);
percpu_counter_destroy(&sbi->s_freeinodes_counter);
percpu_counter_destroy(&sbi->s_dirs_counter);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 467/491] xfs: save ailp before dropping the AIL lock in push callbacks
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 466/491] ext4: fix the might_sleep() warnings in kvfree() Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 468/491] xfs: stop reclaim before pushing AIL during unmount Greg Kroah-Hartman
` (28 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+652af2b3c5569c4ab63c,
Darrick J. Wong, Dave Chinner, Yuto Ohnuki, Carlos Maiolino,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuto Ohnuki <ytohnuki@amazon.com>
[ Upstream commit 394d70b86fae9fe865e7e6d9540b7696f73aa9b6 ]
In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock
is dropped to perform buffer IO. Once the cluster buffer no longer
protects the log item from reclaim, the log item may be freed by
background reclaim or the dquot shrinker. The subsequent spin_lock()
call dereferences lip->li_ailp, which is a use-after-free.
Fix this by saving the ailp pointer in a local variable while the AIL
lock is held and the log item is guaranteed to be valid.
Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary")
Cc: stable@vger.kernel.org # v5.9
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_dquot_item.c | 9 +++++++--
fs/xfs/xfs_inode_item.c | 9 +++++++--
2 files changed, 14 insertions(+), 4 deletions(-)
--- a/fs/xfs/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
@@ -124,6 +124,7 @@ xfs_qm_dquot_logitem_push(
{
struct xfs_dquot *dqp = DQUOT_ITEM(lip)->qli_dquot;
struct xfs_buf *bp = lip->li_buf;
+ struct xfs_ail *ailp = lip->li_ailp;
uint rval = XFS_ITEM_SUCCESS;
int error;
@@ -152,7 +153,7 @@ xfs_qm_dquot_logitem_push(
goto out_unlock;
}
- spin_unlock(&lip->li_ailp->ail_lock);
+ spin_unlock(&ailp->ail_lock);
error = xfs_qm_dqflush(dqp, &bp);
if (!error) {
@@ -162,7 +163,11 @@ xfs_qm_dquot_logitem_push(
} else if (error == -EAGAIN)
rval = XFS_ITEM_LOCKED;
- spin_lock(&lip->li_ailp->ail_lock);
+ /*
+ * The buffer no longer protects the log item from reclaim, so
+ * do not reference lip after this point.
+ */
+ spin_lock(&ailp->ail_lock);
out_unlock:
xfs_dqunlock(dqp);
return rval;
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -514,6 +514,7 @@ xfs_inode_item_push(
struct xfs_inode_log_item *iip = INODE_ITEM(lip);
struct xfs_inode *ip = iip->ili_inode;
struct xfs_buf *bp = lip->li_buf;
+ struct xfs_ail *ailp = lip->li_ailp;
uint rval = XFS_ITEM_SUCCESS;
int error;
@@ -529,7 +530,7 @@ xfs_inode_item_push(
if (!xfs_buf_trylock(bp))
return XFS_ITEM_LOCKED;
- spin_unlock(&lip->li_ailp->ail_lock);
+ spin_unlock(&ailp->ail_lock);
/*
* We need to hold a reference for flushing the cluster buffer as it may
@@ -553,7 +554,11 @@ xfs_inode_item_push(
rval = XFS_ITEM_LOCKED;
}
- spin_lock(&lip->li_ailp->ail_lock);
+ /*
+ * The buffer no longer protects the log item from reclaim, so
+ * do not reference lip after this point.
+ */
+ spin_lock(&ailp->ail_lock);
return rval;
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 468/491] xfs: stop reclaim before pushing AIL during unmount
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 467/491] xfs: save ailp before dropping the AIL lock in push callbacks Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 469/491] ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Greg Kroah-Hartman
` (27 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+652af2b3c5569c4ab63c,
Yuto Ohnuki, Darrick J. Wong, Carlos Maiolino, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuto Ohnuki <ytohnuki@amazon.com>
[ Upstream commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 ]
The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while
background reclaim and inodegc are still running. This is broken
independently of any use-after-free issues - background reclaim and
inodegc should not be running while the AIL is being pushed during
unmount, as inodegc can dirty and insert inodes into the AIL during the
flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background
reclaim before pushing the AIL. Stop inodegc before cancelling
m_reclaim_work because the inodegc worker can re-queue m_reclaim_work
via xfs_inodegc_set_reclaimable.
Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary")
Cc: stable@vger.kernel.org # v5.9
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ dropped xfs_inodegc_stop() call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_mount.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -652,8 +652,9 @@ xfs_check_summary_counts(
* have been retrying in the background. This will prevent never-ending
* retries in AIL pushing from hanging the unmount.
*
- * Finally, we can push the AIL to clean all the remaining dirty objects, then
- * reclaim the remaining inodes that are still in memory at this point in time.
+ * Stop inodegc and background reclaim before pushing the AIL so that they
+ * are not running while the AIL is being flushed. Then push the AIL to
+ * clean all the remaining dirty objects and reclaim the remaining inodes.
*/
static void
xfs_unmount_flush_inodes(
@@ -665,8 +666,8 @@ xfs_unmount_flush_inodes(
mp->m_flags |= XFS_MOUNT_UNMOUNTING;
- xfs_ail_push_all_sync(mp->m_ail);
cancel_delayed_work_sync(&mp->m_reclaim_work);
+ xfs_ail_push_all_sync(mp->m_ail);
xfs_reclaim_inodes(mp);
xfs_health_unmount(mp);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 469/491] ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 468/491] xfs: stop reclaim before pushing AIL during unmount Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 470/491] ext4: publish jinode after initialization Greg Kroah-Hartman
` (26 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Baokun Li, Zhang Yi,
Jan Kara, Theodore Tso, stable, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
[ Upstream commit ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 ]
During code review, Joseph found that ext4_fc_replay_inode() calls
ext4_get_fc_inode_loc() to get the inode location, which holds a
reference to iloc.bh that must be released via brelse().
However, several error paths jump to the 'out' label without
releasing iloc.bh:
- ext4_handle_dirty_metadata() failure
- sync_dirty_buffer() failure
- ext4_mark_inode_used() failure
- ext4_iget() failure
Fix this by introducing an 'out_brelse' label placed just before
the existing 'out' label to ensure iloc.bh is always released.
Additionally, make ext4_fc_replay_inode() propagate errors
properly instead of always returning 0.
Reported-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260323060836.3452660-1-libaokun@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/fast_commit.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -1480,19 +1480,21 @@ static int ext4_fc_replay_inode(struct s
/* Immediately update the inode on disk. */
ret = ext4_handle_dirty_metadata(NULL, NULL, iloc.bh);
if (ret)
- goto out;
+ goto out_brelse;
ret = sync_dirty_buffer(iloc.bh);
if (ret)
- goto out;
+ goto out_brelse;
ret = ext4_mark_inode_used(sb, ino);
if (ret)
- goto out;
+ goto out_brelse;
/* Given that we just wrote the inode on disk, this SHOULD succeed. */
inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
if (IS_ERR(inode)) {
jbd_debug(1, "Inode not found.");
- return -EFSCORRUPTED;
+ inode = NULL;
+ ret = -EFSCORRUPTED;
+ goto out_brelse;
}
/*
@@ -1508,13 +1510,14 @@ static int ext4_fc_replay_inode(struct s
ext4_inode_csum_set(inode, ext4_raw_inode(&iloc), EXT4_I(inode));
ret = ext4_handle_dirty_metadata(NULL, NULL, iloc.bh);
sync_dirty_buffer(iloc.bh);
+out_brelse:
brelse(iloc.bh);
out:
iput(inode);
if (!ret)
blkdev_issue_flush(sb->s_bdev, GFP_KERNEL);
- return 0;
+ return ret;
}
/*
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 470/491] ext4: publish jinode after initialization
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 469/491] ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 471/491] Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Greg Kroah-Hartman
` (25 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Chen, Jan Kara, Theodore Tso,
stable, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Chen <me@linux.beauty>
[ Upstream commit 1aec30021edd410b986c156f195f3d23959a9d11 ]
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
RIP: 0010:xas_find_marked+0x3d/0x2e0
Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
filemap_get_folios_tag+0x87/0x2a0
__filemap_fdatawait_range+0x5f/0xd0
? srso_alias_return_thunk+0x5/0xfbef5
? __schedule+0x3e7/0x10c0
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? cap_safe_nice+0x37/0x70
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
filemap_fdatawait_range_keep_errors+0x12/0x40
ext4_fc_commit+0x697/0x8b0
? ext4_file_write_iter+0x64b/0x950
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_write+0x356/0x480
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
ext4_sync_file+0xf7/0x370
do_fsync+0x3b/0x80
? syscall_trace_enter+0x108/0x1d0
__x64_sys_fdatasync+0x16/0x20
do_syscall_64+0x62/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
```
Fix this by initializing the jbd2_inode first.
Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after
initialization. Readers use READ_ONCE() to fetch the pointer.
Fixes: a361293f5fede ("jbd2: Fix oops in jbd2_journal_file_inode()")
Cc: stable@vger.kernel.org
Signed-off-by: Li Chen <me@linux.beauty>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260225082617.147957-1-me@linux.beauty
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
[ adapted READ_ONCE(jinode) wrapping to split ext4_fc_submit_inode_data_all() and ext4_fc_wait_inode_data_all() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/fast_commit.c | 4 ++--
fs/ext4/inode.c | 15 +++++++++++----
2 files changed, 13 insertions(+), 6 deletions(-)
--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -902,7 +902,7 @@ static int ext4_fc_submit_inode_data_all
finish_wait(&ei->i_fc_wait, &wait);
}
spin_unlock(&sbi->s_fc_lock);
- ret = jbd2_submit_inode_data(ei->jinode);
+ ret = jbd2_submit_inode_data(READ_ONCE(ei->jinode));
if (ret)
return ret;
spin_lock(&sbi->s_fc_lock);
@@ -927,7 +927,7 @@ static int ext4_fc_wait_inode_data_all(j
continue;
spin_unlock(&sbi->s_fc_lock);
- ret = jbd2_wait_inode_data(journal, pos->jinode);
+ ret = jbd2_wait_inode_data(journal, READ_ONCE(pos->jinode));
if (ret)
return ret;
spin_lock(&sbi->s_fc_lock);
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -121,6 +121,8 @@ void ext4_inode_csum_set(struct inode *i
static inline int ext4_begin_ordered_truncate(struct inode *inode,
loff_t new_size)
{
+ struct jbd2_inode *jinode = READ_ONCE(EXT4_I(inode)->jinode);
+
trace_ext4_begin_ordered_truncate(inode, new_size);
/*
* If jinode is zero, then we never opened the file for
@@ -128,10 +130,10 @@ static inline int ext4_begin_ordered_tru
* jbd2_journal_begin_ordered_truncate() since there's no
* outstanding writes we need to flush.
*/
- if (!EXT4_I(inode)->jinode)
+ if (!jinode)
return 0;
return jbd2_journal_begin_ordered_truncate(EXT4_JOURNAL(inode),
- EXT4_I(inode)->jinode,
+ jinode,
new_size);
}
@@ -4231,8 +4233,13 @@ int ext4_inode_attach_jinode(struct inod
spin_unlock(&inode->i_lock);
return -ENOMEM;
}
- ei->jinode = jinode;
- jbd2_journal_init_jbd_inode(ei->jinode, inode);
+ jbd2_journal_init_jbd_inode(jinode, inode);
+ /*
+ * Publish ->jinode only after it is fully initialized so that
+ * readers never observe a partially initialized jbd2_inode.
+ */
+ smp_wmb();
+ WRITE_ONCE(ei->jinode, jinode);
jinode = NULL;
}
spin_unlock(&inode->i_lock);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 471/491] Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 470/491] ext4: publish jinode after initialization Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Greg Kroah-Hartman
` (24 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 5b3e2052334f2ff6d5200e952f4aa66994d09899 ]
Currently the code attempts to accept requests regardless of the
command identifier which may cause multiple requests to be marked
as pending (FLAG_DEFER_SETUP) which can cause more than
L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer
causing an overflow.
The spec is quite clear that the same identifier shall not be used on
subsequent requests:
'Within each signaling channel a different Identifier shall be used
for each successive request or indication.'
https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d
So this attempts to check if there are any channels pending with the
same identifier and rejects if any are found.
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ adapted variable names ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6053,7 +6053,7 @@ static inline int l2cap_ecred_conn_req(s
u16 mtu, mps;
__le16 psm;
u8 result, len = 0;
- int i, num_scid;
+ int i, num_scid = 0;
bool defer = false;
if (!enable_ecred)
@@ -6063,6 +6063,14 @@ static inline int l2cap_ecred_conn_req(s
result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
}
+
+ /* Check if there are no pending channels with the same ident */
+ __l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer,
+ &num_scid);
+ if (num_scid) {
+ result = L2CAP_CR_LE_INVALID_PARAMS;
+ goto response;
+ }
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 471/491] Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 20:49 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 473/491] mmc: core: Drop redundant member in struct mmc host Greg Kroah-Hartman
` (23 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Hellström,
Maarten Lankhorst, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <dev@lankhorst.se>
[ Upstream commit 6bee098b91417654703e17eb5c1822c6dfd0c01d ]
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
....
[ 739.713328] Call Trace:
[ 739.713330] <TASK>
[ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
[ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
[ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
[ 739.714284] devm_action_release+0xf/0x20
[ 739.714294] devres_release_all+0xad/0xf0
[ 739.714301] device_unbind_cleanup+0x12/0xa0
[ 739.714305] device_release_driver_internal+0x1b7/0x210
[ 739.714311] device_driver_detach+0x14/0x20
[ 739.714315] unbind_store+0xa6/0xb0
[ 739.714319] drv_attr_store+0x21/0x30
[ 739.714322] sysfs_kf_write+0x48/0x60
[ 739.714328] kernfs_fop_write_iter+0x16b/0x240
[ 739.714333] vfs_write+0x266/0x520
[ 739.714341] ksys_write+0x72/0xe0
[ 739.714345] __x64_sys_write+0x19/0x20
[ 739.714347] x64_sys_call+0xa15/0xa30
[ 739.714355] do_syscall_64+0xd8/0xab0
[ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and
[ 739.714459] ------------[ cut here ]------------
[ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head))
[ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
[ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
...
[ 739.714869] Call Trace:
[ 739.714871] <TASK>
[ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
[ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
[ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
[ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
[ 739.715821] devm_action_release+0xf/0x20
[ 739.715828] devres_release_all+0xad/0xf0
[ 739.715843] device_unbind_cleanup+0x12/0xa0
[ 739.715850] device_release_driver_internal+0x1b7/0x210
[ 739.715856] device_driver_detach+0x14/0x20
[ 739.715860] unbind_store+0xa6/0xb0
[ 739.715865] drv_attr_store+0x21/0x30
[ 739.715868] sysfs_kf_write+0x48/0x60
[ 739.715873] kernfs_fop_write_iter+0x16b/0x240
[ 739.715878] vfs_write+0x266/0x520
[ 739.715886] ksys_write+0x72/0xe0
[ 739.715890] __x64_sys_write+0x19/0x20
[ 739.715893] x64_sys_call+0xa15/0xa30
[ 739.715900] do_syscall_64+0xd8/0xab0
[ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and then finally file close blows up:
[ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP
[ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
[ 743.186537] Tainted: [W]=WARN
[ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
[ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42
[ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
[ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03
[ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08
[ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000
[ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00
[ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0
[ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000
[ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0
[ 743.186597] Call Trace:
[ 743.186598] <TASK>
[ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
[ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
[ 743.186750] ? trace_hardirqs_on+0x5f/0x120
[ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
[ 743.186786] drm_fb_release+0x105/0x190 [drm]
[ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
[ 743.186817] ? rt_spin_lock+0xea/0x1b0
[ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
[ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
[ 743.186865] __fput+0x100/0x2e0
[ 743.186869] fput_close_sync+0x40/0xa0
[ 743.186870] __x64_sys_close+0x3e/0x80
[ 743.186873] x64_sys_call+0xa07/0xa30
[ 743.186879] do_syscall_64+0xd8/0xab0
[ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 743.186882] RIP: 0033:0x7ff37e567732
[ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732
[ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000
[ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0
[ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30
[ 743.186892] </TASK>
[ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 743.186938] ---[ end trace 0000000000000000 ]---
And for property blobs:
void drm_mode_config_cleanup(struct drm_device *dev)
{
...
list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
head_global) {
drm_property_blob_put(blob);
}
Resulting in:
[ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff
[ 371.072944] #PF: supervisor read access in kernel mode
[ 371.072945] #PF: error_code(0x0000) - not-present page
[ 371.072947] PGD 0 P4D 0
[ 371.072950] Oops: Oops: 0000 [#1] SMP
[ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
[ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm]
[ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70
[ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
[ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0
[ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000
[ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000
[ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7
[ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970
[ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000
[ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0
[ 371.073031] Call Trace:
[ 371.073033] <TASK>
[ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
[ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
[ 371.073113] __fput+0xe2/0x2b0
[ 371.073118] fput_close_sync+0x40/0xa0
[ 371.073119] __x64_sys_close+0x3e/0x80
[ 371.073122] x64_sys_call+0xa07/0xa30
[ 371.073126] do_syscall_64+0xc0/0x840
[ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 371.073132] RIP: 0033:0x7f1fb3501732
[ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732
[ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000
[ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0
[ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30
[ 371.073143] </TASK>
[ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 371.073198] CR2: 000001ffffffffff
[ 371.073199] ---[ end trace 0000000000000000 ]---
Add a guard around file close, and ensure the warnings from drm_mode_config
do not trigger. Fix those by allowing an open reference to the file descriptor
and cleaning up the file linked list entry in drm_mode_config_cleanup().
Cc: <stable@vger.kernel.org> # v4.18+
Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/20260313151728.14990-4-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
[ adapted drm_dbg_printer(dev, DRM_UT_KMS, ...) call to older drm_debug_printer(...) API ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_file.c | 5 ++++-
drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -248,6 +248,7 @@ static void drm_events_release(struct dr
void drm_file_free(struct drm_file *file)
{
struct drm_device *dev;
+ int idx;
if (!file)
return;
@@ -271,9 +272,11 @@ void drm_file_free(struct drm_file *file
drm_events_release(file);
- if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ if (drm_core_check_feature(dev, DRIVER_MODESET) &&
+ drm_dev_enter(dev, &idx)) {
drm_fb_release(file);
drm_property_destroy_user_blobs(dev, file);
+ drm_dev_exit(idx);
}
if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -543,10 +543,13 @@ void drm_mode_config_cleanup(struct drm_
*/
WARN_ON(!list_empty(&dev->mode_config.fb_list));
list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
- struct drm_printer p = drm_debug_printer("[leaked fb]");
+ if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
+ struct drm_printer p = drm_debug_printer("[leaked fb]");
- drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
- drm_framebuffer_print_info(&p, 1, fb);
+ drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
+ drm_framebuffer_print_info(&p, 1, fb);
+ }
+ list_del_init(&fb->filp_head);
drm_framebuffer_free(&fb->base.refcount);
}
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 473/491] mmc: core: Drop redundant member in struct mmc host
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Greg Kroah-Hartman
` (22 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit 951f6ccfcbb7e4a18bf5fef1fb373d21e5831957 ]
The Kconfig option to use the blk-mq support was removed in commit
1bec43a3b181 ("mmc: core: Remove option not to use blk-mq"), but forgot to
remove the use_blk_mq member in the struct mmc_host, let's fix it.
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20210202101924.69970-1-ulf.hansson@linaro.org
Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmc/host.h | 1 -
1 file changed, 1 deletion(-)
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -409,7 +409,6 @@ struct mmc_host {
unsigned int doing_retune:1; /* re-tuning in progress */
unsigned int retune_now:1; /* do re-tuning at next req */
unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
- unsigned int use_blk_mq:1; /* use blk-mq */
unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
unsigned int can_dma_map_merge:1; /* merging can be used */
unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 473/491] mmc: core: Drop redundant member in struct mmc host Greg Kroah-Hartman
@ 2026-04-13 16:01 ` Greg Kroah-Hartman
2026-04-13 21:10 ` Ben Hutchings
2026-04-13 16:02 ` [PATCH 5.10 475/491] mmc: core: Drop reference counting of the bus_ops Greg Kroah-Hartman
` (21 subsequent siblings)
495 siblings, 1 reply; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Adrian Hunter,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit fefdd3c91e0a7b3cbb3f25925d93a57c45cb0f31 ]
The mmc_hw|sw_reset() APIs are designed to be called solely from upper
layers, which means drivers that operates on top of the struct mmc_card,
like the mmc block device driver and an SDIO functional driver.
Additionally, as long as the struct mmc_host has a valid pointer to a
struct mmc_card, the corresponding host->bus_ops pointer stays valid and
assigned.
For these reasons, let's drop the superfluous reference counting and the
redundant validations in mmc_hw|sw_reset().
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210212131532.236775-1-ulf.hansson@linaro.org
Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/block.c | 2 +-
drivers/mmc/core/core.c | 21 +--------------------
2 files changed, 2 insertions(+), 21 deletions(-)
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -987,7 +987,7 @@ static int mmc_blk_reset(struct mmc_blk_
md->reset_done |= type;
err = mmc_hw_reset(host);
/* Ensure we switch back to the correct partition */
- if (err != -EOPNOTSUPP) {
+ if (err) {
struct mmc_blk_data *main_md =
dev_get_drvdata(&host->card->dev);
int part_err;
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2096,18 +2096,7 @@ int mmc_hw_reset(struct mmc_host *host)
{
int ret;
- if (!host->card)
- return -EINVAL;
-
- mmc_bus_get(host);
- if (!host->bus_ops || host->bus_dead || !host->bus_ops->hw_reset) {
- mmc_bus_put(host);
- return -EOPNOTSUPP;
- }
-
ret = host->bus_ops->hw_reset(host);
- mmc_bus_put(host);
-
if (ret < 0)
pr_warn("%s: tried to HW reset card, got error %d\n",
mmc_hostname(host), ret);
@@ -2120,18 +2109,10 @@ int mmc_sw_reset(struct mmc_host *host)
{
int ret;
- if (!host->card)
- return -EINVAL;
-
- mmc_bus_get(host);
- if (!host->bus_ops || host->bus_dead || !host->bus_ops->sw_reset) {
- mmc_bus_put(host);
+ if (!host->bus_ops->sw_reset)
return -EOPNOTSUPP;
- }
ret = host->bus_ops->sw_reset(host);
- mmc_bus_put(host);
-
if (ret)
pr_warn("%s: tried to SW reset card, got error %d\n",
mmc_hostname(host), ret);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 475/491] mmc: core: Drop reference counting of the bus_ops
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-04-13 16:01 ` [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 476/491] mmc: core: Avoid bitfield RMW for claim/retune flags Greg Kroah-Hartman
` (20 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre Ossman, Russell King,
Ulf Hansson, Adrian Hunter, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit e9ce2ce17da626d930812199568bd426b2832f57 ]
When the mmc_rescan work is enabled for execution (host->rescan_disable),
it's the only instance per mmc host that is allowed to set/clear the
host->bus_ops pointer.
Besides the mmc_rescan work, there are a couple of scenarios when the
host->bus_ops pointer may be accessed. Typically, those can be described as
as below:
*)
Upper mmc driver layers (like the mmc block device driver or an SDIO
functional driver) needs to execute a host->bus_ops callback. This can be
considered as safe without having to use some special locking mechanism,
because they operate on top of the struct mmc_card. As long as there is a
card to operate upon, the mmc core guarantees that there is a host->bus_ops
assigned as well. Note that, upper layer mmc drivers are of course
responsible to clean up from themselves from their ->remove() callbacks,
otherwise things would fall apart anyways.
**)
Via the mmc host instance, we may need to force a removal of an inserted
mmc card. This happens when a mmc host driver gets unbind, for example. In
this case, we protect the host->bus_ops pointer from concurrent accesses,
by disabling the mmc_rescan work upfront (host->rescan_disable). See
mmc_stop_host() for example.
This said, it seems like the reference counting of the host->bus_ops
pointer at some point have become superfluous. As this is an old mechanism
of the mmc core, it a bit difficult to digest the history of when that
could have happened. However, let's drop the reference counting to avoid
unnecessary code-paths and lockings.
Cc: Pierre Ossman <pierre@ossman.eu>
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210212131610.236843-1-ulf.hansson@linaro.org
Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/core.c | 89 ++---------------------------------------------
include/linux/mmc/host.h | 2 -
2 files changed, 4 insertions(+), 87 deletions(-)
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1389,62 +1389,12 @@ void mmc_power_cycle(struct mmc_host *ho
}
/*
- * Cleanup when the last reference to the bus operator is dropped.
- */
-static void __mmc_release_bus(struct mmc_host *host)
-{
- WARN_ON(!host->bus_dead);
-
- host->bus_ops = NULL;
-}
-
-/*
- * Increase reference count of bus operator
- */
-static inline void mmc_bus_get(struct mmc_host *host)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&host->lock, flags);
- host->bus_refs++;
- spin_unlock_irqrestore(&host->lock, flags);
-}
-
-/*
- * Decrease reference count of bus operator and free it if
- * it is the last reference.
- */
-static inline void mmc_bus_put(struct mmc_host *host)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&host->lock, flags);
- host->bus_refs--;
- if ((host->bus_refs == 0) && host->bus_ops)
- __mmc_release_bus(host);
- spin_unlock_irqrestore(&host->lock, flags);
-}
-
-/*
* Assign a mmc bus handler to a host. Only one bus handler may control a
* host at any given time.
*/
void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops)
{
- unsigned long flags;
-
- WARN_ON(!host->claimed);
-
- spin_lock_irqsave(&host->lock, flags);
-
- WARN_ON(host->bus_ops);
- WARN_ON(host->bus_refs);
-
host->bus_ops = ops;
- host->bus_refs = 1;
- host->bus_dead = 0;
-
- spin_unlock_irqrestore(&host->lock, flags);
}
/*
@@ -1452,18 +1402,7 @@ void mmc_attach_bus(struct mmc_host *hos
*/
void mmc_detach_bus(struct mmc_host *host)
{
- unsigned long flags;
-
- WARN_ON(!host->claimed);
- WARN_ON(!host->bus_ops);
-
- spin_lock_irqsave(&host->lock, flags);
-
- host->bus_dead = 1;
-
- spin_unlock_irqrestore(&host->lock, flags);
-
- mmc_bus_put(host);
+ host->bus_ops = NULL;
}
void _mmc_detect_change(struct mmc_host *host, unsigned long delay, bool cd_irq)
@@ -2260,32 +2199,15 @@ void mmc_rescan(struct work_struct *work
host->trigger_card_event = false;
}
- mmc_bus_get(host);
-
/* Verify a registered card to be functional, else remove it. */
- if (host->bus_ops && !host->bus_dead)
+ if (host->bus_ops)
host->bus_ops->detect(host);
host->detect_change = 0;
- /*
- * Let mmc_bus_put() free the bus/bus_ops if we've found that
- * the card is no longer present.
- */
- mmc_bus_put(host);
- mmc_bus_get(host);
-
/* if there still is a card present, stop here */
- if (host->bus_ops != NULL) {
- mmc_bus_put(host);
+ if (host->bus_ops != NULL)
goto out;
- }
-
- /*
- * Only we can add a new handler, so it's safe to
- * release the lock here.
- */
- mmc_bus_put(host);
mmc_claim_host(host);
if (mmc_card_is_removable(host) && host->ops->get_cd &&
@@ -2356,18 +2278,15 @@ void mmc_stop_host(struct mmc_host *host
/* clear pm flags now and let card drivers set them as needed */
host->pm_flags = 0;
- mmc_bus_get(host);
- if (host->bus_ops && !host->bus_dead) {
+ if (host->bus_ops) {
/* Calling bus_ops->remove() with a claimed host can deadlock */
host->bus_ops->remove(host);
mmc_claim_host(host);
mmc_detach_bus(host);
mmc_power_off(host);
mmc_release_host(host);
- mmc_bus_put(host);
return;
}
- mmc_bus_put(host);
mmc_claim_host(host);
mmc_power_off(host);
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -403,7 +403,6 @@ struct mmc_host {
/* group bitfields together to minimize padding */
unsigned int use_spi_crc:1;
unsigned int claimed:1; /* host exclusively claimed */
- unsigned int bus_dead:1; /* bus has been released */
unsigned int doing_init_tune:1; /* initial tuning in progress */
unsigned int can_retune:1; /* re-tuning can be used */
unsigned int doing_retune:1; /* re-tuning in progress */
@@ -435,7 +434,6 @@ struct mmc_host {
struct mmc_slot slot;
const struct mmc_bus_ops *bus_ops; /* current bus driver */
- unsigned int bus_refs; /* reference counter */
unsigned int sdio_irqs;
struct task_struct *sdio_irq_thread;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 476/491] mmc: core: Avoid bitfield RMW for claim/retune flags
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 475/491] mmc: core: Drop reference counting of the bus_ops Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 477/491] Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Greg Kroah-Hartman
` (19 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Penghe Geng,
Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Penghe Geng <pgeng@nvidia.com>
[ Upstream commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 ]
Move claimed and retune control flags out of the bitfield word to
avoid unrelated RMW side effects in asynchronous contexts.
The host->claimed bit shared a word with retune flags. Writes to claimed
in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite
other bits when concurrent updates happen in other contexts, triggering
spurious WARN_ON(!host->claimed). Convert claimed, can_retune,
retune_now and retune_paused to bool to remove shared-word coupling.
Fixes: 6c0cedd1ef952 ("mmc: core: Introduce host claiming by context")
Fixes: 1e8e55b67030c ("mmc: block: Add CQE support")
Cc: stable@vger.kernel.org
Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Penghe Geng <pgeng@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmc/host.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -400,14 +400,12 @@ struct mmc_host {
struct mmc_ios ios; /* current io bus settings */
+ bool claimed; /* host exclusively claimed */
+
/* group bitfields together to minimize padding */
unsigned int use_spi_crc:1;
- unsigned int claimed:1; /* host exclusively claimed */
unsigned int doing_init_tune:1; /* initial tuning in progress */
- unsigned int can_retune:1; /* re-tuning can be used */
unsigned int doing_retune:1; /* re-tuning in progress */
- unsigned int retune_now:1; /* do re-tuning at next req */
- unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
unsigned int can_dma_map_merge:1; /* merging can be used */
unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
@@ -415,6 +413,9 @@ struct mmc_host {
int rescan_disable; /* disable card detection */
int rescan_entered; /* used with nonremovable devices */
+ bool can_retune; /* re-tuning can be used */
+ bool retune_now; /* do re-tuning at next req */
+ bool retune_paused; /* re-tuning is temporarily disabled */
int need_retune; /* re-tuning is needed */
int hold_retune; /* hold off re-tuning */
unsigned int retune_period; /* re-tuning period in secs */
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 477/491] Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 476/491] mmc: core: Avoid bitfield RMW for claim/retune flags Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 478/491] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
` (18 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jaskaran Singh
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaskaran Singh <jsingh@cloudlinux.com>
This reverts commit 3d78e8e01251da032a5f7cbc9728e4ab1a5a5464.
The backport of upstream commit 0a2c5495b6d1 was incorrectly applied.
The cancel_work_sync() call for ->ioerr_work was added to
nvme_fc_reset_ctrl_work() instead of nvme_fc_delete_ctrl().
Revert this commit so the correct fix can be applied.
Signed-off-by: Jaskaran Singh <jsingh@cloudlinux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3259,6 +3259,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc
{
struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
+ cancel_work_sync(&ctrl->ioerr_work);
cancel_delayed_work_sync(&ctrl->connect_work);
/*
* kill the association on the link side. this will block
@@ -3322,7 +3323,6 @@ nvme_fc_reset_ctrl_work(struct work_stru
/* will block will waiting for io to terminate */
nvme_fc_delete_association(ctrl);
- cancel_work_sync(&ctrl->ioerr_work);
if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
dev_err(ctrl->ctrl.device,
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 478/491] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 477/491] Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 479/491] device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev() Greg Kroah-Hartman
` (17 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Patalano, Justin Tee,
Ewan D. Milne, Keith Busch, Jaskaran Singh
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaskaran Singh <jsingh@cloudlinux.com>
commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 upstream.
nvme_fc_delete_assocation() waits for pending I/O to complete before
returning, and an error can cause ->ioerr_work to be queued after
cancel_work_sync() had been called. Move the call to cancel_work_sync() to
be after nvme_fc_delete_association() to ensure ->ioerr_work is not running
when the nvme_fc_ctrl object is freed. Otherwise the following can occur:
[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL
[ 1135.917705] ------------[ cut here ]------------
[ 1135.922336] kernel BUG at lib/list_debug.c:52!
[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)
[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025
[ 1135.950969] Workqueue: 0x0 (nvme-wq)
[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b
[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046
[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000
[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0
[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08
[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100
[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0
[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000
[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0
[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1136.055910] PKRU: 55555554
[ 1136.058623] Call Trace:
[ 1136.061074] <TASK>
[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.071898] ? move_linked_works+0x4a/0xa0
[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.081744] ? __die_body.cold+0x8/0x12
[ 1136.085584] ? die+0x2e/0x50
[ 1136.088469] ? do_trap+0xca/0x110
[ 1136.091789] ? do_error_trap+0x65/0x80
[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.101289] ? exc_invalid_op+0x50/0x70
[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20
[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.120806] move_linked_works+0x4a/0xa0
[ 1136.124733] worker_thread+0x216/0x3a0
[ 1136.128485] ? __pfx_worker_thread+0x10/0x10
[ 1136.132758] kthread+0xfa/0x240
[ 1136.135904] ? __pfx_kthread+0x10/0x10
[ 1136.139657] ret_from_fork+0x31/0x50
[ 1136.143236] ? __pfx_kthread+0x10/0x10
[ 1136.146988] ret_from_fork_asm+0x1a/0x30
[ 1136.150915] </TASK>
Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context")
Cc: stable@vger.kernel.org
Tested-by: Marco Patalano <mpatalan@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jaskaran Singh <jsingh@cloudlinux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3259,13 +3259,13 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc
{
struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
- cancel_work_sync(&ctrl->ioerr_work);
cancel_delayed_work_sync(&ctrl->connect_work);
/*
* kill the association on the link side. this will block
* waiting for io to terminate
*/
nvme_fc_delete_association(ctrl);
+ cancel_work_sync(&ctrl->ioerr_work);
}
static void
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 479/491] device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 478/491] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 480/491] media: device property: Return true in fwnode_device_is_available for NULL ops Greg Kroah-Hartman
` (16 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Saravana Kannan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravana Kannan <saravanak@google.com>
[ Upstream commit b5d3e2fbcb10957521af14c4256cd0e5f68b9234 ]
Add fwnode_is_ancestor_of() helper function to check if a fwnode is an
ancestor of another fwnode.
Add fwnode_get_next_parent_dev() helper function that take as input a
fwnode and finds the closest ancestor fwnode that has a corresponding
struct device and returns that struct device.
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20201121020232.908850-11-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++
include/linux/property.h | 3 ++
2 files changed, 55 insertions(+)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -615,6 +615,31 @@ struct fwnode_handle *fwnode_get_next_pa
EXPORT_SYMBOL_GPL(fwnode_get_next_parent);
/**
+ * fwnode_get_next_parent_dev - Find device of closest ancestor fwnode
+ * @fwnode: firmware node
+ *
+ * Given a firmware node (@fwnode), this function finds its closest ancestor
+ * firmware node that has a corresponding struct device and returns that struct
+ * device.
+ *
+ * The caller of this function is expected to call put_device() on the returned
+ * device when they are done.
+ */
+struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode)
+{
+ struct device *dev = NULL;
+
+ fwnode_handle_get(fwnode);
+ do {
+ fwnode = fwnode_get_next_parent(fwnode);
+ if (fwnode)
+ dev = get_dev_from_fwnode(fwnode);
+ } while (fwnode && !dev);
+ fwnode_handle_put(fwnode);
+ return dev;
+}
+
+/**
* fwnode_count_parents - Return the number of parents a node has
* @fwnode: The node the parents of which are to be counted
*
@@ -661,6 +686,33 @@ struct fwnode_handle *fwnode_get_nth_par
EXPORT_SYMBOL_GPL(fwnode_get_nth_parent);
/**
+ * fwnode_is_ancestor_of - Test if @test_ancestor is ancestor of @test_child
+ * @test_ancestor: Firmware which is tested for being an ancestor
+ * @test_child: Firmware which is tested for being the child
+ *
+ * A node is considered an ancestor of itself too.
+ *
+ * Returns true if @test_ancestor is an ancestor of @test_child.
+ * Otherwise, returns false.
+ */
+bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor,
+ struct fwnode_handle *test_child)
+{
+ if (!test_ancestor)
+ return false;
+
+ fwnode_handle_get(test_child);
+ while (test_child) {
+ if (test_child == test_ancestor) {
+ fwnode_handle_put(test_child);
+ return true;
+ }
+ test_child = fwnode_get_next_parent(test_child);
+ }
+ return false;
+}
+
+/**
* fwnode_get_next_child_node - Return the next child node handle for a node
* @fwnode: Firmware node to find the next child node for.
* @child: Handle to one of the node's child nodes or a %NULL handle.
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -85,9 +85,12 @@ const char *fwnode_get_name_prefix(const
struct fwnode_handle *fwnode_get_parent(const struct fwnode_handle *fwnode);
struct fwnode_handle *fwnode_get_next_parent(
struct fwnode_handle *fwnode);
+struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode);
unsigned int fwnode_count_parents(const struct fwnode_handle *fwn);
struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwn,
unsigned int depth);
+bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor,
+ struct fwnode_handle *test_child);
struct fwnode_handle *fwnode_get_next_child_node(
const struct fwnode_handle *fwnode, struct fwnode_handle *child);
struct fwnode_handle *fwnode_get_next_available_child_node(
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 480/491] media: device property: Return true in fwnode_device_is_available for NULL ops
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 479/491] device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 481/491] device property: Retrieve fwnode from of_node via accessor Greg Kroah-Hartman
` (15 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Andy Shevchenko,
Daniel Scally, Heikki Krogerus, Rafael J. Wysocki, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scally <djrscally@gmail.com>
[ Upstream commit 5273382d03763277aaf8c6a2d6088e2afaee0cf0 ]
Some types of fwnode_handle do not implement the device_is_available()
check, such as those created by software_nodes. There isn't really a
meaningful way to check for the availability of a device that doesn't
actually exist, so if the check isn't implemented just assume that the
"device" is present.
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Daniel Scally <djrscally@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -837,9 +837,15 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put);
/**
* fwnode_device_is_available - check if a device is available for use
* @fwnode: Pointer to the fwnode of the device.
+ *
+ * For fwnode node types that don't implement the .device_is_available()
+ * operation, this function returns true.
*/
bool fwnode_device_is_available(const struct fwnode_handle *fwnode)
{
+ if (!fwnode_has_op(fwnode, device_is_available))
+ return true;
+
return fwnode_call_bool_op(fwnode, device_is_available);
}
EXPORT_SYMBOL_GPL(fwnode_device_is_available);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 481/491] device property: Retrieve fwnode from of_node via accessor
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 480/491] media: device property: Return true in fwnode_device_is_available for NULL ops Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 482/491] device property: Unify access to of_node Greg Kroah-Hartman
` (14 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andy.shevchenko@gmail.com>
[ Upstream commit 3cd8015040d7537a6b88e26f36768a90d9247829 ]
OF provides a specific accessor to retrieve fwnode handle.
Use it instead of direct dereferencing.
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -21,7 +21,7 @@
struct fwnode_handle *dev_fwnode(const struct device *dev)
{
return IS_ENABLED(CONFIG_OF) && dev->of_node ?
- &dev->of_node->fwnode : dev->fwnode;
+ of_fwnode_handle(dev->of_node) : dev->fwnode;
}
EXPORT_SYMBOL_GPL(dev_fwnode);
@@ -763,7 +763,7 @@ struct fwnode_handle *device_get_next_ch
struct fwnode_handle *fwnode = NULL, *next;
if (dev->of_node)
- fwnode = &dev->of_node->fwnode;
+ fwnode = of_fwnode_handle(dev->of_node);
else if (adev)
fwnode = acpi_fwnode_handle(adev);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 482/491] device property: Unify access to of_node
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 481/491] device property: Retrieve fwnode from of_node via accessor Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 483/491] device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
` (13 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit fb38f314fbd173e2e9f9f0f2e720a5f4889562da ]
Historically we have a few variants how we access dev->fwnode
and dev->of_node. Some of the functions during development
gained different versions of the getters. Unify access to of_node
and as a side change slightly refactor ACPI specific branches.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 29 +++++++++++++----------------
include/linux/property.h | 2 +-
2 files changed, 14 insertions(+), 17 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -759,13 +759,8 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_availa
struct fwnode_handle *device_get_next_child_node(struct device *dev,
struct fwnode_handle *child)
{
- struct acpi_device *adev = ACPI_COMPANION(dev);
- struct fwnode_handle *fwnode = NULL, *next;
-
- if (dev->of_node)
- fwnode = of_fwnode_handle(dev->of_node);
- else if (adev)
- fwnode = acpi_fwnode_handle(adev);
+ const struct fwnode_handle *fwnode = dev_fwnode(dev);
+ struct fwnode_handle *next;
/* Try to find a child in primary fwnode */
next = fwnode_get_next_child_node(fwnode, child);
@@ -868,28 +863,31 @@ EXPORT_SYMBOL_GPL(device_get_child_node_
bool device_dma_supported(struct device *dev)
{
+ const struct fwnode_handle *fwnode = dev_fwnode(dev);
+
/* For DT, this is always supported.
* For ACPI, this depends on CCA, which
* is determined by the acpi_dma_supported().
*/
- if (IS_ENABLED(CONFIG_OF) && dev->of_node)
+ if (is_of_node(fwnode))
return true;
- return acpi_dma_supported(ACPI_COMPANION(dev));
+ return acpi_dma_supported(to_acpi_device_node(fwnode));
}
EXPORT_SYMBOL_GPL(device_dma_supported);
enum dev_dma_attr device_get_dma_attr(struct device *dev)
{
+ const struct fwnode_handle *fwnode = dev_fwnode(dev);
enum dev_dma_attr attr = DEV_DMA_NOT_SUPPORTED;
- if (IS_ENABLED(CONFIG_OF) && dev->of_node) {
- if (of_dma_is_coherent(dev->of_node))
+ if (is_of_node(fwnode)) {
+ if (of_dma_is_coherent(to_of_node(fwnode)))
attr = DEV_DMA_COHERENT;
else
attr = DEV_DMA_NON_COHERENT;
} else
- attr = acpi_get_dma_attr(ACPI_COMPANION(dev));
+ attr = acpi_get_dma_attr(to_acpi_device_node(fwnode));
return attr;
}
@@ -1007,14 +1005,13 @@ EXPORT_SYMBOL(device_get_mac_address);
* Returns Linux IRQ number on success. Other values are determined
* accordingly to acpi_/of_ irq_get() operation.
*/
-int fwnode_irq_get(struct fwnode_handle *fwnode, unsigned int index)
+int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index)
{
- struct device_node *of_node = to_of_node(fwnode);
struct resource res;
int ret;
- if (IS_ENABLED(CONFIG_OF) && of_node)
- return of_irq_get(of_node, index);
+ if (is_of_node(fwnode))
+ return of_irq_get(to_of_node(fwnode), index);
ret = acpi_irq_get(ACPI_HANDLE_FWNODE(fwnode), index, &res);
if (ret)
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -119,7 +119,7 @@ struct fwnode_handle *device_get_named_c
struct fwnode_handle *fwnode_handle_get(struct fwnode_handle *fwnode);
void fwnode_handle_put(struct fwnode_handle *fwnode);
-int fwnode_irq_get(struct fwnode_handle *fwnode, unsigned int index);
+int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index);
unsigned int device_get_child_node_count(struct device *dev);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 483/491] device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 482/491] device property: Unify access to of_node Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 484/491] device property: Check fwnode->secondary when finding properties Greg Kroah-Hartman
` (12 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Daniel Scally,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scally <djrscally@gmail.com>
[ Upstream commit b5b41ab6b0c1bb70fe37a0d193006c969e3b5909 ]
Sensor drivers often check for an endpoint to make sure that they're
connected to a consuming device like a CIO2 during .probe(). Some of
those endpoints might be in the form of software_nodes assigned as
a secondary to the device's fwnode_handle. Account for this possibility
in fwnode_graph_get_next_endpoint() to avoid having to do it in the
sensor drivers themselves.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Daniel Scally <djrscally@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1033,7 +1033,26 @@ struct fwnode_handle *
fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode,
struct fwnode_handle *prev)
{
- return fwnode_call_ptr_op(fwnode, graph_get_next_endpoint, prev);
+ const struct fwnode_handle *parent;
+ struct fwnode_handle *ep;
+
+ /*
+ * If this function is in a loop and the previous iteration returned
+ * an endpoint from fwnode->secondary, then we need to use the secondary
+ * as parent rather than @fwnode.
+ */
+ if (prev)
+ parent = fwnode_graph_get_port_parent(prev);
+ else
+ parent = fwnode;
+
+ ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev);
+
+ if (IS_ERR_OR_NULL(ep) &&
+ !IS_ERR_OR_NULL(parent) && !IS_ERR_OR_NULL(parent->secondary))
+ ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL);
+
+ return ep;
}
EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 484/491] device property: Check fwnode->secondary when finding properties
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 483/491] device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 485/491] device property: Allow error pointer to be passed to fwnode APIs Greg Kroah-Hartman
` (11 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Hans de Goede,
Daniel Scally, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scally <djrscally@gmail.com>
[ Upstream commit c097af1d0a8483b44fa30e86b311991d76b6ae67 ]
fwnode_property_get_reference_args() searches for named properties
against a fwnode_handle, but these could instead be against the fwnode's
secondary. If the property isn't found against the primary, check the
secondary to see if it's there instead.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Daniel Scally <djrscally@gmail.com>
Link: https://lore.kernel.org/r/20211128232455.39332-1-djrscally@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -479,8 +479,17 @@ int fwnode_property_get_reference_args(c
unsigned int nargs, unsigned int index,
struct fwnode_reference_args *args)
{
- return fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop,
- nargs, index, args);
+ int ret;
+
+ ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop,
+ nargs, index, args);
+
+ if (ret < 0 && !IS_ERR_OR_NULL(fwnode) &&
+ !IS_ERR_OR_NULL(fwnode->secondary))
+ ret = fwnode_call_int_op(fwnode->secondary, get_reference_args,
+ prop, nargs_prop, nargs, index, args);
+
+ return ret;
}
EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 485/491] device property: Allow error pointer to be passed to fwnode APIs
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 484/491] device property: Check fwnode->secondary when finding properties Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 486/491] device property: Allow secondary lookup in fwnode_get_next_child_node() Greg Kroah-Hartman
` (10 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sá, Sakari Ailus,
Heikki Krogerus, Andy Shevchenko, Michael Walle,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 002752af7b89b74c64fe6bec8c5fde3d3a7810d8 ]
Some of the fwnode APIs might return an error pointer instead of NULL
or valid fwnode handle. The result of such API call may be considered
optional and hence the test for it is usually done in a form of
fwnode = fwnode_find_reference(...);
if (IS_ERR(fwnode))
...error handling...
Nevertheless the resulting fwnode may have bumped the reference count
and hence caller of the above API is obliged to call fwnode_handle_put().
Since fwnode may be not valid either as NULL or error pointer the check
has to be performed there. This approach uglifies the code and adds
a point of making a mistake, i.e. forgetting about error point case.
To prevent this, allow an error pointer to be passed to the fwnode APIs.
Fixes: 83b34afb6b79 ("device property: Introduce fwnode_find_reference()")
Reported-by: Nuno Sá <nuno.sa@analog.com>
Tested-by: Nuno Sá <nuno.sa@analog.com>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Michael Walle <michael@walle.cc>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 2692c614f8f0 ("device property: Allow secondary lookup in fwnode_get_next_child_node()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 89 +++++++++++++++++++++++++++---------------------
include/linux/fwnode.h | 10 ++---
2 files changed, 56 insertions(+), 43 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -48,12 +48,14 @@ bool fwnode_property_present(const struc
{
bool ret;
+ if (IS_ERR_OR_NULL(fwnode))
+ return false;
+
ret = fwnode_call_bool_op(fwnode, property_present, propname);
- if (ret == false && !IS_ERR_OR_NULL(fwnode) &&
- !IS_ERR_OR_NULL(fwnode->secondary))
- ret = fwnode_call_bool_op(fwnode->secondary, property_present,
- propname);
- return ret;
+ if (ret)
+ return ret;
+
+ return fwnode_call_bool_op(fwnode->secondary, property_present, propname);
}
EXPORT_SYMBOL_GPL(fwnode_property_present);
@@ -233,15 +235,16 @@ static int fwnode_property_read_int_arra
{
int ret;
+ if (IS_ERR_OR_NULL(fwnode))
+ return -EINVAL;
+
ret = fwnode_call_int_op(fwnode, property_read_int_array, propname,
elem_size, val, nval);
- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) &&
- !IS_ERR_OR_NULL(fwnode->secondary))
- ret = fwnode_call_int_op(
- fwnode->secondary, property_read_int_array, propname,
- elem_size, val, nval);
+ if (ret != -EINVAL)
+ return ret;
- return ret;
+ return fwnode_call_int_op(fwnode->secondary, property_read_int_array, propname,
+ elem_size, val, nval);
}
/**
@@ -372,14 +375,16 @@ int fwnode_property_read_string_array(co
{
int ret;
+ if (IS_ERR_OR_NULL(fwnode))
+ return -EINVAL;
+
ret = fwnode_call_int_op(fwnode, property_read_string_array, propname,
val, nval);
- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) &&
- !IS_ERR_OR_NULL(fwnode->secondary))
- ret = fwnode_call_int_op(fwnode->secondary,
- property_read_string_array, propname,
- val, nval);
- return ret;
+ if (ret != -EINVAL)
+ return ret;
+
+ return fwnode_call_int_op(fwnode->secondary, property_read_string_array, propname,
+ val, nval);
}
EXPORT_SYMBOL_GPL(fwnode_property_read_string_array);
@@ -481,15 +486,19 @@ int fwnode_property_get_reference_args(c
{
int ret;
+ if (IS_ERR_OR_NULL(fwnode))
+ return -ENOENT;
+
ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop,
nargs, index, args);
+ if (ret == 0)
+ return ret;
- if (ret < 0 && !IS_ERR_OR_NULL(fwnode) &&
- !IS_ERR_OR_NULL(fwnode->secondary))
- ret = fwnode_call_int_op(fwnode->secondary, get_reference_args,
- prop, nargs_prop, nargs, index, args);
+ if (IS_ERR_OR_NULL(fwnode->secondary))
+ return ret;
- return ret;
+ return fwnode_call_int_op(fwnode->secondary, get_reference_args, prop, nargs_prop,
+ nargs, index, args);
}
EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args);
@@ -683,12 +692,13 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents);
struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode,
unsigned int depth)
{
- unsigned int i;
-
fwnode_handle_get(fwnode);
- for (i = 0; i < depth && fwnode; i++)
+ do {
+ if (depth-- == 0)
+ break;
fwnode = fwnode_get_next_parent(fwnode);
+ } while (fwnode);
return fwnode;
}
@@ -707,17 +717,17 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent)
bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor,
struct fwnode_handle *test_child)
{
- if (!test_ancestor)
+ if (IS_ERR_OR_NULL(test_ancestor))
return false;
fwnode_handle_get(test_child);
- while (test_child) {
+ do {
if (test_child == test_ancestor) {
fwnode_handle_put(test_child);
return true;
}
test_child = fwnode_get_next_parent(test_child);
- }
+ } while (test_child);
return false;
}
@@ -746,7 +756,7 @@ fwnode_get_next_available_child_node(con
{
struct fwnode_handle *next_child = child;
- if (!fwnode)
+ if (IS_ERR_OR_NULL(fwnode))
return NULL;
do {
@@ -771,16 +781,16 @@ struct fwnode_handle *device_get_next_ch
const struct fwnode_handle *fwnode = dev_fwnode(dev);
struct fwnode_handle *next;
+ if (IS_ERR_OR_NULL(fwnode))
+ return NULL;
+
/* Try to find a child in primary fwnode */
next = fwnode_get_next_child_node(fwnode, child);
if (next)
return next;
/* When no more children in primary, continue with secondary */
- if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
- next = fwnode_get_next_child_node(fwnode->secondary, child);
-
- return next;
+ return fwnode_get_next_child_node(fwnode->secondary, child);
}
EXPORT_SYMBOL_GPL(device_get_next_child_node);
@@ -847,6 +857,9 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put);
*/
bool fwnode_device_is_available(const struct fwnode_handle *fwnode)
{
+ if (IS_ERR_OR_NULL(fwnode))
+ return false;
+
if (!fwnode_has_op(fwnode, device_is_available))
return true;
@@ -1054,14 +1067,14 @@ fwnode_graph_get_next_endpoint(const str
parent = fwnode_graph_get_port_parent(prev);
else
parent = fwnode;
+ if (IS_ERR_OR_NULL(parent))
+ return NULL;
ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev);
+ if (ep)
+ return ep;
- if (IS_ERR_OR_NULL(ep) &&
- !IS_ERR_OR_NULL(parent) && !IS_ERR_OR_NULL(parent->secondary))
- ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL);
-
- return ep;
+ return fwnode_graph_get_next_endpoint(parent->secondary, NULL);
}
EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint);
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -149,12 +149,12 @@ struct fwnode_operations {
struct device *dev);
};
-#define fwnode_has_op(fwnode, op) \
- ((fwnode) && (fwnode)->ops && (fwnode)->ops->op)
+#define fwnode_has_op(fwnode, op) \
+ (!IS_ERR_OR_NULL(fwnode) && (fwnode)->ops && (fwnode)->ops->op)
+
#define fwnode_call_int_op(fwnode, op, ...) \
- (fwnode ? (fwnode_has_op(fwnode, op) ? \
- (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : -ENXIO) : \
- -EINVAL)
+ (fwnode_has_op(fwnode, op) ? \
+ (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : (IS_ERR_OR_NULL(fwnode) ? -EINVAL : -ENXIO))
#define fwnode_call_bool_op(fwnode, op, ...) \
(fwnode_has_op(fwnode, op) ? \
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 486/491] device property: Allow secondary lookup in fwnode_get_next_child_node()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 485/491] device property: Allow error pointer to be passed to fwnode APIs Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 487/491] batman-adv: avoid OGM aggregation when skb tailroom is insufficient Greg Kroah-Hartman
` (9 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko,
Rafael J. Wysocki (Intel), Sakari Ailus, Danilo Krummrich,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 ]
When device_get_child_node_count() got split to the fwnode and device
respective APIs, the fwnode didn't inherit the ability to traverse over
the secondary fwnode. Hence any user, that switches from device to fwnode
API misses this feature. In particular, this was revealed by the commit
1490cbb9dbfd ("device property: Split fwnode_get_child_node_count()")
that effectively broke the GPIO enumeration on Intel Galileo boards.
Fix this by moving the secondary lookup from device to fwnode API.
Note, in general no device_*() API should go into the depth of the fwnode
implementation.
Fixes: 114dbb4fa7c4 ("drivers property: When no children in primary, try secondary")
Cc: stable@vger.kernel.org
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Link: https://patch.msgid.link/20260210135822.47335-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -740,7 +740,18 @@ struct fwnode_handle *
fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
struct fwnode_handle *child)
{
- return fwnode_call_ptr_op(fwnode, get_next_child_node, child);
+ struct fwnode_handle *next;
+
+ if (IS_ERR_OR_NULL(fwnode))
+ return NULL;
+
+ /* Try to find a child in primary fwnode */
+ next = fwnode_call_ptr_op(fwnode, get_next_child_node, child);
+ if (next)
+ return next;
+
+ /* When no more children in primary, continue with secondary */
+ return fwnode_call_ptr_op(fwnode->secondary, get_next_child_node, child);
}
EXPORT_SYMBOL_GPL(fwnode_get_next_child_node);
@@ -778,19 +789,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_availa
struct fwnode_handle *device_get_next_child_node(struct device *dev,
struct fwnode_handle *child)
{
- const struct fwnode_handle *fwnode = dev_fwnode(dev);
- struct fwnode_handle *next;
-
- if (IS_ERR_OR_NULL(fwnode))
- return NULL;
-
- /* Try to find a child in primary fwnode */
- next = fwnode_get_next_child_node(fwnode, child);
- if (next)
- return next;
-
- /* When no more children in primary, continue with secondary */
- return fwnode_get_next_child_node(fwnode->secondary, child);
+ return fwnode_get_next_child_node(dev_fwnode(dev), child);
}
EXPORT_SYMBOL_GPL(device_get_next_child_node);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 487/491] batman-adv: avoid OGM aggregation when skb tailroom is insufficient
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 486/491] device property: Allow secondary lookup in fwnode_get_next_child_node() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 488/491] s390/syscalls: Add spectre boundary for syscall dispatch table Greg Kroah-Hartman
` (8 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Wu, Juefei Pu, Yuan Tan,
Xin Liu, Ao Zhou, Sven Eckelmann, Simon Wunderlich
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <n05ec@lzu.edu.cn>
commit 0d4aef630be9d5f9c1227d07669c26c4383b5ad0 upstream.
When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with only packet_len bytes, while a later
packet can still be selected for aggregation. Appending in this case can
hit skb_put overflow conditions.
Reject aggregation when the target skb tailroom cannot accommodate the new
packet. The caller then falls back to creating a new forward packet
instead of appending.
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Ao Zhou <n05ec@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[ Adjust context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -466,6 +466,9 @@ batadv_iv_ogm_can_aggregate(const struct
!time_after_eq(aggregation_end_time, forw_packet->send_time))
return false;
+ if (skb_tailroom(forw_packet->skb) < packet_len)
+ return false;
+
if (aggregated_bytes > BATADV_MAX_AGGREGATION_BYTES)
return false;
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 488/491] s390/syscalls: Add spectre boundary for syscall dispatch table
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 487/491] batman-adv: avoid OGM aggregation when skb tailroom is insufficient Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 489/491] device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
` (7 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik,
Alexander Gordeev, Christian Borntraeger, Sven Schnelle,
Arnd Bergmann, stable, Ilya Leoshkevich
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 48b8814e25d073dd84daf990a879a820bad2bcbd ]
The s390 syscall number is directly controlled by userspace, but does
not have an array_index_nospec() boundary to prevent access past the
syscall function pointer tables.
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Fixes: 56e62a737028 ("s390: convert to generic entry")
Cc: stable@kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Link: https://lore.kernel.org/r/2026032404-sterling-swoosh-43e6@gregkh
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
[ gor: 5.10 backport. In 5.10, commit 56e62a737028 ("s390: convert to
generic entry") has not been applied — syscall dispatch is in
assembly (entry.S), not in C (syscall.c). The equivalent to
array_index_nospec() is implemented using the same clgr/slbgr/ngr.
SVC 0 path: the user-controlled syscall number in r1 is clamped via
a single unsigned compare (clgr) followed by slbgr/ngr. The original
cghi/jnl bounds check branch is replaced — the clamp handles both
cases: in-bounds values pass through, out-of-bounds values are zeroed
(producing the same r8=0 dispatch to table[0] as the original branch).
SVC 1-255 path: syscall number from the 8-bit instruction immediate
is always in bounds. ]
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/entry.S | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -420,12 +420,15 @@ ENTRY(system_call)
# svc 0: system call number in %r1
llgfr %r1,%r1 # clear high word in r1
sth %r1,__PT_INT_CODE+2(%r11)
- cghi %r1,NR_syscalls
- jnl .Lsysc_nr_ok
+ lghi %r0,NR_syscalls-1
+ clgr %r1,%r0 # CC0/1 if r1 in bounds
+ slbgr %r0,%r0 # mask = -1 in bounds, 0 out of bounds
+ ngr %r1,%r0 # clamp r1
slag %r8,%r1,3
.Lsysc_nr_ok:
stg %r2,__PT_ORIG_GPR2(%r11)
stg %r7,STACK_FRAME_OVERHEAD(%r15)
+ xgr %r1,%r1 # scrub r1, unclamped user value for svc 1-255
lg %r9,0(%r8,%r10) # get system call add.
TSTMSK __TI_flags(%r12),_TIF_TRACE
jnz .Lsysc_tracesys
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 489/491] device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 488/491] s390/syscalls: Add spectre boundary for syscall dispatch table Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 490/491] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Greg Kroah-Hartman
` (6 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Sakari Ailus,
Andy Shevchenko, Daniel Scally
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
commit 39af728649b05e88a2b40e714feeee6451c3f18e upstream.
The 'parent' returned by fwnode_graph_get_port_parent()
with refcount incremented when 'prev' is not NULL, it
needs be put when finish using it.
Because the parent is const, introduce a new variable to
store the returned fwnode, then put it before returning
from fwnode_graph_get_next_endpoint().
Fixes: b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-and-tested-by: Daniel Scally <djrscally@gmail.com>
Link: https://lore.kernel.org/r/20221123022542.2999510-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/property.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1054,26 +1054,32 @@ struct fwnode_handle *
fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode,
struct fwnode_handle *prev)
{
+ struct fwnode_handle *ep, *port_parent = NULL;
const struct fwnode_handle *parent;
- struct fwnode_handle *ep;
/*
* If this function is in a loop and the previous iteration returned
* an endpoint from fwnode->secondary, then we need to use the secondary
* as parent rather than @fwnode.
*/
- if (prev)
- parent = fwnode_graph_get_port_parent(prev);
- else
+ if (prev) {
+ port_parent = fwnode_graph_get_port_parent(prev);
+ parent = port_parent;
+ } else {
parent = fwnode;
+ }
if (IS_ERR_OR_NULL(parent))
return NULL;
ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev);
if (ep)
- return ep;
+ goto out_put_port_parent;
- return fwnode_graph_get_next_endpoint(parent->secondary, NULL);
+ ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL);
+
+out_put_port_parent:
+ fwnode_handle_put(port_parent);
+ return ep;
}
EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 490/491] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 489/491] device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 491/491] io_uring/poll: correctly handle io_poll_add() return value on update Greg Kroah-Hartman
` (5 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Hancock, bjorn.forsman,
Linux kernel regressions list, Manivannan Sadhasivam
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
This reverts commit 573497f350b3cdb526c8c38955ddd287c5d4cc53 which is
commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream.
The original commit attempted to enable ACS in pci_dma_configure() prior
to IOMMU group assignment in iommu_init_device() to fix the ACS enablement
issue for OF platforms. But that assumption doesn't hold true for kernel
versions prior to v6.15, because on these older kernels,
pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU
groups are already created before the ACS gets enabled. This causes the
devices that should have been split into separate groups by ACS, getting
merged into one group, thereby breaking the IOMMU isolation as reported on
the AMD machines.
So revert the offending commit to restore the IOMMU group assignment on
those affected machines. It should be noted that ACS has never really
worked on kernel versions prior to v6.15, so the revert doesn't make any
difference for OF platforms.
Reported-by: John Hancock <john@kernel.doghat.io>
Reported-by: bjorn.forsman@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234
Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms")
Cc: Linux kernel regressions list <regressions@lists.linux.dev>
Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-driver.c | 8 --------
drivers/pci/pci.c | 10 +++++++++-
drivers/pci/pci.h | 1 -
3 files changed, 9 insertions(+), 10 deletions(-)
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -1601,14 +1601,6 @@ static int pci_dma_configure(struct devi
ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
}
- /*
- * Attempt to enable ACS regardless of capability because some Root
- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
- * the standard ACS capability but still support ACS via those
- * quirks.
- */
- pci_enable_acs(to_pci_dev(dev));
-
pci_put_host_bridge_device(bridge);
return ret;
}
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -894,7 +894,7 @@ static void pci_std_enable_acs(struct pc
* pci_enable_acs - enable ACS if hardware support it
* @dev: the PCI device
*/
-void pci_enable_acs(struct pci_dev *dev)
+static void pci_enable_acs(struct pci_dev *dev)
{
if (!pci_acs_enable)
goto disable_acs_redir;
@@ -3548,6 +3548,14 @@ bool pci_acs_path_enabled(struct pci_dev
void pci_acs_init(struct pci_dev *dev)
{
dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+
+ /*
+ * Attempt to enable ACS regardless of capability because some Root
+ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+ * the standard ACS capability but still support ACS via those
+ * quirks.
+ */
+ pci_enable_acs(dev);
}
/**
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -547,7 +547,6 @@ static inline resource_size_t pci_resour
}
void pci_acs_init(struct pci_dev *dev);
-void pci_enable_acs(struct pci_dev *dev);
#ifdef CONFIG_PCI_QUIRKS
int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
int pci_dev_specific_enable_acs(struct pci_dev *dev);
^ permalink raw reply [flat|nested] 524+ messages in thread
* [PATCH 5.10 491/491] io_uring/poll: correctly handle io_poll_add() return value on update
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 490/491] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Greg Kroah-Hartman
@ 2026-04-13 16:02 ` Greg Kroah-Hartman
2026-04-13 17:37 ` [PATCH 5.10 000/491] 5.10.253-rc1 review Brett A C Sheffield
` (4 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Greg Kroah-Hartman @ 2026-04-13 16:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+641eec6b7af1f62f2b99,
Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream.
When the core of io_uring was updated to handle completions
consistently and with fixed return codes, the POLL_REMOVE opcode
with updates got slightly broken. If a POLL_ADD is pending and
then POLL_REMOVE is used to update the events of that request, if that
update causes the POLL_ADD to now trigger, then that completion is lost
and a CQE is never posted.
Additionally, ensure that if an update does cause an existing POLL_ADD
to complete, that the completion value isn't always overwritten with
-ECANCELED. For that case, whatever io_poll_add() set the value to
should just be retained.
Cc: stable@vger.kernel.org
Fixes: 97b388d70b53 ("io_uring: handle completions in the core")
Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -5980,7 +5980,7 @@ static int io_poll_add_prep(struct io_ki
return 0;
}
-static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
+static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
{
struct io_poll_iocb *poll = &req->poll;
struct io_poll_table ipt;
@@ -5992,11 +5992,21 @@ static int io_poll_add(struct io_kiocb *
if (!ret && ipt.error)
req_set_fail(req);
ret = ret ?: ipt.error;
- if (ret)
+ if (ret > 0) {
__io_req_complete(req, issue_flags, ret, 0);
+ return ret;
+ }
return 0;
}
+static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
+{
+ int ret;
+
+ ret = __io_poll_add(req, issue_flags);
+ return ret < 0 ? ret : 0;
+}
+
static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags)
{
struct io_ring_ctx *ctx = req->ctx;
@@ -6012,6 +6022,7 @@ static int io_poll_update(struct io_kioc
ret = preq ? -EALREADY : -ENOENT;
goto out;
}
+ preq->result = -ECANCELED;
spin_unlock(&ctx->completion_lock);
if (req->poll_update.update_events || req->poll_update.update_user_data) {
@@ -6024,16 +6035,17 @@ static int io_poll_update(struct io_kioc
if (req->poll_update.update_user_data)
preq->user_data = req->poll_update.new_user_data;
- ret2 = io_poll_add(preq, issue_flags);
+ ret2 = __io_poll_add(preq, issue_flags);
/* successfully updated, don't complete poll request */
if (!ret2)
goto out;
+ preq->result = ret2;
+
}
- req_set_fail(preq);
- io_req_complete(preq, -ECANCELED);
+ if (preq->result < 0)
+ req_set_fail(preq);
+ io_req_complete(preq, preq->result);
out:
- if (ret < 0)
- req_set_fail(req);
/* complete update request, we're done with it */
io_req_complete(req, ret);
io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-04-13 16:02 ` [PATCH 5.10 491/491] io_uring/poll: correctly handle io_poll_add() return value on update Greg Kroah-Hartman
@ 2026-04-13 17:37 ` Brett A C Sheffield
2026-04-13 17:59 ` Florian Fainelli
` (3 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Brett A C Sheffield @ 2026-04-13 17:37 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 5.10.253-rc1-00492-g0abb5988a311 #1 SMP Mon Apr 13 17:24:27 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-04-13 17:37 ` [PATCH 5.10 000/491] 5.10.253-rc1 review Brett A C Sheffield
@ 2026-04-13 17:59 ` Florian Fainelli
2026-04-13 18:52 ` Jon Hunter
` (2 subsequent siblings)
495 siblings, 0 replies; 524+ messages in thread
From: Florian Fainelli @ 2026-04-13 17:59 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 4/13/26 08:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.253 release.
> There are 491 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-04-13 17:59 ` Florian Fainelli
@ 2026-04-13 18:52 ` Jon Hunter
2026-04-14 8:02 ` Pavel Machek
2026-04-14 18:20 ` Mark Brown
2026-04-15 3:01 ` Barry K. Nathan
495 siblings, 1 reply; 524+ messages in thread
From: Jon Hunter @ 2026-04-13 18:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, f.fainelli, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr, linux-tegra@vger.kernel.org
Hi Greg,
On 13/04/2026 16:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.253 release.
> There are 491 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
...
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> bus: omap-ocp2scp: Convert to platform remove callback returning void
I am seeing the following build error due to the above change on ARM platforms ...
drivers/bus/omap-ocp2scp.c:95:10: error: 'struct platform_driver' has no member named 'remove_new'; did you mean 'remove'?
95 | .remove_new = omap_ocp2scp_remove,
| ^~~~~~~~~~
| remove
drivers/bus/omap-ocp2scp.c:95:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
95 | .remove_new = omap_ocp2scp_remove,
| ^~~~~~~~~~~~~~~~~~~
Thanks
Jon
--
nvpublic
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root
2026-04-13 15:58 ` [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root Greg Kroah-Hartman
@ 2026-04-13 20:17 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 20:17 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, webcaptcha, Heikki Krogerus, Rafael J. Wysocki,
Hans de Goede, Mario Limonciello, Andy Shevchenko, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 5822 bytes --]
On Mon, 2026-04-13 at 17:58 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>
> [ Upstream commit 60fa6ae6e6d09e377fce6f8d9b6f6a4d88769f63 ]
It appears that this can cause regressions, which were fixed by commits
71bf41b8e913 ("ACPI: EC: Evaluate _REG outside the EC scope more
carefully") and 0e6b6dedf168 ("ACPI: EC: Evaluate orphan _REG under EC
device") upstream. I didn't check whether those would apply and build
cleanly here, but if not then this may have to be dropped.
Ben.
> It is reported that _DSM evaluation fails in ucsi_acpi_dsm() on Lenovo
> IdeaPad Pro 5 due to a missing address space handler for the EC address
> space:
>
> ACPI Error: No handler for Region [ECSI] (000000007b8176ee) [EmbeddedControl] (20230628/evregion-130)
>
> This happens because if there is no ECDT, the EC driver only registers
> the EC address space handler for operation regions defined in the EC
> device scope of the ACPI namespace while the operation region being
> accessed by the _DSM in question is located beyond that scope.
>
> To address this, modify the ACPI EC driver to install the EC address
> space handler at the root of the ACPI namespace for the first EC that
> can be found regardless of whether or not an ECDT is present.
>
> Note that this change is consistent with some examples in the ACPI
> specification in which EC operation regions located outside the EC
> device scope are used (for example, see Section 9.17.15 in ACPI 6.5),
> so the current behavior of the EC driver is arguably questionable.
>
> Reported-by: webcaptcha <webcapcha@gmail.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=218789
> Link: https://uefi.org/specs/ACPI/6.5/09_ACPI_Defined_Devices_and_Device_Specific_Objects.html#example-asl-code
> Link: https://lore.kernel.org/linux-acpi/Zi+0whTvDbAdveHq@kuha.fi.intel.com
> Suggested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/acpi/ec.c | 25 ++++++++++++++++---------
> drivers/acpi/internal.h | 1 -
> 2 files changed, 16 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
> index 10f7e3ef58791..1d7e7e47ea0e4 100644
> --- a/drivers/acpi/ec.c
> +++ b/drivers/acpi/ec.c
> @@ -1514,13 +1514,14 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)
> static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
> bool call_reg)
> {
> + acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
> acpi_status status;
>
> acpi_ec_start(ec, false);
>
> if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
> acpi_ec_enter_noirq(ec);
> - status = acpi_install_address_space_handler_no_reg(ec->handle,
> + status = acpi_install_address_space_handler_no_reg(scope_handle,
> ACPI_ADR_SPACE_EC,
> &acpi_ec_space_handler,
> NULL, ec);
> @@ -1529,11 +1530,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
> return -ENODEV;
> }
> set_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
> - ec->address_space_handler_holder = ec->handle;
> }
>
> if (call_reg && !test_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags)) {
> - acpi_execute_reg_methods(ec->handle, ACPI_ADR_SPACE_EC);
> + acpi_execute_reg_methods(scope_handle, ACPI_ADR_SPACE_EC);
> set_bit(EC_FLAGS_EC_REG_CALLED, &ec->flags);
> }
>
> @@ -1585,10 +1585,13 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
>
> static void ec_remove_handlers(struct acpi_ec *ec)
> {
> + acpi_handle scope_handle = ec == first_ec ? ACPI_ROOT_OBJECT : ec->handle;
> +
> if (test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
> if (ACPI_FAILURE(acpi_remove_address_space_handler(
> - ec->address_space_handler_holder,
> - ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
> + scope_handle,
> + ACPI_ADR_SPACE_EC,
> + &acpi_ec_space_handler)))
> pr_err("failed to remove space handler\n");
> clear_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
> }
> @@ -1627,14 +1630,18 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca
> {
> int ret;
>
> - ret = ec_install_handlers(ec, device, call_reg);
> - if (ret)
> - return ret;
> -
> /* First EC capable of handling transactions */
> if (!first_ec)
> first_ec = ec;
>
> + ret = ec_install_handlers(ec, device, call_reg);
> + if (ret) {
> + if (ec == first_ec)
> + first_ec = NULL;
> +
> + return ret;
> + }
> +
> pr_info("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", ec->command_addr,
> ec->data_addr);
>
> diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
> index 4edf591f8a3a5..f6c929787c9e6 100644
> --- a/drivers/acpi/internal.h
> +++ b/drivers/acpi/internal.h
> @@ -169,7 +169,6 @@ static inline void acpi_early_processor_osc(void) {}
> -------------------------------------------------------------------------- */
> struct acpi_ec {
> acpi_handle handle;
> - acpi_handle address_space_handler_holder;
> int gpe;
> int irq;
> unsigned long command_addr;
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable
2026-04-13 16:01 ` [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable Greg Kroah-Hartman
@ 2026-04-13 20:36 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 20:36 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Miaohe Lin, Lukas Bulwahn, Mike Kravetz, Muchun Song,
Andrew Morton, David Hildenbrand (Arm), Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 3697 bytes --]
On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Miaohe Lin <linmiaohe@huawei.com>
Missing "commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546 upstream."
Ben.
> If the pagetables are shared, we shouldn't copy or take references. Since
> src could have unshared and dst shares with another vma, huge_pte_none()
> is thus used to determine whether dst_pte is shared. But this check isn't
> reliable. A shared pte could have pte none in pagetable in fact. The
> page count of ptep page should be checked here in order to reliably
> determine whether pte is shared.
>
> [lukas.bulwahn@gmail.com: remove unused local variable dst_entry in copy_hugetlb_page_range()]
> Link: https://lkml.kernel.org/r/20220822082525.26071-1-lukas.bulwahn@gmail.com
> Link: https://lkml.kernel.org/r/20220816130553.31406-7-linmiaohe@huawei.com
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
> Cc: Muchun Song <songmuchun@bytedance.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 3aa4ed8040e1535d95c03cef8b52cf11bf0d8546)
> [ David: We don't have 4eae4efa2c29 ("hugetlb: do early cow when page
> pinned on src mm", so there are some contextual conflicts. ]
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> mm/hugetlb.c | 19 +++++++------------
> 1 file changed, 7 insertions(+), 12 deletions(-)
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 99a71943c1f69..a2cab8f2190f8 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -3827,7 +3827,7 @@ static bool is_hugetlb_entry_hwpoisoned(pte_t pte)
> int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> struct vm_area_struct *vma)
> {
> - pte_t *src_pte, *dst_pte, entry, dst_entry;
> + pte_t *src_pte, *dst_pte, entry;
> struct page *ptepage;
> unsigned long addr;
> int cow;
> @@ -3867,27 +3867,22 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
>
> /*
> * If the pagetables are shared don't copy or take references.
> - * dst_pte == src_pte is the common case of src/dest sharing.
> *
> + * dst_pte == src_pte is the common case of src/dest sharing.
> * However, src could have 'unshared' and dst shares with
> - * another vma. If dst_pte !none, this implies sharing.
> - * Check here before taking page table lock, and once again
> - * after taking the lock below.
> + * another vma. So page_count of ptep page is checked instead
> + * to reliably determine whether pte is shared.
> */
> - dst_entry = huge_ptep_get(dst_pte);
> - if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
> + if (page_count(virt_to_page(dst_pte)) > 1)
> continue;
>
> dst_ptl = huge_pte_lock(h, dst, dst_pte);
> src_ptl = huge_pte_lockptr(h, src, src_pte);
> spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
> entry = huge_ptep_get(src_pte);
> - dst_entry = huge_ptep_get(dst_pte);
> - if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
> + if (huge_pte_none(entry)) {
> /*
> - * Skip if src entry none. Also, skip in the
> - * unlikely case dst entry !none as this implies
> - * sharing with another vma.
> + * Skip if src entry none.
> */
> ;
> } else if (unlikely(is_hugetlb_entry_migration(entry) ||
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
2026-04-13 16:01 ` [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Greg Kroah-Hartman
@ 2026-04-13 20:37 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 20:37 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Jane Chu, Harry Yoo, Oscar Salvador, David Hildenbrand,
Jann Horn, Liu Shixin, Muchun Song, Andrew Morton,
David Hildenbrand (Arm), Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 4108 bytes --]
On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Jane Chu <jane.chu@oracle.com>
This one was commit 14967a9c7d247841b0312c48dcf8cd29e55a4cc8 upstream.
Ben.
> commit 59d9094df3d79 ("mm: hugetlb: independent PMD page table shared
> count") introduced ->pt_share_count dedicated to hugetlb PMD share count
> tracking, but omitted fixing copy_hugetlb_page_range(), leaving the
> function relying on page_count() for tracking that no longer works.
>
> When lazy page table copy for hugetlb is disabled, that is, revert commit
> bcd51a3c679d ("hugetlb: lazy page table copies in fork()") fork()'ing with
> hugetlb PMD sharing quickly lockup -
>
> [ 239.446559] watchdog: BUG: soft lockup - CPU#75 stuck for 27s!
> [ 239.446611] RIP: 0010:native_queued_spin_lock_slowpath+0x7e/0x2e0
> [ 239.446631] Call Trace:
> [ 239.446633] <TASK>
> [ 239.446636] _raw_spin_lock+0x3f/0x60
> [ 239.446639] copy_hugetlb_page_range+0x258/0xb50
> [ 239.446645] copy_page_range+0x22b/0x2c0
> [ 239.446651] dup_mmap+0x3e2/0x770
> [ 239.446654] dup_mm.constprop.0+0x5e/0x230
> [ 239.446657] copy_process+0xd17/0x1760
> [ 239.446660] kernel_clone+0xc0/0x3e0
> [ 239.446661] __do_sys_clone+0x65/0xa0
> [ 239.446664] do_syscall_64+0x82/0x930
> [ 239.446668] ? count_memcg_events+0xd2/0x190
> [ 239.446671] ? syscall_trace_enter+0x14e/0x1f0
> [ 239.446676] ? syscall_exit_work+0x118/0x150
> [ 239.446677] ? arch_exit_to_user_mode_prepare.constprop.0+0x9/0xb0
> [ 239.446681] ? clear_bhb_loop+0x30/0x80
> [ 239.446684] ? clear_bhb_loop+0x30/0x80
> [ 239.446686] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> There are two options to resolve the potential latent issue:
> 1. warn against PMD sharing in copy_hugetlb_page_range(),
> 2. fix it.
> This patch opts for the second option.
> While at it, simplify the comment, the details are not actually relevant
> anymore.
>
> Link: https://lkml.kernel.org/r/20250916004520.1604530-1-jane.chu@oracle.com
> Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
> Signed-off-by: Jane Chu <jane.chu@oracle.com>
> Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
> Acked-by: Oscar Salvador <osalvador@suse.de>
> Acked-by: David Hildenbrand <david@redhat.com>
> Cc: Jann Horn <jannh@google.com>
> Cc: Liu Shixin <liushixin2@huawei.com>
> Cc: Muchun Song <muchun.song@linux.dev>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> (cherry picked from commit 14967a9c7d247841b0312c48dcf8cd29e55a4cc8)
> [ David: We don't have ptdesc and the wrappers, so work directly on the
> page->pt_share_count. CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING is still
> called CONFIG_ARCH_WANT_HUGE_PMD_SHARE. ]
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> mm/hugetlb.c | 13 ++++---------
> 1 file changed, 4 insertions(+), 9 deletions(-)
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index a2cab8f2190f8..8fa34032bc173 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -3865,16 +3865,11 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> break;
> }
>
> - /*
> - * If the pagetables are shared don't copy or take references.
> - *
> - * dst_pte == src_pte is the common case of src/dest sharing.
> - * However, src could have 'unshared' and dst shares with
> - * another vma. So page_count of ptep page is checked instead
> - * to reliably determine whether pte is shared.
> - */
> - if (page_count(virt_to_page(dst_pte)) > 1)
> +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
> + /* If the pagetables are shared, there is nothing to do */
> + if (atomic_read(&virt_to_page(dst_pte)->pt_share_count))
> continue;
> +#endif
>
> dst_ptl = huge_pte_lock(h, dst, dst_pte);
> src_ptl = huge_pte_lockptr(h, src, src_pte);
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT
2026-04-13 16:01 ` [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT Greg Kroah-Hartman
@ 2026-04-13 20:43 ` Ben Hutchings
2026-04-13 20:50 ` Ricardo Ribalda
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 20:43 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Ricardo Ribalda, Laurent Pinchart, Mauro Carvalho Chehab,
Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 11541 bytes --]
On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ricardo Ribalda <ribalda@chromium.org>
>
> [ Upstream commit 2886477ff98740cc3333cf785e4de0b1ff3d7a28 ]
This is a new feature, not obviously suitable for stable.
If it really is needed for 5.10 then there are a number of bug fixes
that also need to follow: 387e89393071 ["media: uvcvideo: Fix deferred
probing error"), a9ea1a3d88b7 ("media: uvcvideo: Fix crash during unbind
if gpio unit is in use"), and f0f078457f18 ("media: uvcvideo: Fix memory
leak in uvc_gpio_parse").
Ben.
> Some devices can implement a physical switch to disable the input of the
> camera on demand. Think of it like an elegant privacy sticker.
>
> The system can read the status of the privacy switch via a GPIO.
>
> It is important to know the status of the switch, e.g. to notify the
> user when the camera will produce black frames and a videochat
> application is used.
>
> In some systems, the GPIO is connected to the main SoC instead of the
> camera controller, with the connection reported by the system firmware
> (ACPI or DT). In that case, the UVC device isn't aware of the GPIO. We
> need to implement a virtual entity to handle the GPIO fully on the
> driver side.
>
> For example, for ACPI-based systems, the GPIO is reported in the USB
> device object:
>
> Scope (\_SB.PCI0.XHCI.RHUB.HS07)
> {
>
> /.../
>
> Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings
> {
> GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly,
> "\\_SB.PCI0.GPIO", 0x00, ResourceConsumer, ,
> )
> { // Pin list
> 0x0064
> }
> })
> Name (_DSD, Package (0x02) // _DSD: Device-Specific Data
> {
> ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301") /* Device Properties for _DSD */,
> Package (0x01)
> {
> Package (0x02)
> {
> "privacy-gpio",
> Package (0x04)
> {
> \_SB.PCI0.XHCI.RHUB.HS07,
> Zero,
> Zero,
> One
> }
> }
> }
> })
> }
>
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> Stable-dep-of: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/media/usb/uvc/uvc_ctrl.c | 3 +
> drivers/media/usb/uvc/uvc_driver.c | 127 +++++++++++++++++++++++++++++
> drivers/media/usb/uvc/uvc_entity.c | 1 +
> drivers/media/usb/uvc/uvcvideo.h | 16 ++++
> 4 files changed, 147 insertions(+)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index 698bf5bb896ec..fc23e53c0d38b 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -2378,6 +2378,9 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
> } else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) {
> bmControls = entity->camera.bmControls;
> bControlSize = entity->camera.bControlSize;
> + } else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) {
> + bmControls = entity->gpio.bmControls;
> + bControlSize = entity->gpio.bControlSize;
> }
>
> /* Remove bogus/blacklisted controls */
> diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> index e1d3e753e80ed..b86e46fa7c0af 100644
> --- a/drivers/media/usb/uvc/uvc_driver.c
> +++ b/drivers/media/usb/uvc/uvc_driver.c
> @@ -7,6 +7,7 @@
> */
>
> #include <linux/atomic.h>
> +#include <linux/gpio/consumer.h>
> #include <linux/kernel.h>
> #include <linux/list.h>
> #include <linux/module.h>
> @@ -1033,6 +1034,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
> }
>
> static const u8 uvc_camera_guid[16] = UVC_GUID_UVC_CAMERA;
> +static const u8 uvc_gpio_guid[16] = UVC_GUID_EXT_GPIO_CONTROLLER;
> static const u8 uvc_media_transport_input_guid[16] =
> UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
> static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
> @@ -1064,6 +1066,9 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
> * is initialized by the caller.
> */
> switch (type) {
> + case UVC_EXT_GPIO_UNIT:
> + memcpy(entity->guid, uvc_gpio_guid, 16);
> + break;
> case UVC_ITT_CAMERA:
> memcpy(entity->guid, uvc_camera_guid, 16);
> break;
> @@ -1467,6 +1472,108 @@ static int uvc_parse_control(struct uvc_device *dev)
> return 0;
> }
>
> +/* -----------------------------------------------------------------------------
> + * Privacy GPIO
> + */
> +
> +static void uvc_gpio_event(struct uvc_device *dev)
> +{
> + struct uvc_entity *unit = dev->gpio_unit;
> + struct uvc_video_chain *chain;
> + u8 new_val;
> +
> + if (!unit)
> + return;
> +
> + new_val = gpiod_get_value_cansleep(unit->gpio.gpio_privacy);
> +
> + /* GPIO entities are always on the first chain. */
> + chain = list_first_entry(&dev->chains, struct uvc_video_chain, list);
> + uvc_ctrl_status_event(chain, unit->controls, &new_val);
> +}
> +
> +static int uvc_gpio_get_cur(struct uvc_device *dev, struct uvc_entity *entity,
> + u8 cs, void *data, u16 size)
> +{
> + if (cs != UVC_CT_PRIVACY_CONTROL || size < 1)
> + return -EINVAL;
> +
> + *(u8 *)data = gpiod_get_value_cansleep(entity->gpio.gpio_privacy);
> +
> + return 0;
> +}
> +
> +static int uvc_gpio_get_info(struct uvc_device *dev, struct uvc_entity *entity,
> + u8 cs, u8 *caps)
> +{
> + if (cs != UVC_CT_PRIVACY_CONTROL)
> + return -EINVAL;
> +
> + *caps = UVC_CONTROL_CAP_GET | UVC_CONTROL_CAP_AUTOUPDATE;
> + return 0;
> +}
> +
> +static irqreturn_t uvc_gpio_irq(int irq, void *data)
> +{
> + struct uvc_device *dev = data;
> +
> + uvc_gpio_event(dev);
> + return IRQ_HANDLED;
> +}
> +
> +static int uvc_gpio_parse(struct uvc_device *dev)
> +{
> + struct uvc_entity *unit;
> + struct gpio_desc *gpio_privacy;
> + int irq;
> +
> + gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy",
> + GPIOD_IN);
> + if (IS_ERR_OR_NULL(gpio_privacy))
> + return PTR_ERR_OR_ZERO(gpio_privacy);
> +
> + unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
> + if (!unit)
> + return -ENOMEM;
> +
> + irq = gpiod_to_irq(gpio_privacy);
> + if (irq < 0) {
> + if (irq != EPROBE_DEFER)
> + dev_err(&dev->udev->dev,
> + "No IRQ for privacy GPIO (%d)\n", irq);
> + return irq;
> + }
> +
> + unit->gpio.gpio_privacy = gpio_privacy;
> + unit->gpio.irq = irq;
> + unit->gpio.bControlSize = 1;
> + unit->gpio.bmControls = (u8 *)unit + sizeof(*unit);
> + unit->gpio.bmControls[0] = 1;
> + unit->get_cur = uvc_gpio_get_cur;
> + unit->get_info = uvc_gpio_get_info;
> + strncpy(unit->name, "GPIO", sizeof(unit->name) - 1);
> +
> + list_add_tail(&unit->list, &dev->entities);
> +
> + dev->gpio_unit = unit;
> +
> + return 0;
> +}
> +
> +static int uvc_gpio_init_irq(struct uvc_device *dev)
> +{
> + struct uvc_entity *unit = dev->gpio_unit;
> +
> + if (!unit || unit->gpio.irq < 0)
> + return 0;
> +
> + return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL,
> + uvc_gpio_irq,
> + IRQF_ONESHOT | IRQF_TRIGGER_FALLING |
> + IRQF_TRIGGER_RISING,
> + "uvc_privacy_gpio", dev);
> +}
> +
> /* ------------------------------------------------------------------------
> * UVC device scan
> */
> @@ -1988,6 +2095,13 @@ static int uvc_scan_device(struct uvc_device *dev)
> return -1;
> }
>
> + /* Add GPIO entity to the first chain. */
> + if (dev->gpio_unit) {
> + chain = list_first_entry(&dev->chains,
> + struct uvc_video_chain, list);
> + list_add_tail(&dev->gpio_unit->chain, &chain->entities);
> + }
> +
> return 0;
> }
>
> @@ -2350,6 +2464,12 @@ static int uvc_probe(struct usb_interface *intf,
> goto error;
> }
>
> + /* Parse the associated GPIOs. */
> + if (uvc_gpio_parse(dev) < 0) {
> + uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC GPIOs\n");
> + goto error;
> + }
> +
> uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
> dev->uvc_version >> 8, dev->uvc_version & 0xff,
> udev->product ? udev->product : "<unnamed>",
> @@ -2394,6 +2514,13 @@ static int uvc_probe(struct usb_interface *intf,
> "supported.\n", ret);
> }
>
> + ret = uvc_gpio_init_irq(dev);
> + if (ret < 0) {
> + dev_err(&dev->udev->dev,
> + "Unable to request privacy GPIO IRQ (%d)\n", ret);
> + goto error;
> + }
> +
> uvc_trace(UVC_TRACE_PROBE, "UVC device initialized.\n");
> usb_enable_autosuspend(udev);
> return 0;
> diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
> index 7c9895377118c..96e965a16d061 100644
> --- a/drivers/media/usb/uvc/uvc_entity.c
> +++ b/drivers/media/usb/uvc/uvc_entity.c
> @@ -105,6 +105,7 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
> case UVC_OTT_DISPLAY:
> case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
> case UVC_EXTERNAL_VENDOR_SPECIFIC:
> + case UVC_EXT_GPIO_UNIT:
> default:
> function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
> break;
> diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
> index 0e4209dbf307f..e9eef2170d866 100644
> --- a/drivers/media/usb/uvc/uvcvideo.h
> +++ b/drivers/media/usb/uvc/uvcvideo.h
> @@ -6,6 +6,7 @@
> #error "The uvcvideo.h header is deprecated, use linux/uvcvideo.h instead."
> #endif /* __KERNEL__ */
>
> +#include <linux/atomic.h>
> #include <linux/kernel.h>
> #include <linux/poll.h>
> #include <linux/usb.h>
> @@ -37,6 +38,8 @@
> (UVC_ENTITY_IS_TERM(entity) && \
> ((entity)->type & 0x8000) == UVC_TERM_OUTPUT)
>
> +#define UVC_EXT_GPIO_UNIT 0x7ffe
> +#define UVC_EXT_GPIO_UNIT_ID 0x100
>
> /* ------------------------------------------------------------------------
> * GUIDs
> @@ -56,6 +59,9 @@
> #define UVC_GUID_UVC_SELECTOR \
> {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
> 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02}
> +#define UVC_GUID_EXT_GPIO_CONTROLLER \
> + {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
> + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03}
>
> #define UVC_GUID_FORMAT_MJPEG \
> { 'M', 'J', 'P', 'G', 0x00, 0x00, 0x10, 0x00, \
> @@ -213,6 +219,7 @@
> * Structures.
> */
>
> +struct gpio_desc;
> struct uvc_device;
>
> /* TODO: Put the most frequently accessed fields at the beginning of
> @@ -354,6 +361,13 @@ struct uvc_entity {
> u8 *bmControls;
> u8 *bmControlsType;
> } extension;
> +
> + struct {
> + u8 bControlSize;
> + u8 *bmControls;
> + struct gpio_desc *gpio_privacy;
> + int irq;
> + } gpio;
> };
>
> u8 bNrInPins;
> @@ -696,6 +710,8 @@ struct uvc_device {
> struct uvc_control *ctrl;
> const void *data;
> } async_ctrl;
> +
> + struct uvc_entity *gpio_unit;
> };
>
> enum uvc_handle_state {
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-04-13 16:01 ` [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Greg Kroah-Hartman
@ 2026-04-13 20:49 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 20:49 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Thomas Hellström, Maarten Lankhorst, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 14590 bytes --]
On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Maarten Lankhorst <dev@lankhorst.se>
>
> [ Upstream commit 6bee098b91417654703e17eb5c1822c6dfd0c01d ]
This has already been reverted upstream (commit 45ebe43ea00d), so please
drop it from all queues.
Ben.
> When trying to do a rather aggressive test of igt's "xe_module_load
> --r reload" with a full desktop environment and game running I noticed
> a few OOPSes when dereferencing freed pointers, related to
> framebuffers and property blobs after the compositor exits.
>
> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
> and immediately put the references from struct drm_file objects during
> drm_dev_unplug().
>
> Related warnings for framebuffers on the subtest:
> [ 739.713076] ------------[ cut here ]------------
> WARN_ON(!list_empty(&dev->mode_config.fb_list))
> [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
> ....
> [ 739.713328] Call Trace:
> [ 739.713330] <TASK>
> [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
> [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
> [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> [ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
> [ 739.714284] devm_action_release+0xf/0x20
> [ 739.714294] devres_release_all+0xad/0xf0
> [ 739.714301] device_unbind_cleanup+0x12/0xa0
> [ 739.714305] device_release_driver_internal+0x1b7/0x210
> [ 739.714311] device_driver_detach+0x14/0x20
> [ 739.714315] unbind_store+0xa6/0xb0
> [ 739.714319] drv_attr_store+0x21/0x30
> [ 739.714322] sysfs_kf_write+0x48/0x60
> [ 739.714328] kernfs_fop_write_iter+0x16b/0x240
> [ 739.714333] vfs_write+0x266/0x520
> [ 739.714341] ksys_write+0x72/0xe0
> [ 739.714345] __x64_sys_write+0x19/0x20
> [ 739.714347] x64_sys_call+0xa15/0xa30
> [ 739.714355] do_syscall_64+0xd8/0xab0
> [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>
> and
>
> [ 739.714459] ------------[ cut here ]------------
> [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head))
> [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
> [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
> ...
> [ 739.714869] Call Trace:
> [ 739.714871] <TASK>
> [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
> [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
> [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
> [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> [ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
> [ 739.715821] devm_action_release+0xf/0x20
> [ 739.715828] devres_release_all+0xad/0xf0
> [ 739.715843] device_unbind_cleanup+0x12/0xa0
> [ 739.715850] device_release_driver_internal+0x1b7/0x210
> [ 739.715856] device_driver_detach+0x14/0x20
> [ 739.715860] unbind_store+0xa6/0xb0
> [ 739.715865] drv_attr_store+0x21/0x30
> [ 739.715868] sysfs_kf_write+0x48/0x60
> [ 739.715873] kernfs_fop_write_iter+0x16b/0x240
> [ 739.715878] vfs_write+0x266/0x520
> [ 739.715886] ksys_write+0x72/0xe0
> [ 739.715890] __x64_sys_write+0x19/0x20
> [ 739.715893] x64_sys_call+0xa15/0xa30
> [ 739.715900] do_syscall_64+0xd8/0xab0
> [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>
> and then finally file close blows up:
>
> [ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP
> [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
> [ 743.186537] Tainted: [W]=WARN
> [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
> [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42
> [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
> [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03
> [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08
> [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000
> [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00
> [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0
> [ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000
> [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0
> [ 743.186597] Call Trace:
> [ 743.186598] <TASK>
> [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
> [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
> [ 743.186750] ? trace_hardirqs_on+0x5f/0x120
> [ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
> [ 743.186786] drm_fb_release+0x105/0x190 [drm]
> [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
> [ 743.186817] ? rt_spin_lock+0xea/0x1b0
> [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
> [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
> [ 743.186865] __fput+0x100/0x2e0
> [ 743.186869] fput_close_sync+0x40/0xa0
> [ 743.186870] __x64_sys_close+0x3e/0x80
> [ 743.186873] x64_sys_call+0xa07/0xa30
> [ 743.186879] do_syscall_64+0xd8/0xab0
> [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> [ 743.186882] RIP: 0033:0x7ff37e567732
> [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
> [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732
> [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
> [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000
> [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0
> [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30
> [ 743.186892] </TASK>
> [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
> [ 743.186938] ---[ end trace 0000000000000000 ]---
>
> And for property blobs:
>
> void drm_mode_config_cleanup(struct drm_device *dev)
> {
> ...
> list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
> head_global) {
> drm_property_blob_put(blob);
> }
>
> Resulting in:
>
> [ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff
> [ 371.072944] #PF: supervisor read access in kernel mode
> [ 371.072945] #PF: error_code(0x0000) - not-present page
> [ 371.072947] PGD 0 P4D 0
> [ 371.072950] Oops: Oops: 0000 [#1] SMP
> [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
> [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> [ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm]
> [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70
> [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
> [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0
> [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000
> [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000
> [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7
> [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970
> [ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000
> [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0
> [ 371.073031] Call Trace:
> [ 371.073033] <TASK>
> [ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
> [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
> [ 371.073113] __fput+0xe2/0x2b0
> [ 371.073118] fput_close_sync+0x40/0xa0
> [ 371.073119] __x64_sys_close+0x3e/0x80
> [ 371.073122] x64_sys_call+0xa07/0xa30
> [ 371.073126] do_syscall_64+0xc0/0x840
> [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> [ 371.073132] RIP: 0033:0x7f1fb3501732
> [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
> [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732
> [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
> [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000
> [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0
> [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30
> [ 371.073143] </TASK>
> [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
> [ 371.073198] CR2: 000001ffffffffff
> [ 371.073199] ---[ end trace 0000000000000000 ]---
>
> Add a guard around file close, and ensure the warnings from drm_mode_config
> do not trigger. Fix those by allowing an open reference to the file descriptor
> and cleaning up the file linked list entry in drm_mode_config_cleanup().
>
> Cc: <stable@vger.kernel.org> # v4.18+
> Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Link: https://patch.msgid.link/20260313151728.14990-4-dev@lankhorst.se
> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
> [ adapted drm_dbg_printer(dev, DRM_UT_KMS, ...) call to older drm_debug_printer(...) API ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/gpu/drm/drm_file.c | 5 ++++-
> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
> 2 files changed, 10 insertions(+), 4 deletions(-)
>
> --- a/drivers/gpu/drm/drm_file.c
> +++ b/drivers/gpu/drm/drm_file.c
> @@ -248,6 +248,7 @@ static void drm_events_release(struct dr
> void drm_file_free(struct drm_file *file)
> {
> struct drm_device *dev;
> + int idx;
>
> if (!file)
> return;
> @@ -271,9 +272,11 @@ void drm_file_free(struct drm_file *file
>
> drm_events_release(file);
>
> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
> + drm_dev_enter(dev, &idx)) {
> drm_fb_release(file);
> drm_property_destroy_user_blobs(dev, file);
> + drm_dev_exit(idx);
> }
>
> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
> --- a/drivers/gpu/drm/drm_mode_config.c
> +++ b/drivers/gpu/drm/drm_mode_config.c
> @@ -543,10 +543,13 @@ void drm_mode_config_cleanup(struct drm_
> */
> WARN_ON(!list_empty(&dev->mode_config.fb_list));
> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
> - struct drm_printer p = drm_debug_printer("[leaked fb]");
> + if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
> + struct drm_printer p = drm_debug_printer("[leaked fb]");
>
> - drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
> - drm_framebuffer_print_info(&p, 1, fb);
> + drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
> + drm_framebuffer_print_info(&p, 1, fb);
> + }
> + list_del_init(&fb->filp_head);
> drm_framebuffer_free(&fb->base.refcount);
> }
>
>
>
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT
2026-04-13 20:43 ` Ben Hutchings
@ 2026-04-13 20:50 ` Ricardo Ribalda
0 siblings, 0 replies; 524+ messages in thread
From: Ricardo Ribalda @ 2026-04-13 20:50 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, stable, patches, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
On Mon, 13 Apr 2026 at 22:43, Ben Hutchings <ben@decadent.org.uk> wrote:
>
> On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> > 5.10-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Ricardo Ribalda <ribalda@chromium.org>
> >
> > [ Upstream commit 2886477ff98740cc3333cf785e4de0b1ff3d7a28 ]
>
> This is a new feature, not obviously suitable for stable.
Agree with Ben here.
if the reason for this patch is to get "media: uvcvideo: Use
heuristic to find stream entity" in 5.10 I can work on a backport that
only adds this feature without GPIO it should be pretty easy.
>
> If it really is needed for 5.10 then there are a number of bug fixes
> that also need to follow: 387e89393071 ["media: uvcvideo: Fix deferred
> probing error"), a9ea1a3d88b7 ("media: uvcvideo: Fix crash during unbind
> if gpio unit is in use"), and f0f078457f18 ("media: uvcvideo: Fix memory
> leak in uvc_gpio_parse").
>
> Ben.
>
> > Some devices can implement a physical switch to disable the input of the
> > camera on demand. Think of it like an elegant privacy sticker.
> >
> > The system can read the status of the privacy switch via a GPIO.
> >
> > It is important to know the status of the switch, e.g. to notify the
> > user when the camera will produce black frames and a videochat
> > application is used.
> >
> > In some systems, the GPIO is connected to the main SoC instead of the
> > camera controller, with the connection reported by the system firmware
> > (ACPI or DT). In that case, the UVC device isn't aware of the GPIO. We
> > need to implement a virtual entity to handle the GPIO fully on the
> > driver side.
> >
> > For example, for ACPI-based systems, the GPIO is reported in the USB
> > device object:
> >
> > Scope (\_SB.PCI0.XHCI.RHUB.HS07)
> > {
> >
> > /.../
> >
> > Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings
> > {
> > GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly,
> > "\\_SB.PCI0.GPIO", 0x00, ResourceConsumer, ,
> > )
> > { // Pin list
> > 0x0064
> > }
> > })
> > Name (_DSD, Package (0x02) // _DSD: Device-Specific Data
> > {
> > ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301") /* Device Properties for _DSD */,
> > Package (0x01)
> > {
> > Package (0x02)
> > {
> > "privacy-gpio",
> > Package (0x04)
> > {
> > \_SB.PCI0.XHCI.RHUB.HS07,
> > Zero,
> > Zero,
> > One
> > }
> > }
> > }
> > })
> > }
> >
> > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> > Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> > Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> > Stable-dep-of: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> > drivers/media/usb/uvc/uvc_ctrl.c | 3 +
> > drivers/media/usb/uvc/uvc_driver.c | 127 +++++++++++++++++++++++++++++
> > drivers/media/usb/uvc/uvc_entity.c | 1 +
> > drivers/media/usb/uvc/uvcvideo.h | 16 ++++
> > 4 files changed, 147 insertions(+)
> >
> > diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> > index 698bf5bb896ec..fc23e53c0d38b 100644
> > --- a/drivers/media/usb/uvc/uvc_ctrl.c
> > +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> > @@ -2378,6 +2378,9 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
> > } else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) {
> > bmControls = entity->camera.bmControls;
> > bControlSize = entity->camera.bControlSize;
> > + } else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) {
> > + bmControls = entity->gpio.bmControls;
> > + bControlSize = entity->gpio.bControlSize;
> > }
> >
> > /* Remove bogus/blacklisted controls */
> > diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> > index e1d3e753e80ed..b86e46fa7c0af 100644
> > --- a/drivers/media/usb/uvc/uvc_driver.c
> > +++ b/drivers/media/usb/uvc/uvc_driver.c
> > @@ -7,6 +7,7 @@
> > */
> >
> > #include <linux/atomic.h>
> > +#include <linux/gpio/consumer.h>
> > #include <linux/kernel.h>
> > #include <linux/list.h>
> > #include <linux/module.h>
> > @@ -1033,6 +1034,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
> > }
> >
> > static const u8 uvc_camera_guid[16] = UVC_GUID_UVC_CAMERA;
> > +static const u8 uvc_gpio_guid[16] = UVC_GUID_EXT_GPIO_CONTROLLER;
> > static const u8 uvc_media_transport_input_guid[16] =
> > UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
> > static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
> > @@ -1064,6 +1066,9 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
> > * is initialized by the caller.
> > */
> > switch (type) {
> > + case UVC_EXT_GPIO_UNIT:
> > + memcpy(entity->guid, uvc_gpio_guid, 16);
> > + break;
> > case UVC_ITT_CAMERA:
> > memcpy(entity->guid, uvc_camera_guid, 16);
> > break;
> > @@ -1467,6 +1472,108 @@ static int uvc_parse_control(struct uvc_device *dev)
> > return 0;
> > }
> >
> > +/* -----------------------------------------------------------------------------
> > + * Privacy GPIO
> > + */
> > +
> > +static void uvc_gpio_event(struct uvc_device *dev)
> > +{
> > + struct uvc_entity *unit = dev->gpio_unit;
> > + struct uvc_video_chain *chain;
> > + u8 new_val;
> > +
> > + if (!unit)
> > + return;
> > +
> > + new_val = gpiod_get_value_cansleep(unit->gpio.gpio_privacy);
> > +
> > + /* GPIO entities are always on the first chain. */
> > + chain = list_first_entry(&dev->chains, struct uvc_video_chain, list);
> > + uvc_ctrl_status_event(chain, unit->controls, &new_val);
> > +}
> > +
> > +static int uvc_gpio_get_cur(struct uvc_device *dev, struct uvc_entity *entity,
> > + u8 cs, void *data, u16 size)
> > +{
> > + if (cs != UVC_CT_PRIVACY_CONTROL || size < 1)
> > + return -EINVAL;
> > +
> > + *(u8 *)data = gpiod_get_value_cansleep(entity->gpio.gpio_privacy);
> > +
> > + return 0;
> > +}
> > +
> > +static int uvc_gpio_get_info(struct uvc_device *dev, struct uvc_entity *entity,
> > + u8 cs, u8 *caps)
> > +{
> > + if (cs != UVC_CT_PRIVACY_CONTROL)
> > + return -EINVAL;
> > +
> > + *caps = UVC_CONTROL_CAP_GET | UVC_CONTROL_CAP_AUTOUPDATE;
> > + return 0;
> > +}
> > +
> > +static irqreturn_t uvc_gpio_irq(int irq, void *data)
> > +{
> > + struct uvc_device *dev = data;
> > +
> > + uvc_gpio_event(dev);
> > + return IRQ_HANDLED;
> > +}
> > +
> > +static int uvc_gpio_parse(struct uvc_device *dev)
> > +{
> > + struct uvc_entity *unit;
> > + struct gpio_desc *gpio_privacy;
> > + int irq;
> > +
> > + gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy",
> > + GPIOD_IN);
> > + if (IS_ERR_OR_NULL(gpio_privacy))
> > + return PTR_ERR_OR_ZERO(gpio_privacy);
> > +
> > + unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
> > + if (!unit)
> > + return -ENOMEM;
> > +
> > + irq = gpiod_to_irq(gpio_privacy);
> > + if (irq < 0) {
> > + if (irq != EPROBE_DEFER)
> > + dev_err(&dev->udev->dev,
> > + "No IRQ for privacy GPIO (%d)\n", irq);
> > + return irq;
> > + }
> > +
> > + unit->gpio.gpio_privacy = gpio_privacy;
> > + unit->gpio.irq = irq;
> > + unit->gpio.bControlSize = 1;
> > + unit->gpio.bmControls = (u8 *)unit + sizeof(*unit);
> > + unit->gpio.bmControls[0] = 1;
> > + unit->get_cur = uvc_gpio_get_cur;
> > + unit->get_info = uvc_gpio_get_info;
> > + strncpy(unit->name, "GPIO", sizeof(unit->name) - 1);
> > +
> > + list_add_tail(&unit->list, &dev->entities);
> > +
> > + dev->gpio_unit = unit;
> > +
> > + return 0;
> > +}
> > +
> > +static int uvc_gpio_init_irq(struct uvc_device *dev)
> > +{
> > + struct uvc_entity *unit = dev->gpio_unit;
> > +
> > + if (!unit || unit->gpio.irq < 0)
> > + return 0;
> > +
> > + return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL,
> > + uvc_gpio_irq,
> > + IRQF_ONESHOT | IRQF_TRIGGER_FALLING |
> > + IRQF_TRIGGER_RISING,
> > + "uvc_privacy_gpio", dev);
> > +}
> > +
> > /* ------------------------------------------------------------------------
> > * UVC device scan
> > */
> > @@ -1988,6 +2095,13 @@ static int uvc_scan_device(struct uvc_device *dev)
> > return -1;
> > }
> >
> > + /* Add GPIO entity to the first chain. */
> > + if (dev->gpio_unit) {
> > + chain = list_first_entry(&dev->chains,
> > + struct uvc_video_chain, list);
> > + list_add_tail(&dev->gpio_unit->chain, &chain->entities);
> > + }
> > +
> > return 0;
> > }
> >
> > @@ -2350,6 +2464,12 @@ static int uvc_probe(struct usb_interface *intf,
> > goto error;
> > }
> >
> > + /* Parse the associated GPIOs. */
> > + if (uvc_gpio_parse(dev) < 0) {
> > + uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC GPIOs\n");
> > + goto error;
> > + }
> > +
> > uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
> > dev->uvc_version >> 8, dev->uvc_version & 0xff,
> > udev->product ? udev->product : "<unnamed>",
> > @@ -2394,6 +2514,13 @@ static int uvc_probe(struct usb_interface *intf,
> > "supported.\n", ret);
> > }
> >
> > + ret = uvc_gpio_init_irq(dev);
> > + if (ret < 0) {
> > + dev_err(&dev->udev->dev,
> > + "Unable to request privacy GPIO IRQ (%d)\n", ret);
> > + goto error;
> > + }
> > +
> > uvc_trace(UVC_TRACE_PROBE, "UVC device initialized.\n");
> > usb_enable_autosuspend(udev);
> > return 0;
> > diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
> > index 7c9895377118c..96e965a16d061 100644
> > --- a/drivers/media/usb/uvc/uvc_entity.c
> > +++ b/drivers/media/usb/uvc/uvc_entity.c
> > @@ -105,6 +105,7 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
> > case UVC_OTT_DISPLAY:
> > case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
> > case UVC_EXTERNAL_VENDOR_SPECIFIC:
> > + case UVC_EXT_GPIO_UNIT:
> > default:
> > function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
> > break;
> > diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
> > index 0e4209dbf307f..e9eef2170d866 100644
> > --- a/drivers/media/usb/uvc/uvcvideo.h
> > +++ b/drivers/media/usb/uvc/uvcvideo.h
> > @@ -6,6 +6,7 @@
> > #error "The uvcvideo.h header is deprecated, use linux/uvcvideo.h instead."
> > #endif /* __KERNEL__ */
> >
> > +#include <linux/atomic.h>
> > #include <linux/kernel.h>
> > #include <linux/poll.h>
> > #include <linux/usb.h>
> > @@ -37,6 +38,8 @@
> > (UVC_ENTITY_IS_TERM(entity) && \
> > ((entity)->type & 0x8000) == UVC_TERM_OUTPUT)
> >
> > +#define UVC_EXT_GPIO_UNIT 0x7ffe
> > +#define UVC_EXT_GPIO_UNIT_ID 0x100
> >
> > /* ------------------------------------------------------------------------
> > * GUIDs
> > @@ -56,6 +59,9 @@
> > #define UVC_GUID_UVC_SELECTOR \
> > {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
> > 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02}
> > +#define UVC_GUID_EXT_GPIO_CONTROLLER \
> > + {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
> > + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03}
> >
> > #define UVC_GUID_FORMAT_MJPEG \
> > { 'M', 'J', 'P', 'G', 0x00, 0x00, 0x10, 0x00, \
> > @@ -213,6 +219,7 @@
> > * Structures.
> > */
> >
> > +struct gpio_desc;
> > struct uvc_device;
> >
> > /* TODO: Put the most frequently accessed fields at the beginning of
> > @@ -354,6 +361,13 @@ struct uvc_entity {
> > u8 *bmControls;
> > u8 *bmControlsType;
> > } extension;
> > +
> > + struct {
> > + u8 bControlSize;
> > + u8 *bmControls;
> > + struct gpio_desc *gpio_privacy;
> > + int irq;
> > + } gpio;
> > };
> >
> > u8 bNrInPins;
> > @@ -696,6 +710,8 @@ struct uvc_device {
> > struct uvc_control *ctrl;
> > const void *data;
> > } async_ctrl;
> > +
> > + struct uvc_entity *gpio_unit;
> > };
> >
> > enum uvc_handle_state {
>
> --
> Ben Hutchings
> When in doubt, use brute force. - Ken Thompson
--
Ricardo Ribalda
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
2026-04-13 16:01 ` [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Greg Kroah-Hartman
@ 2026-04-13 21:10 ` Ben Hutchings
2026-04-14 10:52 ` Ulf Hansson
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-13 21:10 UTC (permalink / raw)
To: Ulf Hansson
Cc: patches, Adrian Hunter, Sasha Levin, Greg Kroah-Hartman, stable
[-- Attachment #1: Type: text/plain, Size: 3180 bytes --]
On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ulf Hansson <ulf.hansson@linaro.org>
>
> [ Upstream commit fefdd3c91e0a7b3cbb3f25925d93a57c45cb0f31 ]
>
> The mmc_hw|sw_reset() APIs are designed to be called solely from upper
> layers, which means drivers that operates on top of the struct mmc_card,
> like the mmc block device driver and an SDIO functional driver.
>
> Additionally, as long as the struct mmc_host has a valid pointer to a
> struct mmc_card, the corresponding host->bus_ops pointer stays valid and
> assigned.
>
> For these reasons, let's drop the superfluous reference counting and the
> redundant validations in mmc_hw|sw_reset().
Is this reasoning still correct for older branches such as 5.10?
And if so, do they also need commit 406e14808ee6 ("mmc: block: Remove
error check of hw_reset on reset"), which claims to fix this one? I
don't really follow the explanation in its commit message.
Ben.
>
> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
> Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
> Link: https://lore.kernel.org/r/20210212131532.236775-1-ulf.hansson@linaro.org
> Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/mmc/core/block.c | 2 +-
> drivers/mmc/core/core.c | 21 +--------------------
> 2 files changed, 2 insertions(+), 21 deletions(-)
>
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -987,7 +987,7 @@ static int mmc_blk_reset(struct mmc_blk_
> md->reset_done |= type;
> err = mmc_hw_reset(host);
> /* Ensure we switch back to the correct partition */
> - if (err != -EOPNOTSUPP) {
> + if (err) {
> struct mmc_blk_data *main_md =
> dev_get_drvdata(&host->card->dev);
> int part_err;
> --- a/drivers/mmc/core/core.c
> +++ b/drivers/mmc/core/core.c
> @@ -2096,18 +2096,7 @@ int mmc_hw_reset(struct mmc_host *host)
> {
> int ret;
>
> - if (!host->card)
> - return -EINVAL;
> -
> - mmc_bus_get(host);
> - if (!host->bus_ops || host->bus_dead || !host->bus_ops->hw_reset) {
> - mmc_bus_put(host);
> - return -EOPNOTSUPP;
> - }
> -
> ret = host->bus_ops->hw_reset(host);
> - mmc_bus_put(host);
> -
> if (ret < 0)
> pr_warn("%s: tried to HW reset card, got error %d\n",
> mmc_hostname(host), ret);
> @@ -2120,18 +2109,10 @@ int mmc_sw_reset(struct mmc_host *host)
> {
> int ret;
>
> - if (!host->card)
> - return -EINVAL;
> -
> - mmc_bus_get(host);
> - if (!host->bus_ops || host->bus_dead || !host->bus_ops->sw_reset) {
> - mmc_bus_put(host);
> + if (!host->bus_ops->sw_reset)
> return -EOPNOTSUPP;
> - }
>
> ret = host->bus_ops->sw_reset(host);
> - mmc_bus_put(host);
> -
> if (ret)
> pr_warn("%s: tried to SW reset card, got error %d\n",
> mmc_hostname(host), ret);
>
>
--
Ben Hutchings
When in doubt, use brute force. - Ken Thompson
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show()
2026-04-13 15:54 ` [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show() Greg Kroah-Hartman
@ 2026-04-14 4:16 ` Gui-Dong Han
0 siblings, 0 replies; 524+ messages in thread
From: Gui-Dong Han @ 2026-04-14 4:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Ioana Ciornei, Christophe Leroy (CS GROUP),
Sasha Levin, pchelkin
On Tue, Apr 14, 2026 at 12:43 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> 5.10-stable review patch. If anyone has any objections, please let me know.
This patch still needs its prerequisite commit 5688f212e98a ("fsl-mc:
Use driver_set_override() instead of open-coding") [1] to be queued
for the 5.10.y and 5.15.y trees.
Without it, driver_override_store() doesn't hold device_lock(), which
means the race remains and can actually trigger a double free. Fedor
and I previously sent reminders about this missing dependency here
[2][3].
Commit 5688f212e98a applies and builds cleanly on both 5.10.y and
5.15.y. Could you please queue it as well?
Thanks.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5688f212e98a
[2] https://lore.kernel.org/stable/CALbr=LY8Shn1Mk2CBu5sCwNeR=Jn7BndH+qvAZGGqWMNoJQePA@mail.gmail.com/
[3] https://lore.kernel.org/stable/20260214220547-5519e7b20a4919ddd81d97c3-pchelkin@ispras/
>
> ------------------
>
> From: Gui-Dong Han <hanguidong02@gmail.com>
>
> [ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
>
> The driver_override_show() function reads the driver_override string
> without holding the device_lock. However, driver_override_store() uses
> driver_set_override(), which modifies and frees the string while holding
> the device_lock.
>
> This can result in a concurrent use-after-free if the string is freed
> by the store function while being read by the show function.
>
> Fix this by holding the device_lock around the read operation.
>
> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
> Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
> Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
> index 8f7448da9258d..49eaf5bddd5ad 100644
> --- a/drivers/bus/fsl-mc/fsl-mc-bus.c
> +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
> @@ -194,8 +194,12 @@ static ssize_t driver_override_show(struct device *dev,
> struct device_attribute *attr, char *buf)
> {
> struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
> + ssize_t len;
>
> - return sysfs_emit(buf, "%s\n", mc_dev->driver_override);
> + device_lock(dev);
> + len = sysfs_emit(buf, "%s\n", mc_dev->driver_override);
> + device_unlock(dev);
> + return len;
> }
> static DEVICE_ATTR_RW(driver_override);
>
> --
> 2.51.0
>
>
>
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 18:52 ` Jon Hunter
@ 2026-04-14 8:02 ` Pavel Machek
2026-04-15 5:49 ` Ben Copeland
0 siblings, 1 reply; 524+ messages in thread
From: Pavel Machek @ 2026-04-14 8:02 UTC (permalink / raw)
To: Jon Hunter
Cc: Greg Kroah-Hartman, stable, patches, linux-kernel, torvalds, akpm,
linux, shuah, patches, lkft-triage, pavel, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 1948 bytes --]
On Mon 2026-04-13 19:52:08, Jon Hunter wrote:
> Hi Greg,
>
> On 13/04/2026 16:54, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.10.253 release.
> > There are 491 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
> > -------------
> > Pseudo-Shortlog of commits:
>
> ...
> > Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> > bus: omap-ocp2scp: Convert to platform remove callback returning void
>
>
> I am seeing the following build error due to the above change on ARM platforms ...
>
> drivers/bus/omap-ocp2scp.c:95:10: error: 'struct platform_driver' has no member named 'remove_new'; did you mean 'remove'?
> 95 | .remove_new = omap_ocp2scp_remove,
> | ^~~~~~~~~~
> | remove
> drivers/bus/omap-ocp2scp.c:95:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
> 95 | .remove_new = omap_ocp2scp_remove,
> | ^~~~~~~~~~~~~~~~~~~
>
We see that one, too:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/13901155305
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2450043152
Best regards,
Pavel
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
2026-04-13 21:10 ` Ben Hutchings
@ 2026-04-14 10:52 ` Ulf Hansson
0 siblings, 0 replies; 524+ messages in thread
From: Ulf Hansson @ 2026-04-14 10:52 UTC (permalink / raw)
To: Ben Hutchings
Cc: patches, Adrian Hunter, Sasha Levin, Greg Kroah-Hartman, stable
On Mon, 13 Apr 2026 at 23:10, Ben Hutchings <ben@decadent.org.uk> wrote:
>
> On Mon, 2026-04-13 at 18:01 +0200, Greg Kroah-Hartman wrote:
> > 5.10-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Ulf Hansson <ulf.hansson@linaro.org>
> >
> > [ Upstream commit fefdd3c91e0a7b3cbb3f25925d93a57c45cb0f31 ]
> >
> > The mmc_hw|sw_reset() APIs are designed to be called solely from upper
> > layers, which means drivers that operates on top of the struct mmc_card,
> > like the mmc block device driver and an SDIO functional driver.
> >
> > Additionally, as long as the struct mmc_host has a valid pointer to a
> > struct mmc_card, the corresponding host->bus_ops pointer stays valid and
> > assigned.
> >
> > For these reasons, let's drop the superfluous reference counting and the
> > redundant validations in mmc_hw|sw_reset().
>
> Is this reasoning still correct for older branches such as 5.10?
Yes, I think it should be fine.
>
> And if so, do they also need commit 406e14808ee6 ("mmc: block: Remove
> error check of hw_reset on reset"), which claims to fix this one? I
> don't really follow the explanation in its commit message.
Yes, good point, this commit is needed as well!
Kind regards
Uffe
>
> Ben.
>
> >
> > Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
> > Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
> > Link: https://lore.kernel.org/r/20210212131532.236775-1-ulf.hansson@linaro.org
> > Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > drivers/mmc/core/block.c | 2 +-
> > drivers/mmc/core/core.c | 21 +--------------------
> > 2 files changed, 2 insertions(+), 21 deletions(-)
> >
> > --- a/drivers/mmc/core/block.c
> > +++ b/drivers/mmc/core/block.c
> > @@ -987,7 +987,7 @@ static int mmc_blk_reset(struct mmc_blk_
> > md->reset_done |= type;
> > err = mmc_hw_reset(host);
> > /* Ensure we switch back to the correct partition */
> > - if (err != -EOPNOTSUPP) {
> > + if (err) {
> > struct mmc_blk_data *main_md =
> > dev_get_drvdata(&host->card->dev);
> > int part_err;
> > --- a/drivers/mmc/core/core.c
> > +++ b/drivers/mmc/core/core.c
> > @@ -2096,18 +2096,7 @@ int mmc_hw_reset(struct mmc_host *host)
> > {
> > int ret;
> >
> > - if (!host->card)
> > - return -EINVAL;
> > -
> > - mmc_bus_get(host);
> > - if (!host->bus_ops || host->bus_dead || !host->bus_ops->hw_reset) {
> > - mmc_bus_put(host);
> > - return -EOPNOTSUPP;
> > - }
> > -
> > ret = host->bus_ops->hw_reset(host);
> > - mmc_bus_put(host);
> > -
> > if (ret < 0)
> > pr_warn("%s: tried to HW reset card, got error %d\n",
> > mmc_hostname(host), ret);
> > @@ -2120,18 +2109,10 @@ int mmc_sw_reset(struct mmc_host *host)
> > {
> > int ret;
> >
> > - if (!host->card)
> > - return -EINVAL;
> > -
> > - mmc_bus_get(host);
> > - if (!host->bus_ops || host->bus_dead || !host->bus_ops->sw_reset) {
> > - mmc_bus_put(host);
> > + if (!host->bus_ops->sw_reset)
> > return -EOPNOTSUPP;
> > - }
> >
> > ret = host->bus_ops->sw_reset(host);
> > - mmc_bus_put(host);
> > -
> > if (ret)
> > pr_warn("%s: tried to SW reset card, got error %d\n",
> > mmc_hostname(host), ret);
> >
> >
>
> --
> Ben Hutchings
> When in doubt, use brute force. - Ken Thompson
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-04-13 18:52 ` Jon Hunter
@ 2026-04-14 18:20 ` Mark Brown
2026-04-14 21:39 ` Josh Law
2026-04-15 3:01 ` Barry K. Nathan
495 siblings, 1 reply; 524+ messages in thread
From: Mark Brown @ 2026-04-14 18:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 347 bytes --]
On Mon, Apr 13, 2026 at 05:54:05PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.253 release.
> There are 491 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void
2026-04-13 15:54 ` [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void Greg Kroah-Hartman
@ 2026-04-14 19:35 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-14 19:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Uwe Kleine-König, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 2513 bytes --]
On Mon, 2026-04-13 at 17:54 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
>
> [ Upstream commit 854f89a5b56354ba4135e0e1f0e57ab2caee59ee ]
>
> The .remove() callback for a platform driver returns an int which makes
> many driver authors wrongly assume it's possible to do error handling by
> returning an error code. However the value returned is ignored (apart
> from emitting a warning) and this typically results in resource leaks.
>
> To improve here there is a quest to make the remove callback return
> void. In the first step of this quest all drivers are converted to
> .remove_new(), which already returns void. Eventually after all drivers
> are converted, .remove_new() will be renamed to .remove().
But platform_driver::remove_new doesn't exist in 5.10 so this breaks the
build.
Ben.
> Trivially convert this driver from always returning zero in the remove
> callback to the void returning variant.
>
> Link: https://lore.kernel.org/r/20231109202830.4124591-3-u.kleine-koenig@pengutronix.de
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> Stable-dep-of: 5eb63e9bb65d ("bus: omap-ocp2scp: fix OF populate on driver rebind")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/bus/omap-ocp2scp.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
> index e02d0656242b8..7d7479ba0a759 100644
> --- a/drivers/bus/omap-ocp2scp.c
> +++ b/drivers/bus/omap-ocp2scp.c
> @@ -84,12 +84,10 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
> return ret;
> }
>
> -static int omap_ocp2scp_remove(struct platform_device *pdev)
> +static void omap_ocp2scp_remove(struct platform_device *pdev)
> {
> pm_runtime_disable(&pdev->dev);
> device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
> -
> - return 0;
> }
>
> #ifdef CONFIG_OF
> @@ -103,7 +101,7 @@ MODULE_DEVICE_TABLE(of, omap_ocp2scp_id_table);
>
> static struct platform_driver omap_ocp2scp_driver = {
> .probe = omap_ocp2scp_probe,
> - .remove = omap_ocp2scp_remove,
> + .remove_new = omap_ocp2scp_remove,
> .driver = {
> .name = "omap-ocp2scp",
> .of_match_table = of_match_ptr(omap_ocp2scp_id_table),
--
Ben Hutchings
73.46% of all statistics are made up.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths
2026-04-13 15:54 ` [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths Greg Kroah-Hartman
@ 2026-04-14 20:48 ` Ben Hutchings
2026-04-14 22:02 ` Bart Van Assche
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-14 20:48 UTC (permalink / raw)
To: Greg Kroah-Hartman, Bart Van Assche, Johannes Berg
Cc: patches, Sasha Levin, stable
[-- Attachment #1: Type: text/plain, Size: 2072 bytes --]
On Mon, 2026-04-13 at 17:54 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> [ Upstream commit d98c24617a831e92e7224a07dcaed2dd0b02af96 ]
>
> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
> returns zero. This mutex must be unlocked if an error is returned. Add
> mutex_unlock() calls to the error paths from which that call is missing.
These error paths already call cw1200_wow_resume() which unlocks
conf_mutex. So this is introducing and not fixing a locking bug.
Please drop this from all stable queues and revert it upstream.
> This has been detected by the Clang thread-safety analyzer.
A bug report against that analyser may also be in order!
Ben.
>
> Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> Link: https://patch.msgid.link/20260223220102.2158611-25-bart.vanassche@linux.dev
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/net/wireless/st/cw1200/pm.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/wireless/st/cw1200/pm.c b/drivers/net/wireless/st/cw1200/pm.c
> index a20ab577a3644..212b6f2af8de4 100644
> --- a/drivers/net/wireless/st/cw1200/pm.c
> +++ b/drivers/net/wireless/st/cw1200/pm.c
> @@ -264,12 +264,14 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
> wiphy_err(priv->hw->wiphy,
> "PM request failed: %d. WoW is disabled.\n", ret);
> cw1200_wow_resume(hw);
> + mutex_unlock(&priv->conf_mutex);
> return -EBUSY;
> }
>
> /* Force resume if event is coming from the device. */
> if (atomic_read(&priv->bh_rx)) {
> cw1200_wow_resume(hw);
> + mutex_unlock(&priv->conf_mutex);
> return -EAGAIN;
> }
>
--
Ben Hutchings
73.46% of all statistics are made up.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-14 18:20 ` Mark Brown
@ 2026-04-14 21:39 ` Josh Law
0 siblings, 0 replies; 524+ messages in thread
From: Josh Law @ 2026-04-14 21:39 UTC (permalink / raw)
To: broonie
Cc: achill, akpm, conor, f.fainelli, gregkh, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds
(Compiled and tested on my qemu arm and my qemu x86 machines, no dmesg
oddities or issues that should be acknowledged)
Take my
Tested-by: Josh Law <joshlaw48@gmail.com>
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths
2026-04-14 20:48 ` Ben Hutchings
@ 2026-04-14 22:02 ` Bart Van Assche
0 siblings, 0 replies; 524+ messages in thread
From: Bart Van Assche @ 2026-04-14 22:02 UTC (permalink / raw)
To: Ben Hutchings, Greg Kroah-Hartman, Johannes Berg
Cc: patches, Sasha Levin, stable
On 4/14/26 1:48 PM, Ben Hutchings wrote:
> On Mon, 2026-04-13 at 17:54 +0200, Greg Kroah-Hartman wrote:
>> [ Upstream commit d98c24617a831e92e7224a07dcaed2dd0b02af96 ]
>>
>> cw1200_wow_suspend() must only return with priv->conf_mutex locked if it
>> returns zero. This mutex must be unlocked if an error is returned. Add
>> mutex_unlock() calls to the error paths from which that call is missing.
>
> These error paths already call cw1200_wow_resume() which unlocks
> conf_mutex. So this is introducing and not fixing a locking bug.
> Please drop this from all stable queues and revert it upstream.
Agreed.
>> This has been detected by the Clang thread-safety analyzer.
>
> A bug report against that analyser may also be in order!
The analyzer is fine - I was the one who misinterpret the output of the
analyzer. The patch below should be sufficient to address what the
thread-safety analyzer reported and shouldn't introduce any functional
changes. A structure definition and a few include directives have been
moved to allow the compiler to verify the __releases() annotation at
compile time.
Bart.
diff --git a/drivers/net/wireless/st/cw1200/cw1200.h
b/drivers/net/wireless/st/cw1200/cw1200.h
index 48f808cdc1cb..583e85fd8260 100644
--- a/drivers/net/wireless/st/cw1200/cw1200.h
+++ b/drivers/net/wireless/st/cw1200/cw1200.h
@@ -24,7 +24,6 @@
#include "wsm.h"
#include "scan.h"
#include "txrx.h"
-#include "pm.h"
/* Forward declarations */
struct hwbus_ops;
@@ -88,6 +87,13 @@ struct cw1200_link_entry {
struct sk_buff_head rx_queue;
};
+struct cw1200_pm_state {
+ struct cw1200_suspend_state *suspend_state;
+ struct timer_list stay_awake;
+ struct platform_device *pm_dev;
+ spinlock_t lock; /* Protect access */
+};
+
struct cw1200_common {
/* interfaces to the rest of the stack */
struct ieee80211_hw *hw;
diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c
b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
index 2b6afe221268..5ab9211dfd4b 100644
--- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c
+++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
@@ -21,6 +21,7 @@
#include "hwbus.h"
#include <linux/platform_data/net-cw1200.h>
#include "hwio.h"
+#include "pm.h"
MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>");
MODULE_DESCRIPTION("mac80211 ST-Ericsson CW1200 SDIO driver");
diff --git a/drivers/net/wireless/st/cw1200/cw1200_spi.c
b/drivers/net/wireless/st/cw1200/cw1200_spi.c
index 52386dfb5f4a..b942472e0e69 100644
--- a/drivers/net/wireless/st/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/st/cw1200/cw1200_spi.c
@@ -24,6 +24,7 @@
#include "hwbus.h"
#include <linux/platform_data/net-cw1200.h>
#include "hwio.h"
+#include "pm.h"
MODULE_AUTHOR("Solomon Peachy <speachy@sagrad.com>");
MODULE_DESCRIPTION("mac80211 ST-Ericsson CW1200 SPI driver");
diff --git a/drivers/net/wireless/st/cw1200/pm.c
b/drivers/net/wireless/st/cw1200/pm.c
index 120f0379f81d..a7b39c75fc56 100644
--- a/drivers/net/wireless/st/cw1200/pm.c
+++ b/drivers/net/wireless/st/cw1200/pm.c
@@ -155,6 +155,7 @@ int cw1200_can_suspend(struct cw1200_common *priv)
EXPORT_SYMBOL_GPL(cw1200_can_suspend);
int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan
*wowlan)
+ __cond_acquires(0, ((struct cw1200_common *)hw->priv)->conf_mutex)
{
struct cw1200_common *priv = hw->priv;
struct cw1200_pm_state *pm_state = &priv->pm_state;
diff --git a/drivers/net/wireless/st/cw1200/pm.h
b/drivers/net/wireless/st/cw1200/pm.h
index f516eedfe03c..0074abf46ee0 100644
--- a/drivers/net/wireless/st/cw1200/pm.h
+++ b/drivers/net/wireless/st/cw1200/pm.h
@@ -9,19 +9,15 @@
#ifndef PM_H_INCLUDED
#define PM_H_INCLUDED
+#include <net/mac80211.h>
+#include "cw1200.h"
+
/* ******************************************************************** */
/* mac80211 API */
/* extern */ struct cw1200_common;
/* private */ struct cw1200_suspend_state;
-struct cw1200_pm_state {
- struct cw1200_suspend_state *suspend_state;
- struct timer_list stay_awake;
- struct platform_device *pm_dev;
- spinlock_t lock; /* Protect access */
-};
-
#ifdef CONFIG_PM
int cw1200_pm_init(struct cw1200_pm_state *pm,
struct cw1200_common *priv);
@@ -29,7 +25,8 @@ void cw1200_pm_deinit(struct cw1200_pm_state *pm);
int cw1200_wow_suspend(struct ieee80211_hw *hw,
struct cfg80211_wowlan *wowlan);
int cw1200_can_suspend(struct cw1200_common *priv);
-int cw1200_wow_resume(struct ieee80211_hw *hw);
+int cw1200_wow_resume(struct ieee80211_hw *hw)
+ __releases(((struct cw1200_common *)hw->priv)->conf_mutex);
void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
unsigned long tmo);
#else
diff --git a/drivers/net/wireless/st/cw1200/queue.c
b/drivers/net/wireless/st/cw1200/queue.c
index c2f2c118224c..d926e7c84531 100644
--- a/drivers/net/wireless/st/cw1200/queue.c
+++ b/drivers/net/wireless/st/cw1200/queue.c
@@ -12,6 +12,7 @@
#include "queue.h"
#include "cw1200.h"
#include "debug.h"
+#include "pm.h"
/* private */ struct cw1200_queue_item
{
diff --git a/drivers/net/wireless/st/cw1200/sta.c
b/drivers/net/wireless/st/cw1200/sta.c
index 5d8eaa700779..6dfdee52fdb2 100644
--- a/drivers/net/wireless/st/cw1200/sta.c
+++ b/drivers/net/wireless/st/cw1200/sta.c
@@ -17,6 +17,7 @@
#include "fwio.h"
#include "bh.h"
#include "debug.h"
+#include "pm.h"
#ifndef ERP_INFO_BYTE_OFFSET
#define ERP_INFO_BYTE_OFFSET 2
diff --git a/drivers/net/wireless/st/cw1200/txrx.c
b/drivers/net/wireless/st/cw1200/txrx.c
index 084d52b11f5b..7160059030ba 100644
--- a/drivers/net/wireless/st/cw1200/txrx.c
+++ b/drivers/net/wireless/st/cw1200/txrx.c
@@ -15,6 +15,7 @@
#include "bh.h"
#include "sta.h"
#include "debug.h"
+#include "pm.h"
#define CW1200_INVALID_RATE_ID (0xFF)
^ permalink raw reply related [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components
2026-04-13 15:55 ` [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components Greg Kroah-Hartman
@ 2026-04-14 22:15 ` Ben Hutchings
2026-04-15 9:01 ` Cezary Rojewski
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-14 22:15 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Cezary Rojewski, Amadeusz Sławiński,
Mark Brown, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1953 bytes --]
On Mon, 2026-04-13 at 17:55 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Cezary Rojewski <cezary.rojewski@intel.com>
>
> [ Upstream commit c7eb967d70446971413061effca3226578cb4dab ]
I don't think this change is safe for 5.10.
[...]
> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
> index 4294206dff362..562fbc0fb3475 100644
> --- a/sound/soc/soc-core.c
> +++ b/sound/soc/soc-core.c
> @@ -962,9 +962,6 @@ void snd_soc_remove_pcm_runtime(struct snd_soc_card *card,
>
> lockdep_assert_held(&client_mutex);
>
> - /* release machine specific resources */
> - snd_soc_link_exit(rtd);
> -
> /*
> * Notify the machine driver for extra destruction
> */
snd_soc_remove_pcm_runtime() is called from remove_link() in
soc-topology.c. I might be misunderstanding it, but it seems to free
the structure that snd_soc_link_exit() accesses immediately after
snd_soc_remove_pcm_runtime() returns.
> @@ -1928,6 +1925,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
>
> snd_soc_dapm_shutdown(card);
>
> + /* release machine specific resources */
> + for_each_card_rtds(card, rtd)
> + snd_soc_link_exit(rtd);
> /* remove and free each DAI */
> soc_remove_link_dais(card);
> soc_remove_link_components(card);
So it wouldn't be safe to defer snd_soc_link_exit() to here.
After ff9226224437 ("ASoC: topology: Change allocations to resource
managed") upstream that memory is device-managed, making the lifetime of
the link structure long enough for this to be OK. So none of the newer
branches would have this problem.
Ben.
--
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill Gates
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-04-14 18:20 ` Mark Brown
@ 2026-04-15 3:01 ` Barry K. Nathan
495 siblings, 0 replies; 524+ messages in thread
From: Barry K. Nathan @ 2026-04-15 3:01 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 4/13/26 08:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.253 release.
> There are 491 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
I took the 5.10 stable-queue as of commit
586b5ceef9af2e2148a3811f0c4814688b38b85c
("drop 4 mmc patches from queue-5.10 based on RC review feedback"),
and applied it on top of 5.10.252. This is up to date with most of the
patch drops after 5.10.253-rc1. I then tested the resulting kernel on my
Lenovo ThinkPad T14 Gen 1. It works well and I have not observed any
regressions.
Tested-by: Barry K. Nathan <barryn@pobox.com>
(As of this writing, stable-queue is now up to commit
e84a934b1e8f2f35890b51c6521a7b8678ebdc8f
("drop 1 patch from queue-5.15 and queue-5.10 based on RC review feedback")
and a few more patches were dropped from cw1200 and omap-ocp2scp. However,
the config I used for testing does not build either of those drivers,
so I don't think it really changes anything compared to what I tested.)
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-14 8:02 ` Pavel Machek
@ 2026-04-15 5:49 ` Ben Copeland
2026-04-15 10:12 ` Ben Copeland
0 siblings, 1 reply; 524+ messages in thread
From: Ben Copeland @ 2026-04-15 5:49 UTC (permalink / raw)
To: Pavel Machek
Cc: Jon Hunter, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra@vger.kernel.org
On Tue, 14 Apr 2026 at 09:03, Pavel Machek <pavel@nabladev.com> wrote:
>
> On Mon 2026-04-13 19:52:08, Jon Hunter wrote:
> > Hi Greg,
> >
> > On 13/04/2026 16:54, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 5.10.253 release.
> > > There are 491 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> > > or in the git tree and branch at:
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> > >
> > > -------------
> > > Pseudo-Shortlog of commits:
> >
> > ...
> > > Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> > > bus: omap-ocp2scp: Convert to platform remove callback returning void
> >
> >
> > I am seeing the following build error due to the above change on ARM platforms ...
> >
> > drivers/bus/omap-ocp2scp.c:95:10: error: 'struct platform_driver' has no member named 'remove_new'; did you mean 'remove'?
> > 95 | .remove_new = omap_ocp2scp_remove,
> > | ^~~~~~~~~~
> > | remove
> > drivers/bus/omap-ocp2scp.c:95:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
> > 95 | .remove_new = omap_ocp2scp_remove,
> > | ^~~~~~~~~~~~~~~~~~~
> >
>
> We see that one, too:
>
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/13901155305
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2450043152
>
> Best regards,
This was also observed on KernelCI:
https://dashboard.kernelci.org/tree/stable-rc/linux-5.10.y/0abb5988a311f0e617615aa4b08c90b3ade85c25?df%7Ca%7Carm=true
The two issues:
https://dashboard.kernelci.org/issue/maestro%3A67d434ff5d6b71886d45efe758ca00ff45cb969a?iv=1
https://dashboard.kernelci.org/issue/maestro%3Ac970827f049cfd67124148e3c19abe1d4aa8347a?iv=1
Regards
Ben
> Pavel
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components
2026-04-14 22:15 ` Ben Hutchings
@ 2026-04-15 9:01 ` Cezary Rojewski
0 siblings, 0 replies; 524+ messages in thread
From: Cezary Rojewski @ 2026-04-15 9:01 UTC (permalink / raw)
To: Ben Hutchings
Cc: patches, Amadeusz Sławiński, Mark Brown, Sasha Levin,
Greg Kroah-Hartman, stable
On 2026-04-15 12:15 AM, Ben Hutchings wrote:
> On Mon, 2026-04-13 at 17:55 +0200, Greg Kroah-Hartman wrote:
>> 5.10-stable review patch. If anyone has any objections, please let me know.
...
>> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
>> index 4294206dff362..562fbc0fb3475 100644
>> --- a/sound/soc/soc-core.c
>> +++ b/sound/soc/soc-core.c
>> @@ -962,9 +962,6 @@ void snd_soc_remove_pcm_runtime(struct snd_soc_card *card,
>>
>> lockdep_assert_held(&client_mutex);
>>
>> - /* release machine specific resources */
>> - snd_soc_link_exit(rtd);
>> -
>> /*
>> * Notify the machine driver for extra destruction
>> */
>
> snd_soc_remove_pcm_runtime() is called from remove_link() in
> soc-topology.c. I might be misunderstanding it, but it seems to free
> the structure that snd_soc_link_exit() accesses immediately after
> snd_soc_remove_pcm_runtime() returns.
Hello Ben,
Good questions all around. Now, the topology is typically loaded during
ASoC's component->probe() and removed during component->remove().
FrontEnd (FE) DAIs spawned during the topology-load process shall be
removed during topology-remove process, so component->remove(). That
remove() is the last third step - after rtd->exit()s and dai->remove()s
and just before the general snd_soc_remove_pcm_runtime().
rtds->exit()
dais->remove()
components->remove()
|_snd_soc_tplg_component_remove()
|__snd_soc_remove_pcm_runtime() // rtds spawned with tplg
snd_soc_remove_pcm_runtime() // rtds spawned without tplg
>
>> @@ -1928,6 +1925,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
>>
>> snd_soc_dapm_shutdown(card);
>>
>> + /* release machine specific resources */
>> + for_each_card_rtds(card, rtd)
>> + snd_soc_link_exit(rtd);
>> /* remove and free each DAI */
>> soc_remove_link_dais(card);
>> soc_remove_link_components(card);
>
> So it wouldn't be safe to defer snd_soc_link_exit() to here.
>
> After ff9226224437 ("ASoC: topology: Change allocations to resource
> managed") upstream that memory is device-managed, making the lifetime of
> the link structure long enough for this to be OK. So none of the newer
> branches would have this problem.
In essence, the patch fixes the teardown sequence of a card so that it
matches its startup equivalent. For simplicity, component marked as
(A), DAI with (B) and rtd with (C).
Existing v5.10 startup flow:
(A) -> (B) -> (C)
the teardown:
(B) -> (A) -> (C)
assuming we have an ASoC sound cards with components/DAIs/rtds utilizing
their custom probing procedures, it's clear that one may hit unexpected
issues when tearing down the card. Code implementing rtd->exit() shall
be able to touch the component its paired with.
Let me know if I'm missing something. Perhaps v5.10 has more modprobe
<> rmmod related problems and that's why you're hitting an obstacle.
Kind regards,
Czarek
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 000/491] 5.10.253-rc1 review
2026-04-15 5:49 ` Ben Copeland
@ 2026-04-15 10:12 ` Ben Copeland
0 siblings, 0 replies; 524+ messages in thread
From: Ben Copeland @ 2026-04-15 10:12 UTC (permalink / raw)
To: Pavel Machek
Cc: Jon Hunter, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra@vger.kernel.org
On Wed, 15 Apr 2026 at 06:49, Ben Copeland <ben.copeland@linaro.org> wrote:
>
> On Tue, 14 Apr 2026 at 09:03, Pavel Machek <pavel@nabladev.com> wrote:
> >
> > On Mon 2026-04-13 19:52:08, Jon Hunter wrote:
> > > Hi Greg,
> > >
> > > On 13/04/2026 16:54, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 5.10.253 release.
> > > > There are 491 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
> > > > Anything received after that time might be too late.
> > > >
> > > > The whole patch series can be found in one patch at:
> > > > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.253-rc1.gz
> > > > or in the git tree and branch at:
> > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> > > > and the diffstat can be found below.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > > >
> > > > -------------
> > > > Pseudo-Shortlog of commits:
> > >
> > > ...
> > > > Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> > > > bus: omap-ocp2scp: Convert to platform remove callback returning void
> > >
> > >
> > > I am seeing the following build error due to the above change on ARM platforms ...
> > >
> > > drivers/bus/omap-ocp2scp.c:95:10: error: 'struct platform_driver' has no member named 'remove_new'; did you mean 'remove'?
> > > 95 | .remove_new = omap_ocp2scp_remove,
> > > | ^~~~~~~~~~
> > > | remove
> > > drivers/bus/omap-ocp2scp.c:95:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
> > > 95 | .remove_new = omap_ocp2scp_remove,
> > > | ^~~~~~~~~~~~~~~~~~~
> > >
> >
> > We see that one, too:
> >
> > https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/13901155305
> > https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2450043152
> >
> > Best regards,
>
> This was also observed on KernelCI:
>
> https://dashboard.kernelci.org/tree/stable-rc/linux-5.10.y/0abb5988a311f0e617615aa4b08c90b3ade85c25?df%7Ca%7Carm=true
>
> The two issues:
>
> https://dashboard.kernelci.org/issue/maestro%3A67d434ff5d6b71886d45efe758ca00ff45cb969a?iv=1
> https://dashboard.kernelci.org/issue/maestro%3Ac970827f049cfd67124148e3c19abe1d4aa8347a?iv=1
I bisected it to # first bad commit:
[708f670c8e0849525742cc3a1ce319739fe74c26] bus: omap-ocp2scp: Convert
to platform remove callback returning void
Here is the log:
# bad: [0abb5988a311f0e617615aa4b08c90b3ade85c25] Linux 5.10.253-rc1
# good: [fbb1715e3efa70ec20c5b1f755f3301fd3d042eb] Linux 5.10.252
git bisect start '0abb5988a311' 'v5.10.252'
# bad: [0cbe44da7c41f095b72fb599410d0530ca80a9aa] ASoC: soc-core: move
snd_soc_runtime_set_dai_fmt() to upside
git bisect bad 0cbe44da7c41f095b72fb599410d0530ca80a9aa
# bad: [9b7ae0b9077850af955e1c8c976808feb269cc44] net: Handle
napi_schedule() calls from non-interrupt
git bisect bad 9b7ae0b9077850af955e1c8c976808feb269cc44
# bad: [eb39b81e0f85135e1e5a39b6c7bfbec77e03467b] sh: platform_early:
remove pdev->driver_override check
git bisect bad eb39b81e0f85135e1e5a39b6c7bfbec77e03467b
# bad: [a1ea84bad7500d1e346bf3714850c5a32c4d5c51] net: qrtr: Add GFP
flags parameter to qrtr_alloc_ctrl_packet
git bisect bad a1ea84bad7500d1e346bf3714850c5a32c4d5c51
# bad: [e6613448c424bc28ca19cad1e56295ae101cd9c4] usb: gadget:
dummy_hcd: fix premature URB completion when ZLP follows partial
transfer
git bisect bad e6613448c424bc28ca19cad1e56295ae101cd9c4
# good: [0f8c01ecc1771e45d065f17df934c2bdc4d6a825] drm/tegra: dsi: fix
device leak on probe
git bisect good 0f8c01ecc1771e45d065f17df934c2bdc4d6a825
# bad: [5a490afd6710b438b7fab854128d34e05e60c4bf] can: ucan: Fix
infinite loop from zero-length messages
git bisect bad 5a490afd6710b438b7fab854128d34e05e60c4bf
# bad: [5ec032ae50ff9959dccf12ccf0438c4b03032e2b] can: mcp251x: fix
deadlock in error path of mcp251x_open
git bisect bad 5ec032ae50ff9959dccf12ccf0438c4b03032e2b
# bad: [e2f4d521f05adb048145737f4f87125ab0452f25] scsi: storvsc: Fix
scheduling while atomic on PREEMPT_RT
git bisect bad e2f4d521f05adb048145737f4f87125ab0452f25
# bad: [708f670c8e0849525742cc3a1ce319739fe74c26] bus: omap-ocp2scp:
Convert to platform remove callback returning void
git bisect bad 708f670c8e0849525742cc3a1ce319739fe74c26
# bad: [fd70655e816486140fd3b8d190e98bc0390d756b] clk: tegra:
tegra124-emc: fix device leak on set_rate()
git bisect bad fd70655e816486140fd3b8d190e98bc0390d756b
# bad: [7cea67d4c59e7351b459cef6aa062127a4501923] hwmon: (max16065)
Use READ/WRITE_ONCE to avoid compiler optimization induced race
git bisect bad 7cea67d4c59e7351b459cef6aa062127a4501923
# bad: [efed6d887792cb026aef5fe3b711583b56b8037f] net: arcnet:
com20020-pci: fix support for 2.5Mbit cards
git bisect bad efed6d887792cb026aef5fe3b711583b56b8037f
# bad: [dad08fee3e0e4c9c2103fe7538af96398f7a7567] net: usb: kaweth:
validate USB endpoints
git bisect bad dad08fee3e0e4c9c2103fe7538af96398f7a7567
# bad: [2529a8fc2f31887320b59699da52508055fba791] net: usb: pegasus:
validate USB endpoints
git bisect bad 2529a8fc2f31887320b59699da52508055fba791
# first bad commit: [708f670c8e0849525742cc3a1ce319739fe74c26] bus:
omap-ocp2scp: Convert to platform remove callback returning void
Regards,
Ben
>
> Regards
>
> Ben
>
> > Pavel
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration
2026-04-13 15:56 ` [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration Greg Kroah-Hartman
@ 2026-04-15 10:22 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-15 10:22 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Ankit Garg, Jordan Rhee, Joshua Washington,
Harshitha Ramamurthy, Paolo Abeni
[-- Attachment #1: Type: text/plain, Size: 1012 bytes --]
On Mon, 2026-04-13 at 17:56 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ankit Garg <nktgrg@google.com>
>
> commit 3d970eda003441f66551a91fda16478ac0711617 upstream.
[...]
> --- a/drivers/net/ethernet/google/gve/gve_main.c
> +++ b/drivers/net/ethernet/google/gve/gve_main.c
[...]
> @@ -420,6 +422,7 @@ static void gve_remove_napi(struct gve_p
> struct gve_notify_block *block = &priv->ntfy_blocks[ntfy_idx];
>
> netif_napi_del(&block->napi);
> + disable_irq(block->irq);
The disable_irq() belongs before the netif_napi_del(). (The upstream
version got this right.)
Ben.
> }
>
> static int gve_register_qpls(struct gve_priv *priv)
>
>
--
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill Gates
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector
2026-04-13 15:57 ` [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector Greg Kroah-Hartman
@ 2026-04-15 11:55 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-15 11:55 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable, Xu Yang
Cc: patches, stable, Arnaud Ferraris, Heikki Krogerus, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 2890 bytes --]
On Mon, 2026-04-13 at 17:57 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Xu Yang <xu.yang_2@nxp.com>
>
> [ Upstream commit 8345b1539faa49fcf9c9439c3cbd97dac6eca171 ]
>
> usb_role_switch_is_parent() was walking up to the parent node and checking
> for the "usb-role-switch" property regardless of the type of the passed
> fwnode. This could cause unrelated device nodes to be probed as potential
> role switch parent, leading to spurious matches and "-EPROBE_DEFER" being
> returned infinitely.
>
> Till now only Type-B connector node will have a parent node which may
> present "usb-role-switch" property and register the role switch device.
> For Type-C connector node, its parent node will always be a Type-C chip
> device which will never register the role switch device. However, it may
> still present a non-boolean "usb-role-switch = <&usb_controller>" property
> for historical compatibility.
>
> So restrict the helper to only operate on Type-B connector when attempting
> to get the role switch from parent node.
Is this safe to backport? It seems like very few device trees on older
branches have the compatible string that will now be required.
Ben.
> Fixes: 6fadd72943b8 ("usb: roles: get usb-role-switch from parent")
> Cc: stable <stable@kernel.org>
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> Tested-by: Arnaud Ferraris <arnaud.ferraris@collabora.com>
> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Link: https://patch.msgid.link/20260309074313.2809867-3-xu.yang_2@nxp.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> [ replace fwnode_device_is_compatible() call with it's expansion ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/usb/roles/class.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> --- a/drivers/usb/roles/class.c
> +++ b/drivers/usb/roles/class.c
> @@ -108,9 +108,14 @@ static void *usb_role_switch_match(struc
> static struct usb_role_switch *
> usb_role_switch_is_parent(struct fwnode_handle *fwnode)
> {
> - struct fwnode_handle *parent = fwnode_get_parent(fwnode);
> + struct fwnode_handle *parent;
> struct device *dev;
>
> + if (fwnode_property_match_string(fwnode, "compatible", "usb-b-connector") < 0)
> + return NULL;
> +
> + parent = fwnode_get_parent(fwnode);
> +
> if (!fwnode_property_present(parent, "usb-role-switch")) {
> fwnode_handle_put(parent);
> return NULL;
>
>
--
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill Gates
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device
2026-04-13 15:57 ` [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device Greg Kroah-Hartman
@ 2026-04-15 12:10 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-15 12:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Marc Kleine-Budde, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 2293 bytes --]
On Mon, 2026-04-13 at 17:57 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Marc Kleine-Budde <mkl@pengutronix.de>
>
> [ Upstream commit 2df6162785f31f1bbb598cfc3b08e4efc88f80b6 ]
[...]
> --- a/drivers/net/can/usb/gs_usb.c
> +++ b/drivers/net/can/usb/gs_usb.c
> @@ -413,9 +413,8 @@ static void gs_usb_receive_bulk_callback
> }
> }
>
> -static int gs_usb_set_bittiming(struct net_device *netdev)
> +static int gs_usb_set_bittiming(struct gs_can *dev)
> {
> - struct gs_can *dev = netdev_priv(netdev);
> struct can_bittiming *bt = &dev->can.bittiming;
> struct usb_interface *intf = dev->iface;
> int rc;
> @@ -445,7 +444,7 @@ static int gs_usb_set_bittiming(struct n
> kfree(dbt);
>
> if (rc < 0)
> - dev_err(netdev->dev.parent, "Couldn't set bittimings (err=%d)",
> + dev_err(dev->netdev->dev.parent, "Couldn't set bittimings (err=%d)",
> rc);
>
> return (rc > 0) ? 0 : rc;
> @@ -675,6 +674,13 @@ static int gs_can_open(struct net_device
> if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
> flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
>
> + rc = gs_usb_set_bittiming(dev);
> + if (rc) {
> + netdev_err(netdev, "failed to set bittiming: %pe\n", ERR_PTR(rc));
> + kfree(dm);
This error path leaks the URBs allocated above (but the upstream version
does not have this problem).
I think it would make sense to backport commit 2603be9e8167 ("can:
gs_usb: gs_can_open(): improve error handling") before this one.
Ben.
> + return rc;
> + }
> +
> /* finally start device */
> dev->can.state = CAN_STATE_ERROR_ACTIVE;
> dm->mode = cpu_to_le32(GS_CAN_MODE_START);
> @@ -888,7 +894,6 @@ static struct gs_can *gs_make_candev(uns
> dev->can.state = CAN_STATE_STOPPED;
> dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
> dev->can.bittiming_const = &dev->bt_const;
> - dev->can.do_set_bittiming = gs_usb_set_bittiming;
>
> dev->can.ctrlmode_supported = 0;
>
>
>
--
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill Gates
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
2026-04-13 15:57 ` [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Greg Kroah-Hartman
@ 2026-04-15 12:42 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-15 12:42 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable, Peddolla Harshavardhan Reddy,
Johannes Berg
Cc: patches, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 2613 bytes --]
On Mon, 2026-04-13 at 17:57 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
>
> [ Upstream commit 6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 ]
>
> When the nl80211 socket that originated a PMSR request is
> closed, cfg80211_release_pmsr() sets the request's nl_portid
> to zero and schedules pmsr_free_wk to process the abort
> asynchronously. If the interface is concurrently torn down
> before that work runs, cfg80211_pmsr_wdev_down() calls
> cfg80211_pmsr_process_abort() directly. However, the already-
> scheduled pmsr_free_wk work item remains pending and may run
> after the interface has been removed from the driver. This
> could cause the driver's abort_pmsr callback to operate on a
> torn-down interface, leading to undefined behavior and
> potential crashes.
>
> Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()
> before calling cfg80211_pmsr_process_abort(). This ensures any
> pending or in-progress work is drained before interface teardown
> proceeds, preventing the work from invoking the driver abort
> callback after the interface is gone.
But cfg80211_pmsr_wdev_down() holds the wiphy lock which the work item
also tries to acquire. Cancelling it synchronously can then lead to
deadlock.
I don't know whether this is also a problem upstream, as locking in
cfg80211 has changed significantly since 5.10.
Ben.
> Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
> Link: https://patch.msgid.link/20260305160712.1263829-3-peddolla.reddy@oss.qualcomm.com
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> net/wireless/pmsr.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
> index 7503c7dd71ab5..32cea07b98fd1 100644
> --- a/net/wireless/pmsr.c
> +++ b/net/wireless/pmsr.c
> @@ -620,6 +620,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
> }
> spin_unlock_bh(&wdev->pmsr_lock);
>
> + cancel_work_sync(&wdev->pmsr_free_wk);
> if (found)
> cfg80211_pmsr_process_abort(wdev);
>
--
Ben Hutchings
The obvious mathematical breakthrough [to break modern encryption]
would be development of an easy way to factor large prime numbers.
- Bill Gates
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
2026-04-13 15:59 ` [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Greg Kroah-Hartman
@ 2026-04-16 17:58 ` Ben Hutchings
2026-04-16 18:20 ` Marek Vasut
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-16 17:58 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Marek Vasut, Vinod Koul, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 2747 bytes --]
On Mon, 2026-04-13 at 17:59 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Marek Vasut <marex@nabladev.com>
>
> [ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
>
> The segment .control and .status fields both contain top bits which are
> not part of the buffer size, the buffer size is located only in the bottom
> max_buffer_len bits. To avoid interference from those top bits, mask out
> the size using max_buffer_len first, and only then subtract the values.
This change is harmless, but the problem it claims to fix does not
exist.
Ben.
> Fixes: a575d0b4e663 ("dmaengine: xilinx_dma: Introduce xilinx_dma_get_residue")
> Signed-off-by: Marek Vasut <marex@nabladev.com>
> Link: https://patch.msgid.link/20260316222530.163815-1-marex@nabladev.com
> Signed-off-by: Vinod Koul <vkoul@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/dma/xilinx/xilinx_dma.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
> index ca80a1dee8489..a89a150be3284 100644
> --- a/drivers/dma/xilinx/xilinx_dma.c
> +++ b/drivers/dma/xilinx/xilinx_dma.c
> @@ -964,16 +964,16 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
> struct xilinx_cdma_tx_segment,
> node);
> cdma_hw = &cdma_seg->hw;
> - residue += (cdma_hw->control - cdma_hw->status) &
> - chan->xdev->max_buffer_len;
> + residue += (cdma_hw->control & chan->xdev->max_buffer_len) -
> + (cdma_hw->status & chan->xdev->max_buffer_len);
> } else if (chan->xdev->dma_config->dmatype ==
> XDMA_TYPE_AXIDMA) {
> axidma_seg = list_entry(entry,
> struct xilinx_axidma_tx_segment,
> node);
> axidma_hw = &axidma_seg->hw;
> - residue += (axidma_hw->control - axidma_hw->status) &
> - chan->xdev->max_buffer_len;
> + residue += (axidma_hw->control & chan->xdev->max_buffer_len) -
> + (axidma_hw->status & chan->xdev->max_buffer_len);
> } else {
> aximcdma_seg =
> list_entry(entry,
> @@ -981,8 +981,8 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
> node);
> aximcdma_hw = &aximcdma_seg->hw;
> residue +=
> - (aximcdma_hw->control - aximcdma_hw->status) &
> - chan->xdev->max_buffer_len;
> + (aximcdma_hw->control & chan->xdev->max_buffer_len) -
> + (aximcdma_hw->status & chan->xdev->max_buffer_len);
> }
> }
>
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
2026-04-16 17:58 ` Ben Hutchings
@ 2026-04-16 18:20 ` Marek Vasut
2026-04-16 18:43 ` Ben Hutchings
0 siblings, 1 reply; 524+ messages in thread
From: Marek Vasut @ 2026-04-16 18:20 UTC (permalink / raw)
To: Ben Hutchings, Greg Kroah-Hartman, stable
Cc: patches, Vinod Koul, Sasha Levin
On 4/16/26 7:58 PM, Ben Hutchings wrote:
> On Mon, 2026-04-13 at 17:59 +0200, Greg Kroah-Hartman wrote:
>> 5.10-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Marek Vasut <marex@nabladev.com>
>>
>> [ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
>>
>> The segment .control and .status fields both contain top bits which are
>> not part of the buffer size, the buffer size is located only in the bottom
>> max_buffer_len bits. To avoid interference from those top bits, mask out
>> the size using max_buffer_len first, and only then subtract the values.
>
> This change is harmless, but the problem it claims to fix does not
> exist.
The current code subtracts two independently read values which both
contain status/control MSbits and the actual value LSbits. Depending on
the MSbits being identical in both separately read values is unsafe, so
the change in this patch masks out the MSbits first and then does the
subtraction on the actual value LSbits only, which is safe.
Why do you think the original unsafe behavior can not trigger a failure?
> Ben.
>
>> Fixes: a575d0b4e663 ("dmaengine: xilinx_dma: Introduce xilinx_dma_get_residue")
>> Signed-off-by: Marek Vasut <marex@nabladev.com>
>> Link: https://patch.msgid.link/20260316222530.163815-1-marex@nabladev.com
>> Signed-off-by: Vinod Koul <vkoul@kernel.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/dma/xilinx/xilinx_dma.c | 12 ++++++------
>> 1 file changed, 6 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
>> index ca80a1dee8489..a89a150be3284 100644
>> --- a/drivers/dma/xilinx/xilinx_dma.c
>> +++ b/drivers/dma/xilinx/xilinx_dma.c
>> @@ -964,16 +964,16 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
>> struct xilinx_cdma_tx_segment,
>> node);
>> cdma_hw = &cdma_seg->hw;
>> - residue += (cdma_hw->control - cdma_hw->status) &
>> - chan->xdev->max_buffer_len;
>> + residue += (cdma_hw->control & chan->xdev->max_buffer_len) -
>> + (cdma_hw->status & chan->xdev->max_buffer_len);
>> } else if (chan->xdev->dma_config->dmatype ==
>> XDMA_TYPE_AXIDMA) {
>> axidma_seg = list_entry(entry,
>> struct xilinx_axidma_tx_segment,
>> node);
>> axidma_hw = &axidma_seg->hw;
>> - residue += (axidma_hw->control - axidma_hw->status) &
>> - chan->xdev->max_buffer_len;
>> + residue += (axidma_hw->control & chan->xdev->max_buffer_len) -
>> + (axidma_hw->status & chan->xdev->max_buffer_len);
>> } else {
>> aximcdma_seg =
>> list_entry(entry,
>> @@ -981,8 +981,8 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
>> node);
>> aximcdma_hw = &aximcdma_seg->hw;
>> residue +=
>> - (aximcdma_hw->control - aximcdma_hw->status) &
>> - chan->xdev->max_buffer_len;
>> + (aximcdma_hw->control & chan->xdev->max_buffer_len) -
>> + (aximcdma_hw->status & chan->xdev->max_buffer_len);
>> }
>> }
>>
[...]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
2026-04-16 18:20 ` Marek Vasut
@ 2026-04-16 18:43 ` Ben Hutchings
2026-04-18 16:51 ` Marek Vasut
0 siblings, 1 reply; 524+ messages in thread
From: Ben Hutchings @ 2026-04-16 18:43 UTC (permalink / raw)
To: Marek Vasut, Greg Kroah-Hartman, stable; +Cc: patches, Vinod Koul, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1737 bytes --]
On Thu, 2026-04-16 at 20:20 +0200, Marek Vasut wrote:
> On 4/16/26 7:58 PM, Ben Hutchings wrote:
> > On Mon, 2026-04-13 at 17:59 +0200, Greg Kroah-Hartman wrote:
> > > 5.10-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Marek Vasut <marex@nabladev.com>
> > >
> > > [ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
> > >
> > > The segment .control and .status fields both contain top bits which are
> > > not part of the buffer size, the buffer size is located only in the bottom
> > > max_buffer_len bits. To avoid interference from those top bits, mask out
> > > the size using max_buffer_len first, and only then subtract the values.
> >
> > This change is harmless, but the problem it claims to fix does not
> > exist.
>
> The current code subtracts two independently read values which both
> contain status/control MSbits and the actual value LSbits. Depending on
> the MSbits being identical in both separately read values is unsafe, so
> the change in this patch masks out the MSbits first and then does the
> subtraction on the actual value LSbits only, which is safe.
>
> Why do you think the original unsafe behavior can not trigger a failure?
The old code masked out the MSbits after subtraction. So, there was no
dependency on their being equal before substraction. Since borrows
propagate to the left, not the right, the MSbits could not "interfere"
with the LSbits.
If you still aren't convinced, please try to find some example values
for which the result would actually change.
Ben.
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
2026-04-13 16:00 ` [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Greg Kroah-Hartman
@ 2026-04-18 11:38 ` Ben Hutchings
0 siblings, 0 replies; 524+ messages in thread
From: Ben Hutchings @ 2026-04-18 11:38 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Yoshihiro Shimoda, Lad Prabhakar, Claudiu Beznea,
Vinod Koul, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 546 bytes --]
On Mon, 2026-04-13 at 18:00 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
>
> commit 55a387ebb9219cbe4edfa8ba9996ccb0e7ad4932 upstream.
[...]
This backport wrongly omitted the conversion of msleep() to mdelay()
inside rcar_gen3_init_otg(), which is now called in atomic context.
Ben.
--
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 524+ messages in thread
* Re: [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
2026-04-16 18:43 ` Ben Hutchings
@ 2026-04-18 16:51 ` Marek Vasut
0 siblings, 0 replies; 524+ messages in thread
From: Marek Vasut @ 2026-04-18 16:51 UTC (permalink / raw)
To: Ben Hutchings, Greg Kroah-Hartman, stable
Cc: patches, Vinod Koul, Sasha Levin
On 4/16/26 8:43 PM, Ben Hutchings wrote:
> On Thu, 2026-04-16 at 20:20 +0200, Marek Vasut wrote:
>> On 4/16/26 7:58 PM, Ben Hutchings wrote:
>>> On Mon, 2026-04-13 at 17:59 +0200, Greg Kroah-Hartman wrote:
>>>> 5.10-stable review patch. If anyone has any objections, please let me know.
>>>>
>>>> ------------------
>>>>
>>>> From: Marek Vasut <marex@nabladev.com>
>>>>
>>>> [ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
>>>>
>>>> The segment .control and .status fields both contain top bits which are
>>>> not part of the buffer size, the buffer size is located only in the bottom
>>>> max_buffer_len bits. To avoid interference from those top bits, mask out
>>>> the size using max_buffer_len first, and only then subtract the values.
>>>
>>> This change is harmless, but the problem it claims to fix does not
>>> exist.
>>
>> The current code subtracts two independently read values which both
>> contain status/control MSbits and the actual value LSbits. Depending on
>> the MSbits being identical in both separately read values is unsafe, so
>> the change in this patch masks out the MSbits first and then does the
>> subtraction on the actual value LSbits only, which is safe.
>>
>> Why do you think the original unsafe behavior can not trigger a failure?
>
> The old code masked out the MSbits after subtraction. So, there was no
> dependency on their being equal before substraction. Since borrows
> propagate to the left, not the right, the MSbits could not "interfere"
> with the LSbits.
>
> If you still aren't convinced, please try to find some example values
> for which the result would actually change.
Ah sigh, you're right. I will add this into the list of lessons learnt
the hard way. Thank you for the clarification.
^ permalink raw reply [flat|nested] 524+ messages in thread
end of thread, other threads:[~2026-04-18 16:51 UTC | newest]
Thread overview: 524+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-13 15:54 [PATCH 5.10 000/491] 5.10.253-rc1 review Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 001/491] ARM: clean up the memset64() C wrapper Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 002/491] ip6_tunnel: Fix usage of skb_vlan_inet_prepare() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 003/491] scsi: lpfc: Properly set WC for DPP mapping Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 004/491] scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 005/491] ALSA: usb-audio: Cap the packet size pre-calculations Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 006/491] btrfs: fix incorrect key offset in error message in check_dev_extent_item() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 007/491] ARM: OMAP2+: add missing of_node_put before break and return Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 008/491] ARM: omap2: Fix reference count leaks in omap_control_init() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 009/491] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show() Greg Kroah-Hartman
2026-04-14 4:16 ` Gui-Dong Han
2026-04-13 15:54 ` [PATCH 5.10 011/491] drm/tegra: dsi: fix device leak on probe Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 012/491] bus: omap-ocp2scp: Convert to platform remove callback returning void Greg Kroah-Hartman
2026-04-14 19:35 ` Ben Hutchings
2026-04-13 15:54 ` [PATCH 5.10 013/491] bus: omap-ocp2scp: fix OF populate on driver rebind Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 014/491] clk: tegra: tegra124-emc: fix device leak on set_rate() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 015/491] ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 016/491] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 017/491] ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 018/491] net: arcnet: com20020-pci: fix support for 2.5Mbit cards Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 019/491] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 020/491] nfc: pn533: properly drop the usb interface reference on disconnect Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 021/491] net: usb: kaweth: validate USB endpoints Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 022/491] net: usb: kalmia: " Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 023/491] net: usb: pegasus: " Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 024/491] can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 025/491] can: ucan: Fix infinite loop from zero-length messages Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 026/491] HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 027/491] x86/efi: defer freeing of boot services memory Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 028/491] ALSA: usb-audio: Use correct version for UAC3 header validation Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 029/491] wifi: radiotap: reject radiotap with unknown bits Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 030/491] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 031/491] net/sched: ets: fix divide by zero in the offload path Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 032/491] Squashfs: check metadata block offset is within range Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 033/491] drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 034/491] selftests: mptcp: more stable simult_flows tests Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 035/491] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 036/491] net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 037/491] atm: lec: fix null-ptr-deref in lec_arp_clear_vccs Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 038/491] can: bcm: fix locking for bcm_op runtime updates Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 039/491] can: mcp251x: fix deadlock in error path of mcp251x_open Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 040/491] wifi: cw1200: Fix locking in error paths Greg Kroah-Hartman
2026-04-14 20:48 ` Ben Hutchings
2026-04-14 22:02 ` Bart Van Assche
2026-04-13 15:54 ` [PATCH 5.10 041/491] wifi: wlcore: Fix a locking bug Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 042/491] indirect_call_wrapper: do not reevaluate function pointer Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 043/491] xen/acpi-processor: fix _CST detection using undersized evaluation buffer Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 044/491] ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 045/491] amd-xgbe: fix sleep while atomic on suspend/resume Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 046/491] net: nfc: nci: Fix zero-length proprietary notifications Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 047/491] nfc: nci: free skb on nci_transceive early error paths Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 048/491] nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 049/491] nfc: rawsock: cancel tx_work before socket teardown Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 050/491] net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 051/491] net: vxlan: " Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 052/491] net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 053/491] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Greg Kroah-Hartman
2026-04-13 15:54 ` [PATCH 5.10 054/491] ACPI: PM: Save NVS memory on Lenovo G70-35 Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 055/491] unshare: fix unshare_fs() handling Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 056/491] ACPI: OSI: Add DMI quirk for Acer Aspire One D255 Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 057/491] scsi: ses: Fix devices attaching to different hosts Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 058/491] powerpc/uaccess: Fix inline assembly for clang build on PPC32 Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 059/491] remoteproc: sysmon: Correct subsys_name_len type in QMI request Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 060/491] powerpc: 83xx: km83xx: Fix keymile vendor prefix Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 061/491] bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 062/491] net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 063/491] net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 064/491] ASoC: soc-core: drop delayed_work_pending() check before flush Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 065/491] ASoC: topology: use inclusive language for bclk and fsync Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 066/491] ASoC: dont indicate error message for snd_soc_[pcm_]dai_xxx() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 067/491] ASoC: soc-core: move snd_soc_runtime_set_dai_fmt() to upside Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 068/491] ASoC: soc-core: add snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 069/491] ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 070/491] ASoC: core: Exit all links before removing their components Greg Kroah-Hartman
2026-04-14 22:15 ` Ben Hutchings
2026-04-15 9:01 ` Cezary Rojewski
2026-04-13 15:55 ` [PATCH 5.10 071/491] ASoC: core: Do not call link_exit() on uninitialized rtd objects Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 072/491] ASoC: soc-core: flush delayed work before removing DAIs and widgets Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 073/491] serial: caif: hold tty->link reference in ldisc_open and ser_release Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 074/491] can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 075/491] netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 076/491] netfilter: x_tables: guard option walkers against 1-byte tail reads Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 077/491] netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 078/491] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 079/491] netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 080/491] regulator: pca9450: Make IRQ optional Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 081/491] regulator: pca9450: Correct interrupt type Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 082/491] sched: idle: Make skipping governor callbacks more consistent Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 083/491] nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 084/491] i40e: fix src IP mask checks and memcpy argument names in cloud filter Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 085/491] e1000/e1000e: Fix leak in DMA error cleanup Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 086/491] ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 087/491] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 088/491] ASoC: detect empty DMI strings Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 089/491] cgroup: fix race between task migration and iteration Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 090/491] net: usb: lan78xx: fix silent drop of packets with checksum errors Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 091/491] net: usb: lan78xx: skip LTM configuration for LAN7850 Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 092/491] usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 093/491] usb: xhci: Fix memory leak in xhci_disable_slot() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 094/491] usb: yurex: fix race in probe Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 095/491] usb: misc: uss720: properly clean up reference in uss720_probe() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 096/491] usb: core: dont power off roothub PHYs if phy_set_mode() fails Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 097/491] usb: cdc-acm: Restore CAP_BRK functionnality to CH343 Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 098/491] USB: usbcore: Introduce usb_bulk_msg_killable() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 099/491] USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 100/491] USB: core: Limit the length of unkillable synchronous timeouts Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 101/491] usb: class: cdc-wdm: fix reordering issue in read code path Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 102/491] usb: renesas_usbhs: fix use-after-free in ISR during device removal Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 103/491] usb: mdc800: handle signal and read racing Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 104/491] usb: image: mdc800: kill download URB on timeout Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 105/491] mm/tracing: rss_stat: ensure curr is false from kthread context Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 106/491] mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 107/491] tipc: fix divide-by-zero in tipc_sk_filter_connect() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 108/491] libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 109/491] ceph: fix i_nlink underrun during async unlink Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 110/491] time: add kernel-doc in time.c Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 111/491] time/jiffies: Mark jiffies_64_to_clock_t() notrace Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 112/491] irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 113/491] staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie Greg Kroah-Hartman
2026-04-13 15:55 ` [PATCH 5.10 114/491] staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 115/491] media: dvb-net: fix OOB access in ULE extension header tables Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 116/491] batman-adv: Avoid double-rtnl_lock ELP metric worker Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 117/491] parisc: Increase initial mapping to 64 MB with KALLSYMS Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 118/491] nouveau/dpcd: return EBUSY for aux xfer if the device is asleep Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 119/491] parisc: Fix initial page table creation for boot Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 120/491] net: ncsi: fix skb leak in error paths Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 121/491] net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 122/491] drm/amdgpu: Fix use-after-free race in VM acquire Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 123/491] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 124/491] lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 125/491] x86/apic: Disable x2apic on resume if the kernel expects so Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 126/491] lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 127/491] lib/bootconfig: check bounds before writing in __xbc_open_brace() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 128/491] btrfs: abort transaction on failure to update root in the received subvol ioctl Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 129/491] iio: dac: ds4424: reject -128 RAW value Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 130/491] iio: potentiometer: mcp4131: fix double application of wiper shift Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 131/491] iio: chemical: bme680: Fix measurement wait duration calculation Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 132/491] iio: gyro: mpu3050-core: fix pm_runtime error handling Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 133/491] iio: gyro: mpu3050-i2c: " Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 134/491] iio: imu: inv_icm42600: fix odr switch to the same value Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 135/491] bpf: Forget ranges when refining tnum after JSET Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 136/491] l2tp: do not use sock_hold() in pppol2tp_session_get_sock() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 137/491] io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 138/491] sunrpc: fix cache_request leak in cache_release Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 139/491] nvdimm/bus: Fix potential use after free in asynchronous initialization Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 140/491] NFC: nxp-nci: allow GPIOs to sleep Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 141/491] net: macb: fix use-after-free access to PTP clock Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 142/491] Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 143/491] Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 144/491] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 145/491] mmc: sdhci: fix timing selection for 1-bit bus width Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 146/491] mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 147/491] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 148/491] serial: 8250_pci: add support for the AX99100 Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 149/491] serial: 8250: Fix TX deadlock when using DMA Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 150/491] serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 151/491] drm/radeon: apply state adjust rules to some additional HAINAN vairants Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 152/491] net: Handle napi_schedule() calls from non-interrupt Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 153/491] gve: defer interrupt enabling until NAPI registration Greg Kroah-Hartman
2026-04-15 10:22 ` Ben Hutchings
2026-04-13 15:56 ` [PATCH 5.10 154/491] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 155/491] drm/exynos: vidi: fix to avoid directly dereferencing user pointer Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 156/491] drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 157/491] ext4: dont set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 158/491] ext4: drop extent cache when splitting extent fails Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 159/491] ext4: fix dirtyclusters double decrement on fs shutdown Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 160/491] ata: libata: remove pointless VPRINTK() calls Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 161/491] ata: libata-scsi: refactor ata_scsi_translate() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 162/491] wifi: libertas: fix use-after-free in lbs_free_adapter() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 163/491] wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 164/491] wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 165/491] smb: client: Dont log plaintext credentials in cifs_set_cifscreds Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 166/491] net: phy: register phy led_triggers during probe to avoid AB-BA deadlock Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 167/491] drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 168/491] net/sched: act_gate: snapshot parameters with RCU on replace Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 169/491] s390/xor: Fix xor_xc_2() inline assembly constraints Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 170/491] iomap: reject delalloc mappings during writeback Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 171/491] tracing: Fix syscall events activation by ensuring refcount hits zero Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 172/491] pmdomain: bcm: bcm2835-power: Fix broken reset status read Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 173/491] iio: light: bh1780: fix PM runtime leak on error path Greg Kroah-Hartman
2026-04-13 15:56 ` [PATCH 5.10 174/491] smb: client: fix atomic open with O_DIRECT & O_SYNC Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 175/491] smb: client: fix iface port assignment in parse_server_interfaces Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 176/491] s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 177/491] xfs: ensure dquot item is deleted from AIL only after log shutdown Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 178/491] xfs: fix integer overflow in bmap intent sort comparator Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 179/491] crypto: atmel-sha204a - Fix OOM ->tfm_count leak Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 180/491] drm/msm: Fix dma_free_attrs() buffer size Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 181/491] arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 182/491] nfsd: define exports_proc_ops with CONFIG_PROC_FS Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 183/491] NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 184/491] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 185/491] mtd: partitions: redboot: fix style issues Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 186/491] mtd: Avoid boot crash in RedBoot partition table parser Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 187/491] pmdomain: bcm: bcm2835-power: Increase ASB control timeout Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 188/491] iio: imu: inv_icm42600: fix odr switch when turning buffer off Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 189/491] usb: roles: get usb role switch from parent only for usb-b-connector Greg Kroah-Hartman
2026-04-15 11:55 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 190/491] usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 191/491] can: gs_usb: gs_can_open(): always configure bitrates before starting device Greg Kroah-Hartman
2026-04-15 12:10 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 192/491] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 193/491] ALSA: pcm: fix wait_time calculations Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 194/491] ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 195/491] smb: client: Compare MACs in constant time Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 196/491] net/tcp-md5: Fix MAC comparison to be constant-time Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 197/491] staging: rtl8723bs: fix null dereference in find_network Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 198/491] soc: fsl: qbman: fix race condition in qman_destroy_fq Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 199/491] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down Greg Kroah-Hartman
2026-04-15 12:42 ` Ben Hutchings
2026-04-13 15:57 ` [PATCH 5.10 200/491] Bluetooth: LE L2CAP: Disconnect if received packets SDU exceeds IMTU Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 201/491] Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 202/491] Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 203/491] Bluetooth: HIDP: Fix possible UAF Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 204/491] net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 205/491] netfilter: ctnetlink: remove refcounting in expectation dumpers Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 206/491] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 207/491] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 208/491] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 209/491] netfilter: nft_ct: add seqadj extension for natted connections Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 210/491] netfilter: nft_ct: drop pending enqueued packets on removal Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 211/491] netfilter: xt_CT: drop pending enqueued packets on template removal Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 212/491] netfilter: xt_time: use unsigned int for monthday bit shift Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 213/491] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 214/491] net: bcmgenet: increase WoL poll timeout Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 215/491] sched: idle: Consolidate the handling of two special cases Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 216/491] PM: runtime: Fix a race condition related to device removal Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 217/491] net: usb: aqc111: Do not perform PM inside suspend callback Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 218/491] igc: fix missing update of skb->tail in igc_xmit_frame() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 219/491] wifi: mac80211: fix NULL deref in mesh_matches_local() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 220/491] wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 221/491] net: macb: fix uninitialized rx_fs_lock Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 222/491] udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 223/491] net: bonding: fix NULL deref in bond_debug_rlb_hash_show Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 224/491] nfnetlink_osf: validate individual option lengths in fingerprints Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 225/491] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 226/491] icmp: fix NULL pointer dereference in icmp_tag_validation() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 227/491] hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 228/491] i2c: fsi: Fix a potential leak in fsi_i2c_probe() Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 229/491] mtd: rawnand: serialize lock/unlock against other NAND operations Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 230/491] mtd: rawnand: brcmnand: read/write oob during EDU transfer Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 231/491] mtd: rawnand: brcmnand: move to polling in pio mode on oops write Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 232/491] mtd: rawnand: brcmnand: skip DMA during panic write Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 233/491] tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure Greg Kroah-Hartman
2026-04-13 15:57 ` [PATCH 5.10 234/491] netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 235/491] xen/privcmd: restrict usage in unprivileged domU Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 236/491] xen/privcmd: add boot control for restricted usage in domU Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 237/491] sh: platform_early: remove pdev->driver_override check Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 238/491] HID: asus: avoid memory leak in asus_report_fixup() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 239/491] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 240/491] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 241/491] nvme-pci: ensure were polling a polled queue Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 242/491] HID: mcp2221: cancel last I2C command on read error Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 243/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 244/491] ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 245/491] dma-buf: Include ioctl.h in UAPI header Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 246/491] ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 247/491] xfrm: call xdo_dev_state_delete during state update Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 248/491] xfrm: Fix the usage of skb->sk Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 249/491] esp: fix skb leak with espintcp and async crypto Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 250/491] af_key: validate families in pfkey_send_migrate() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 251/491] can: statistics: add missing atomic access in hot path Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 252/491] Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 253/491] Bluetooth: hci_ll: Fix firmware leak on error path Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 254/491] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 255/491] pinctrl: mediatek: common: Fix probe failure for devices without EINT Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 256/491] nfc: nci: fix circular locking dependency in nci_close_device Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 257/491] net: openvswitch: Avoid releasing netdev before teardown completes Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 258/491] openvswitch: validate MPLS set/set_masked payload length Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 259/491] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 260/491] rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 261/491] platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 262/491] net: fix fanout UAF in packet_release() via NETDEV_UP race Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 263/491] net: enetc: fix the output issue of ethtool --show-ring Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 264/491] dma-mapping: add missing `inline` for `dma_free_attrs` Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 265/491] Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 266/491] Bluetooth: btusb: clamp SCO altsetting table indices Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 267/491] netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 268/491] netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 269/491] netfilter: nf_conntrack_expect: skip expectations in other netns via proc Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 270/491] netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 271/491] netlink: introduce NLA_POLICY_MAX_BE Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 272/491] netfilter: nft_payload: reject out-of-range attributes via policy Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 273/491] netlink: hide validation union fields from kdoc Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 274/491] netlink: introduce bigendian integer types Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 275/491] netlink: allow be16 and be32 types in all uint policy checks Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 276/491] netfilter: ctnetlink: use netlink policy range checks Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 277/491] net: macb: use the current queue number for stats Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 278/491] regmap: Synchronize cache for the page selector Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 279/491] RDMA/rw: Fall back to direct SGE on MR pool exhaustion Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 280/491] scsi: scsi_transport_sas: Fix the maximum channel scanning issue Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 281/491] x86/fault: Fold mm_fault_error() into do_user_addr_fault() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 282/491] x86/fault: Improve kernel-executing-user-memory handling Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 283/491] x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 284/491] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 285/491] ASoC: Intel: catpt: Fix the device initialization Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 286/491] ACPICA: include/acpi/acpixf.h: Fix indentation Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 287/491] ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 288/491] ACPI: EC: Fix EC address space handler unregistration Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 289/491] ACPI: EC: Fix ECDT probe ordering issues Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 290/491] ACPI: EC: Install address space handler at the namespace root Greg Kroah-Hartman
2026-04-13 20:17 ` Ben Hutchings
2026-04-13 15:58 ` [PATCH 5.10 291/491] ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 292/491] hwmon: (adm1177) fix sysfs ABI violation and current unit conversion Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 293/491] sysctl: fix uninitialized variable in proc_do_large_bitmap Greg Kroah-Hartman
2026-04-13 15:58 ` [PATCH 5.10 294/491] spi: spi-fsl-lpspi: fix teardown order issue (UAF) Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 295/491] s390/barrier: Make array_index_mask_nospec() __always_inline Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 296/491] can: gw: fix OOB heap access in cgw_csum_crc8_rel() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 297/491] cpufreq: conservative: Reset requested_freq on limits change Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 298/491] media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 299/491] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 300/491] alarmtimer: Fix argument order in alarm_timer_forward() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 301/491] scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 302/491] scsi: ses: Handle positive SCSI error from ses_recv_diag() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 303/491] jbd2: gracefully abort on checkpointing state corruptions Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 304/491] ext4: convert inline data to extents when truncate exceeds inline size Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 305/491] ext4: make recently_deleted() properly work with lazy itable initialization Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 306/491] ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 307/491] ext4: reject mount if bigalloc with s_first_data_block != 0 Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 308/491] phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 309/491] dmaengine: xilinx: xilinx_dma: Fix dma_device directions Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 310/491] dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 311/491] dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction Greg Kroah-Hartman
2026-04-16 17:58 ` Ben Hutchings
2026-04-16 18:20 ` Marek Vasut
2026-04-16 18:43 ` Ben Hutchings
2026-04-18 16:51 ` Marek Vasut
2026-04-13 15:59 ` [PATCH 5.10 312/491] btrfs: fix super block offset in error message in btrfs_validate_super() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 313/491] btrfs: fix lost error when running device stats on multiple devices fs Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 314/491] dmaengine: xilinx_dma: Program interrupt delay timeout Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 315/491] dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 316/491] futex: Clear stale exiting pointer in futex_lock_pi() retry path Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 317/491] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 318/491] atm: lec: fix use-after-free in sock_def_readable() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 319/491] objtool: Fix Clang jump table detection Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 320/491] HID: multitouch: Check to ensure report responses match the request Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 321/491] crypto: af-alg - fix NULL pointer dereference in scatterwalk Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 322/491] net: qrtr: Add GFP flags parameter to qrtr_alloc_ctrl_packet Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 323/491] net: qrtr: Release distant nodes along the bridge node Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 324/491] net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 325/491] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 326/491] tg3: Fix race for querying speed/duplex Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 327/491] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 328/491] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 329/491] bridge: br_nd_send: linearize skb before parsing ND options Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 330/491] net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 331/491] ipv6: prevent possible UaF in addrconf_permanent_addr() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 332/491] net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 333/491] NFC: pn533: bound the UART receive buffer Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 334/491] net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 335/491] bpf: Fix regsafe() for pointers to packet Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 336/491] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 337/491] netfilter: nfnetlink_log: account for netlink header size Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 338/491] netfilter: x_tables: ensure names are nul-terminated Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 339/491] netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 340/491] netfilter: nf_conntrack_helper: pass helper to expect cleanup Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 341/491] netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 342/491] netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 343/491] netfilter: nf_tables: reject immediate NF_QUEUE verdict Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 344/491] Bluetooth: MGMT: validate LTK enc_size on load Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 345/491] rds: ib: reject FRMR registration before IB connection is established Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 346/491] net: macb: fix clk handling on PCI glue driver removal Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 347/491] net: macb: properly unregister fixed rate clocks Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 348/491] net/mlx5: Avoid "No data available" when FW version queries fail Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 349/491] net/x25: Fix potential double free of skb Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 350/491] net/x25: Fix overflow when accumulating packets Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 351/491] net/sched: cls_fw: fix NULL pointer dereference on shared blocks Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 352/491] net/sched: cls_flow: " Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 353/491] ipv6: avoid overflows in ip6_datagram_send_ctl() Greg Kroah-Hartman
2026-04-13 15:59 ` [PATCH 5.10 354/491] efi/mokvar-table: Avoid repeated map/unmap of the same page Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 355/491] Revert "drm/vmwgfx: Add seqno waiter for sync_files" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 356/491] drm/vmwgfx: Add seqno waiter for sync_files Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 357/491] Revert "scsi: core: Wake up the error handler when final completions race against each other" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 358/491] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 359/491] Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 360/491] media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 361/491] hwmon: (pxe1610) Check return value of page-select write in probe Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 362/491] hwmon: (occ) Fix missing newline in occ_show_extended() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 363/491] riscv: kgdb: fix several debug register assignment bugs Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 364/491] drm/ioc32: stop speculation on the drm_compat_ioctl path Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 365/491] wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 366/491] USB: serial: option: add MeiG Smart SRM825WN Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 367/491] ALSA: caiaq: fix stack out-of-bounds read in init_card Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 368/491] ALSA: ctxfi: Fix missing SPDIFI1 index handling Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 369/491] Bluetooth: SMP: derive legacy responder STK authentication from MITM state Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 370/491] Bluetooth: SMP: force responder MITM requirements before building the pairing response Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 371/491] MIPS: Fix the GCC version check for `__multi3 workaround Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 372/491] hwmon: (occ) Fix division by zero in occ_show_power_1() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 373/491] drm/ast: dp501: Fix initialization of SCU2C Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 374/491] USB: serial: io_edgeport: add support for Blackbox IC135A Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 375/491] USB: serial: option: add support for Rolling Wireless RW135R-GL Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 376/491] USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 377/491] Input: synaptics-rmi4 - fix a locking bug in an error path Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 378/491] Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 379/491] Input: xpad - add support for Razer Wolverine V3 Pro Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 380/491] iio: dac: ad5770r: fix error return in ad5770r_read_raw() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 381/491] iio: light: vcnl4035: fix scan buffer on big-endian Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 382/491] iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 383/491] iio: gyro: mpu3050: Fix incorrect free_irq() variable Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 384/491] iio: gyro: mpu3050: Fix irq resource leak Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 385/491] iio: gyro: mpu3050: Move iio_device_register() to correct location Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 386/491] iio: gyro: mpu3050: Fix out-of-sequence free_irq() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 387/491] usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 388/491] usb: ulpi: fix double free in ulpi_register_interface() error path Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 389/491] usb: usbtmc: Flush anchored URBs in usbtmc_release Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 390/491] usb: ehci-brcm: fix sleep during atomic Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 391/491] phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 392/491] phy: renesas: rcar-gen3-usb2: Move IRQ request in probe Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 393/491] phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data Greg Kroah-Hartman
2026-04-18 11:38 ` Ben Hutchings
2026-04-13 16:00 ` [PATCH 5.10 394/491] phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 395/491] bridge: br_nd_send: validate ND option lengths Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 396/491] cdc-acm: new quirk for EPSON HMD Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 397/491] comedi: dt2815: add hardware detection to prevent crash Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 398/491] comedi: Reinit dev->spinlock between attachments to low-level drivers Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 399/491] comedi: ni_atmio16d: Fix invalid clean-up after failed attach Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 400/491] comedi: me_daq: Fix potential overrun of firmware buffer Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 401/491] comedi: me4000: " Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 402/491] netfilter: ipset: drop logically empty buckets in mtype_del Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 403/491] vxlan: validate ND option lengths in vxlan_na_create Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 404/491] net: ftgmac100: fix ring allocation unwind on open failure Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 405/491] thunderbolt: Fix property read in nhi_wake_supported() Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 406/491] USB: dummy-hcd: Fix locking/synchronization error Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 407/491] usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 408/491] nvmet-tcp: fix use-before-check of sg in bounds validation Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 409/491] usb: gadget: f_subset: Fix unbalanced refcnt in geth_free Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 410/491] usb: gadget: f_rndis: Protect RNDIS options with mutex Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 411/491] usb: gadget: f_uac1_legacy: validate control request size Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 412/491] io_uring/tctx: work around xa_store() allocation error issue Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 413/491] lib/crypto: chacha: Zeroize permuted_state before it leaves scope Greg Kroah-Hartman
2026-04-13 16:00 ` [PATCH 5.10 414/491] wifi: rt2x00usb: fix devres lifetime Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 415/491] xfrm_user: fix info leak in build_report() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 416/491] Input: uinput - fix circular locking dependency with ff-core Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 417/491] Input: uinput - take event lock when submitting FF request "event" Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 418/491] mm/hugetlb: fix skipping of unsharing of pmd page tables Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 419/491] mm/hugetlb: make detecting shared pte more reliable Greg Kroah-Hartman
2026-04-13 20:36 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 420/491] mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count Greg Kroah-Hartman
2026-04-13 20:37 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 421/491] mm/hugetlb: fix hugetlb_pmd_shared() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 422/491] mm/hugetlb: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 423/491] mm/rmap: " Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 424/491] mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 425/491] media: uvcvideo: Move guid to entity Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 426/491] media: uvcvideo: Allow extra entities Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 427/491] media: uvcvideo: Implement UVC_EXT_GPIO_UNIT Greg Kroah-Hartman
2026-04-13 20:43 ` Ben Hutchings
2026-04-13 20:50 ` Ricardo Ribalda
2026-04-13 16:01 ` [PATCH 5.10 428/491] media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 429/491] media: uvcvideo: Use heuristic to find stream entity Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 430/491] apparmor: validate DFA start states are in bounds in unpack_pdb Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 431/491] apparmor: fix memory leak in verify_header Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 432/491] apparmor: replace recursive profile removal with iterative approach Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 433/491] apparmor: fix: limit the number of levels of policy namespaces Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 434/491] apparmor: fix side-effect bug in match_char() macro usage Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 435/491] apparmor: fix missing bounds check on DEFAULT table in verify_dfa() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 436/491] apparmor: Fix double free of ns_name in aa_replace_profiles() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 437/491] apparmor: fix unprivileged local user can do privileged policy management Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 438/491] apparmor: fix differential encoding verification Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 439/491] apparmor: fix race on rawdata dereference Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 440/491] apparmor: fix race between freeing data and fs accessing it Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 441/491] netfilter: nft_ct: fix use-after-free in timeout object destroy Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 442/491] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 443/491] wifi: brcmsmac: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 444/491] arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 445/491] arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 446/491] nfc: pn533: allocate rx skb before consuming bytes Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 447/491] batman-adv: reject oversized global TT response buffers Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 448/491] net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 449/491] mmc: vub300: fix NULL-deref on disconnect Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 450/491] net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 451/491] net: stmmac: fix integer underflow in chain mode Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 452/491] rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 453/491] xen/privcmd: unregister xenstore notifier on module exit Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 454/491] ASoC: soc-core: dont use discriminatory terms on snd_soc_runtime_get_dai_fmt() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 455/491] ASoC: tegra: Fix Master Volume Control Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 456/491] netlink: add nla be16/32 types to minlen array Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 457/491] cpufreq: governor: Free dbs_data directly when gov->init() fails Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 458/491] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 459/491] seg6: separate dst_cache for input and output paths in seg6 lwtunnel Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 460/491] net: rfkill: prevent unlimited numbers of rfkill events from being created Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 461/491] usb: gadget: f_hid: move list and spinlock inits from bind to alloc Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 462/491] usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 463/491] usb: gadget: uvc: fix NULL pointer dereference during unbind race Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 464/491] net: macb: Move devm_{free,request}_irq() out of spin lock area Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 465/491] mm/huge_memory: fix folio isnt locked in softleaf_to_folio() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 466/491] ext4: fix the might_sleep() warnings in kvfree() Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 467/491] xfs: save ailp before dropping the AIL lock in push callbacks Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 468/491] xfs: stop reclaim before pushing AIL during unmount Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 469/491] ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 470/491] ext4: publish jinode after initialization Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 471/491] Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 472/491] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Greg Kroah-Hartman
2026-04-13 20:49 ` Ben Hutchings
2026-04-13 16:01 ` [PATCH 5.10 473/491] mmc: core: Drop redundant member in struct mmc host Greg Kroah-Hartman
2026-04-13 16:01 ` [PATCH 5.10 474/491] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Greg Kroah-Hartman
2026-04-13 21:10 ` Ben Hutchings
2026-04-14 10:52 ` Ulf Hansson
2026-04-13 16:02 ` [PATCH 5.10 475/491] mmc: core: Drop reference counting of the bus_ops Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 476/491] mmc: core: Avoid bitfield RMW for claim/retune flags Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 477/491] Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 478/491] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 479/491] device property: Add fwnode_is_ancestor_of() and fwnode_get_next_parent_dev() Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 480/491] media: device property: Return true in fwnode_device_is_available for NULL ops Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 481/491] device property: Retrieve fwnode from of_node via accessor Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 482/491] device property: Unify access to of_node Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 483/491] device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 484/491] device property: Check fwnode->secondary when finding properties Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 485/491] device property: Allow error pointer to be passed to fwnode APIs Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 486/491] device property: Allow secondary lookup in fwnode_get_next_child_node() Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 487/491] batman-adv: avoid OGM aggregation when skb tailroom is insufficient Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 488/491] s390/syscalls: Add spectre boundary for syscall dispatch table Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 489/491] device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 490/491] Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" Greg Kroah-Hartman
2026-04-13 16:02 ` [PATCH 5.10 491/491] io_uring/poll: correctly handle io_poll_add() return value on update Greg Kroah-Hartman
2026-04-13 17:37 ` [PATCH 5.10 000/491] 5.10.253-rc1 review Brett A C Sheffield
2026-04-13 17:59 ` Florian Fainelli
2026-04-13 18:52 ` Jon Hunter
2026-04-14 8:02 ` Pavel Machek
2026-04-15 5:49 ` Ben Copeland
2026-04-15 10:12 ` Ben Copeland
2026-04-14 18:20 ` Mark Brown
2026-04-14 21:39 ` Josh Law
2026-04-15 3:01 ` Barry K. Nathan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox