* [PATCH 6.6 0000/1266] 6.6.145-rc1 review
@ 2026-07-21 15:07 Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0001/1266] bpf, arm64: Reject out-of-range B.cond targets Greg Kroah-Hartman
` (998 more replies)
0 siblings, 999 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.6.145 release.
There are 1266 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.145-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.6.145-rc1
Danilo Krummrich <dakr@kernel.org>
driver core: Guard deferred probe timeout extension with delayed_work_pending()
Danilo Krummrich <dakr@kernel.org>
driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
Easwar Hariharan <eahariha@linux.microsoft.com>
jiffies: Cast to unsigned long in secs_to_jiffies() conversion
Easwar Hariharan <eahariha@linux.microsoft.com>
jiffies: Define secs_to_jiffies()
Baokun Li <libaokun@linux.alibaba.com>
writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
Jan Kara <jack@suse.cz>
writeback: Fix use after free in inode_switch_wbs_work_fn()
Darrick J. Wong <djwong@kernel.org>
xfs: fix stupid compiler warning
Arnd Bergmann <arnd@arndb.de>
Bluetooth: btmtk: remove #ifdef around declarations
Arnd Bergmann <arnd@arndb.de>
Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: ensure CKI can compile our new tests on old kernels
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
Randy Dunlap <rdunlap@infradead.org>
seqlock: fix scoped_seqlock_read kernel-doc
Marc Zyngier <maz@kernel.org>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
Cen Zhang <zzzccc427@gmail.com>
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Pauli Virtanen <pav@iki.fi>
Bluetooth: separate CIS_LINK and BIS_LINK link types
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
Qu Wenruo <wqu@suse.com>
btrfs: fix incorrect buffered IO fallback for append direct writes
Qu Wenruo <wqu@suse.com>
btrfs: fix false IO failure after falling back to buffered write
Rochan Avlur <rochan.avlur@gmail.com>
exfat: preserve benign secondary entries during rename and move
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: move exfat_chain_set() out of __exfat_resolve_path()
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: add exfat_get_dentry_set_by_ei() helper
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: rename argument name for exfat_move_file and exfat_rename_file
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: remove unnecessary read entry in __exfat_rename()
Yuezhang Mo <Yuezhang.Mo@sony.com>
exfat: move free cluster out of exfat_init_ext_entry()
Pedro Falcato <pfalcato@suse.de>
mm: do file ownership checks with the proper mount idmap
Wentao Liang <vulab@iscas.ac.cn>
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
regulator: scmi: Simplify with scoped for each OF child loop
Ricardo Robaina <rrobaina@redhat.com>
audit: fix potential integer overflow in audit_log_n_hex()
Ricardo Robaina <rrobaina@redhat.com>
audit: add audit_log_nf_skb helper function
Ahsan Atta <ahsan.atta@intel.com>
crypto: qat - fix restarting state leak on allocation failure
Qu Wenruo <wqu@suse.com>
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
Neill Kapron <nkapron@google.com>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
Tianchu Chen <flynnnchen@tencent.com>
nvmet-auth: validate reply message payload bounds against transfer length
Hannes Reinecke <hare@kernel.org>
nvmet: return DHCHAP status codes from nvmet_setup_auth()
Chaitanya Kulkarni <kch@nvidia.com>
nvmet: remove superfluous initialization
Tyler Baker <tyler.baker@oss.qualcomm.com>
usb: gadget: f_fs: initialize reset_work at allocation time
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
Andy Yan <andyshrk@163.com>
usb: typec: tcpm: Fix VDM type for Enter Mode commands
Mauricio Faria de Oliveira <mfo@igalia.com>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
Oliver Neukum <oneukum@suse.com>
usb: iowarrior: remove inherent race with minor number
Vlad Poenaru <vlad.wing@gmail.com>
bpf: Allow LPM map access from sleepable BPF programs
Andrii Nakryiko <andrii@kernel.org>
bpf: Consistently use bpf_rcu_lock_held() everywhere
Tristan Madani <tristan@talencesecurity.com>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
Viacheslav Dubeyko <slava@dubeyko.com>
hfs/hfsplus: prevent getting negative values of offset/length
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
serial: 8250_mid: Disable DMA for selected platforms
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
serial: 8250_mid: Remove 8250_pci usage
Manish Khadka <maskmemanish@gmail.com>
HID: appleir: fix UAF on pending key_up_timer in remove()
Thomas Gleixner <tglx@linutronix.de>
treewide: Switch/rename to timer_delete[_sync]()
Jann Horn <jannh@google.com>
proc: protect ptrace_may_access() with exec_update_lock (part 1)
Oleg Nesterov <oleg@redhat.com>
seqlock: Change do_task_stat() to use scoped_seqlock_read()
Peter Zijlstra <peterz@infradead.org>
seqlock: Introduce scoped_seqlock_read()
Vlastimil Babka (SUSE) <vbabka@kernel.org>
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
Trung Nguyen <trungnh@cystack.net>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
Angela Czubak <aczubak@google.com>
HID: add haptics page defines
Zide Chen <zide.chen@intel.com>
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
Baokun Li <libaokun@linux.alibaba.com>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
Jan Kara <jack@suse.cz>
writeback: Avoid contention on wb->list_lock when switching inodes
Guangshuo Li <lgs201920130244@gmail.com>
cpufreq: qcom-cpufreq-hw: Fix possible double free
Lizhe <sensor1010@163.com>
cpufreq: Make cpufreq_driver->exit() return void
Viresh Kumar <viresh.kumar@linaro.org>
cpufreq: pcc: Remove empty exit() callback
Jann Horn <jannh@google.com>
proc: protect ptrace_may_access() with exec_update_lock (FD links)
Christoph Hellwig <hch@lst.de>
proc: rename proc_setattr to proc_nochmod_setattr
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: track the connection owning a byte-range lock
DaeMyung Kang <charsyam@gmail.com>
ksmbd: centralize ksmbd_conn final release to plug transport leak
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: use opener credentials for FSCTL mutations
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: resolve SWN tcon from live registrations
Markus Elfring <elfring@users.sourceforge.net>
smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
Pauli Virtanen <pav@iki.fi>
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
Runyu Xiao <runyu.xiao@seu.edu.cn>
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Florian Westphal <fw@strlen.de>
netfilter: ebtables: zero chainstack array
Qianfeng Rong <rongqianfeng@vivo.com>
netfilter: ebtables: Use vmalloc_array() to improve code
Xiaolei Wang <xiaolei.wang@windriver.com>
media: nxp: imx8-isi: Fix use-after-free on remove
Frank Li <Frank.Li@nxp.com>
media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
media: nxp: imx8-isi: Convert to platform remove callback returning void
Runyu Xiao <runyu.xiao@seu.edu.cn>
gpio: sch: use raw_spinlock_t in the irq startup path
Runyu Xiao <runyu.xiao@seu.edu.cn>
coresight: etb10: restore atomic_t for shared reading state
Shakeel Butt <shakeel.butt@linux.dev>
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
Qi Zheng <zhengqi.arch@bytedance.com>
mm: shrinker: remove redundant shrinker_rwsem in debugfs operations
Marco Elver <elver@google.com>
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
Nikolay Kulikov <nikolayof23@gmail.com>
staging: rtl8723bs: fix spaces around binary operators
William Hansen-Baird <william.hansen.baird@gmail.com>
staging: rtl8723bs: core: move constants to right side in comparison
Marco Nenciarini <mnencia@kcore.it>
PCI: Skip Resizable BAR restore on read error
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Move Resizable BAR code to rebar.c
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Add kerneldoc for pci_resize_resource()
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Fix restoring BARs on BAR resize rollback path
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Free saved list without holding pci_bus_sem
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Prevent resource tree corruption when BAR resize fails
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: mediatek: Fix IRQ domain leak when port fails to enable
Christian Marangi <ansuelsmth@gmail.com>
PCI: mediatek: Use generic MACRO for TPVPERL delay
Christian Marangi <ansuelsmth@gmail.com>
PCI: mediatek: Convert bool to single quirks entry and bitmap
Jiri Slaby (SUSE) <jirislaby@kernel.org>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
Richard Zhu <hongxing.zhu@nxp.com>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
Alex Williamson <alex.williamson@nvidia.com>
vfio/mlx5: Fix racy bitfields and tighten struct layout
Mahesh Vaidya <mahesh.vaidya@altera.com>
PCI: altera: Fix resource leaks on probe failure
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: aoa: check snd_ctl_new1() return value
Herman van Hazendonk <github.com@herrie.org>
iio: common: st_sensors: honour channel endianness in read_axis_data
Alexander Lobakin <aleksander.lobakin@intel.com>
bitops: make BYTES_TO_BITS() treewide-available
Biren Pandya <birenpandya@gmail.com>
iio: pressure: mpl115: fix runtime PM leak on read error
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: stabilized timestamp in interrupt
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: invensense: fix timestamp glitches when switching frequency
Colin Ian King <colin.i.king@gmail.com>
iio: invensense: remove redundant initialization of variable period
Zhang Lixu <lixu.zhang@intel.com>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
Runyu Xiao <runyu.xiao@seu.edu.cn>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: NFIT: core: Fix possible deadlock and missing notifications
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: bus: Introduce devm_acpi_install_notify_handler()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: driver: Check ACPI_COMPANION() against NULL during probe
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
Sandipan Das <sandipan.das@amd.com>
perf/x86/amd/brs: Fix kernel address leakage
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: fsl_ifc: return errors for failed page reads
Runyu Xiao <runyu.xiao@seu.edu.cn>
mmc: vub300: defer reset until cmd_mutex is unlocked
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: mchp23k256: use SPI match data for chip caps
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: onenand: samsung: report DMA completion timeouts
Rafael Beims <rafael.beims@toradex.com>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Zhiling Zou <roxy520tt@gmail.com>
wifi: mac80211: free ack status frame on TX header build failure
Junrui Luo <moonafterrain@outlook.com>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
Zhao Dongdong <zhaodongdong@kylinos.cn>
reset: sunxi: fix memory region leak on ioremap failure
Robby Cai <robby.cai@nxp.com>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
Florian Westphal <fw@strlen.de>
ipvs: reload ip header after head reallocation
Julian Anastasov <ja@ssi.bg>
ipvs: fix more places with wrong ipv6 transport offsets
Maoyi Xie <maoyixie.tju@gmail.com>
memstick: ms_block: reject a card that reports too many blocks
James Raphael Tiovalen <jamestiotio@gmail.com>
macsec: fix promiscuity refcount leak in macsec_dev_open()
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
llc: fix SAP refcount leak when creating incoming sockets
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Bluetooth: btrtl: validate firmware patch bounds
Asim Viladi Oglu Manizada <manizada@pm.me>
net: openvswitch: reject oversized nested action attrs
Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
Dawei Feng <dawei.feng@seu.edu.cn>
wifi: mac80211: fix memory leak in ieee80211_register_hw()
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: rt2x00: avoid full teardown before work setup in probe
Thorsten Blum <thorsten.blum@linux.dev>
powerpc/pseries: fix memory leak on krealloc failure in papr_init
Peng Fan <peng.fan@nxp.com>
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
Peng Fan <peng.fan@nxp.com>
pmdomain: imx: Fix i.MX8MP power notifier
Farhad Alemi <farhad.alemi@berkeley.edu>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
Crystal Wood <crwood@redhat.com>
tracing/osnoise: Call synchronize_rcu() when unregistering
Tao Liu <ltao@redhat.com>
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
Michael Bommarito <michael.bommarito@gmail.com>
drbd: reject data replies with an out-of-range payload size
Daehyeon Ko <4ncienth@gmail.com>
macsec: don't read an unset MAC header in macsec_encrypt()
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: use parsed transport offset in SCTP state lookup
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
llc: fix SAP refcount leak in llc_ui_autobind()
Yousef Alhouseen <alhouseenyousef@gmail.com>
mac802154: remove interfaces with RCU list deletion
Gerald Schaefer <gerald.schaefer@linux.ibm.com>
s390/monwriter: Reject buffer reuse with different data length
Martin Kaiser <martin@kaiser.cx>
riscv: probes: save original sp in rethook trampoline
HyeongJun An <sammiee5311@gmail.com>
hwmon: (asus_atk0110) Check package count before accessing element
Maoyi Xie <maoyixie.tju@gmail.com>
net: wwan: iosm: bound device offsets in the MUX downlink decoder
Wentao Liang <vulab@iscas.ac.cn>
ata: pata_pxa: Fix DMA channel leak on probe error
Bryam Vargas <hexlabsecurity@proton.me>
orangefs: keep the readdir entry size 64-bit in fill_from_part()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Fix double addition of offset for @+FOFFSET
Bryam Vargas <hexlabsecurity@proton.me>
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Bryam Vargas <hexlabsecurity@proton.me>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Andrea Righi <arighi@nvidia.com>
net: lan743x: Initialize eth_syslock spinlock before use
Haoxiang Li <haoxiang_li2024@163.com>
fsl/fman: Free init resources on KeyGen failure in fman_init()
Runyu Xiao <runyu.xiao@seu.edu.cn>
hwmon: (occ) unregister sysfs devices outside occ lock
Haoxiang Li <haoxiang_li2024@163.com>
net: liquidio: fix BAR resource leak on PF number failure
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: (w83793) remove vrm sysfs file on probe failure
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: (w83627hf) remove VID sysfs files on error and remove
Conor Dooley <conor.dooley@microchip.com>
rtc: mpfs: fix counter upload completion condition
Abdun Nihaal <nihaal@cse.iitm.ac.in>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
Sabrina Dubroca <sd@queasysnail.net>
espintcp: use sk_msg_free_partial to fix partial send
Hongchen Zhang <zhanghongchen@loongson.cn>
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
Sven Eckelmann <sven@narfation.org>
batman-adv: clean untagged VLAN on netdev registration failure
Sven Eckelmann <sven@narfation.org>
batman-adv: ensure minimal ethernet header on TX
Sven Eckelmann <sven@narfation.org>
batman-adv: retrieve ethhdr after potential skb realloc on RX
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure
Michael Bommarito <michael.bommarito@gmail.com>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
Michael Bommarito <michael.bommarito@gmail.com>
ieee802154: admin-gate legacy LLSEC dump operations
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@gmail.com>
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
Dawei Feng <dawei.feng@seu.edu.cn>
net: ena: clean up XDP TX queues when regular TX setup fails
Zihan Xi <xizh2024@lzu.edu.cn>
net/sched: act_ct: preserve tc_skb_cb across defragmentation
Haoxiang Li <haoxiang_li2024@163.com>
net: ixp4xx_hss: fix duplicate HDLC netdev allocation
Haoxiang Li <haoxiang_li2024@163.com>
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
Maoyi Xie <maoyixie.tju@gmail.com>
net: sit: require CAP_NET_ADMIN in the device netns for changelink
Andreas Kemnade <andreas@kemnade.info>
gpios: palmas: add .get_direction() op
Paul Louvel <paul.louvel@bootlin.com>
gpio-f7188x: Add support for NCT6126D version B
Bradley Morgan <include@grrlz.net>
cpu: hotplug: Bound hotplug states sysfs output
Bradley Morgan <include@grrlz.net>
cpu: hotplug: Preserve per instance callback errors
Zhan Xusheng <zhanxusheng1024@gmail.com>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
Doruk Tan Ozturk <doruk@0sec.ai>
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix race condition in reset_device sysfs callback
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix DMA mapping violation in line setup
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - add response length checks
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - validate control endpoint type
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - release data interface on disconnect
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix use-after-free and double-free in disconnect
Haoxiang Li <haoxiang_li2024@163.com>
scsi: elx: efct: Fix I/O leak on unsupported additional CDB
WenTao Liang <vulab@iscas.ac.cn>
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
Bryam Vargas <hexlabsecurity@proton.me>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
Bryam Vargas <hexlabsecurity@proton.me>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
Michael Bommarito <michael.bommarito@gmail.com>
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
Michael Bommarito <michael.bommarito@gmail.com>
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
Xu Rao <raoxu@uniontech.com>
scsi: sg: Report request-table problems when any status is set
Abdun Nihaal <nihaal@cse.iitm.ac.in>
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
Haoxiang Li <haoxiang_li2024@163.com>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
Mikulas Patocka <mpatocka@redhat.com>
dm-verity: increase sprintf buffer size
Mikulas Patocka <mpatocka@redhat.com>
dm-verity: fix a possible NULL pointer dereference
Mikulas Patocka <mpatocka@redhat.com>
dm-integrity: don't increment hash_offset twice
Mikulas Patocka <mpatocka@redhat.com>
dm_early_create: fix freeing used table on dm_resume failure
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix merge accounting
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix dm_jiffies_to_msec64
Benjamin Marzinski <bmarzins@redhat.com>
dm-log: fix a bitset_size overflow on 32bit machines
Mikulas Patocka <mpatocka@redhat.com>
dm-ioctl: fix a possible overflow in list_version_get_info
Mikulas Patocka <mpatocka@redhat.com>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
Samuel Moelius <sam.moelius@trailofbits.com>
dm era: fix out-of-bounds memory access for non-zero start sector
Ming-Hung Tsai <mtsai@redhat.com>
dm thin metadata: fix metadata snapshot consistency on commit failure
Genjian Zhang <zhanggenjian@kylinos.cn>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure
Haoxiang Li <haoxiang_li2024@163.com>
net: sparx5: unregister blocking notifier on init failure
Jiri Olsa <jolsa@kernel.org>
bpf: Add missing access_ok call to copy_user_syms
Jann Horn <jannh@google.com>
bpf,fork: wipe ->bpf_storage before bailouts that access it
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: add missing rcu list annotations and operations
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
Lee Jones <lee@kernel.org>
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
Oliver Hartkopp <socketcan@hartkopp.net>
can: isotp: use unconditional synchronize_rcu() in isotp_release()
Fan Wu <fanwu01@zju.edu.cn>
can: esd_usb: kill anchored URBs before freeing netdevs
Bryam Vargas <hexlabsecurity@proton.me>
nvmet-rdma: handle inline data with a nonzero offset
Weiming Shi <bestswngs@gmail.com>
sctp: validate STALE_COOKIE cause length before reading staleness
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
spi: uniphier: Fix completion initialization order before devm_request_irq()
Wang Yan <wangyan01@kylinos.cn>
time: Fix off-by-one in compat settimeofday() usec validation
Jaewon Yang <yong010301@gmail.com>
tpm: Make the TPM character devices non-seekable
Thorsten Blum <thorsten.blum@linux.dev>
tpm: fix event_size output in tpm1_binary_bios_measurements_show
Maoyi Xie <maoyixie.tju@gmail.com>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
Sanman Pradhan <psanman@juniper.net>
xfrm: use compat translator only for u64 alignment mismatch
Wentao Liang <vulab@iscas.ac.cn>
xen/gntdev: fix error handling in ioctl
Paul Greenwalt <paul.greenwalt@intel.com>
ice: fix ice_init_link() error return preventing probe
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
Roman Vivchar <rva333@protonmail.com>
i2c: mediatek: fix WRRD for SoCs without auto_restart option
Joshua Crofts <joshua.crofts1@gmail.com>
hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
Ibrahim Hashimov <security@auditcode.ai>
ksmbd: fix integer overflow in set_file_allocation_info()
Fredric Cover <fredric.cover.lkernel@gmail.com>
smb: client: use kvzalloc() for megabyte buffer in simple fallocate
Daniel Gibson <daniel@gibson.sh>
platform/x86/amd/pmc: Add delay_suspend module parameter
Daniel Gibson <daniel@gibson.sh>
platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
Daniel Gibson <daniel@gibson.sh>
platform/x86/amd/pmc: Check for intermediate wakeup in function
Frank Li <Frank.Li@nxp.com>
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
Kartik Rajput <kkartik@nvidia.com>
dmaengine: tegra: Fix burst size calculation
Jarkko Sakkinen <jarkko@kernel.org>
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
Bhargav Joshi <j.bhargav.u@gmail.com>
irqchip/crossbar: Use correct index in crossbar_domain_free()
Florian Fuchs <fuchsfl@gmail.com>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: spi-nor: swp: Improve locking user experience
Sebastian Alba Vives <sebasjosue84@gmail.com>
fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
Maoyi Xie <maoyixie.tju@gmail.com>
net: thunderbolt: Fix frags[] overflow by bounding frame_count
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
Sebastian Alba Vives <sebasjosue84@gmail.com>
fpga: dfl: add bounds check in dfh_get_param_size()
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject dinodes whose i_rdev disagrees with the file type
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject dinodes with non-canonical i_mode type
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
Ian Bridges <icb@fastmail.org>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
Kyle Zeng <kylebot@openai.com>
ocfs2: avoid moving extents to occupied clusters
Arseniy Krasnov <avkrasnov@rulkc.org>
mtd: rawnand: fix condition in 'nand_select_target()'
Vasiliy Kovalev <kovalev@altlinux.org>
net/9p: fix infinite loop in p9_client_rpc on fatal signal
Bastien Curutchet <bastien.curutchet@bootlin.com>
mtd: rawnand: pl353: fix probe resource allocation
Tristan Madani <tristan@talencesecurity.com>
ocfs2: use kzalloc for quota recovery bitmap allocation
Ionut Nechita <ionut.nechita@windriver.com>
scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
Martin Wilck <martin.wilck@suse.com>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
Breno Leitao <leitao@debian.org>
9p: skip nlink update in cacheless mode to fix WARN_ON
Ruoyu Wang <ruoyuw560@gmail.com>
mtd: slram: remove failed entries from the device list
Muchun Song <muchun.song@linux.dev>
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
Krzysztof Wilczyński <kwilczynski@kernel.org>
proc: only bump parent nlink when registering directories
SeongJae Park <sj@kernel.org>
mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
SeongJae Park <sj@kernel.org>
mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
Zishun Yi <vulab@iscas.ac.cn>
riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
Aaron Tomlin <atomlin@atomlin.com>
mips: sched: Fix CPUMASK_OFFSTACK memory corruption
WenTao Liang <vulab@iscas.ac.cn>
power: supply: charger-manager: fix refcount leak in is_full_charged()
Tristan Madani <tristan@talencesecurity.com>
ntfs3: fix out-of-bounds read in decompress_lznt
Michael Bommarito <michael.bommarito@gmail.com>
ntfs3: validate split-point offset in indx_insert_into_buffer
Michael Bommarito <michael.bommarito@gmail.com>
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
Michael Bommarito <michael.bommarito@gmail.com>
ntfs3: cap RESTART_TABLE free-chain walker at rt->used
Michael Bommarito <michael.bommarito@gmail.com>
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
Michael Bommarito <michael.bommarito@gmail.com>
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: validate lcns_follow in log_replay conversion
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
Michael Bommarito <michael.bommarito@gmail.com>
fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
Zhan Xusheng <zhanxusheng1024@gmail.com>
fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
SeongJae Park <sj@kernel.org>
mm/damon/core: make charge_addr_from aware of end-address exclusivity
Ma Ke <make24@iscas.ac.cn>
power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix device reference leak in probe
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix kfree() of static object
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix gio device memory leak
Wasim Nazir <wasim.nazir@oss.qualcomm.com>
remoteproc: qcom: Fix leak when custom dump_segments addition fails
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
Chuck Lever <chuck.lever@oracle.com>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
Chuck Lever <chuck.lever@oracle.com>
lockd: Plug nlm_file leak when nlm_do_fopen() fails
Chuck Lever <chuck.lever@oracle.com>
sunrpc: wait for in-flight TLS handshake callback when cancel loses race
Chris Mason <clm@meta.com>
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
Abdun Nihaal <nihaal@cse.iitm.ac.in>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
Abdun Nihaal <nihaal@cse.iitm.ac.in>
nvdimm/btt: Free arenas on btt_init() error paths
Junrui Luo <moonafterrain@outlook.com>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
Pauli Virtanen <pav@iki.fi>
Bluetooth: SCO: hold sk properly in sco_conn_ready
Pauli Virtanen <pav@iki.fi>
Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
Benoît Sevens <bsevens@google.com>
HID: playstation: validate num_touch_reports in DualShock 4 reports
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
mfd: tps6586x: Fix OF node refcount
Shyam Prasad N <sprasad@microsoft.com>
cifs: invalidate cfid on unlink/rename/rmdir
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: prevent TVLV OOB check overflow
Sven Eckelmann <sven@narfation.org>
batman-adv: frag: fix primary_if leak on failed linearization
Sven Eckelmann <sven@narfation.org>
batman-adv: frag: free unfragmentable packet
Sven Eckelmann <sven@narfation.org>
batman-adv: fix VLAN priority offset
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: avoid request storms during pending request
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: fix tie-break for candidate selection
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: ensure accessible eth_hdr proto field
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: reacquire gw address after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: acquire ARP hw source only after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: access unicast_ttvn skb->data only after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: gw: acquire ethernet header only after skb realloc
Sumanth Korikkar <sumanthk@linux.ibm.com>
s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
Sandipan Das <sandipan.das@amd.com>
perf/x86/amd/lbr: Fix kernel address leakage
Thorsten Blum <thorsten.blum@linux.dev>
x86/boot: Reject too long acpi_rsdp= values
Thorsten Blum <thorsten.blum@linux.dev>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang
Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
tools/power/x86/intel-speed-select: Harden daemon pidfile open
Guangshuo Li <lgs201920130244@gmail.com>
mfd: sm501: Fix reference leak on failed device registration
Armin Wolf <W_Armin@gmx.de>
leds: uleds: Fix potential buffer overread
Ondrej Mosnacek <omosnace@redhat.com>
selinux: fix incorrect execmem checks on overlayfs
Stephen Smalley <stephen.smalley.work@gmail.com>
selinux: check connect-related permissions on TCP Fast Open
Wang Jun <1742789905@qq.com>
soc: fsl: qe: panic on ioremap() failure in qe_reset()
Siddharth Vadapalli <s-vadapalli@ti.com>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
Guangshuo Li <lgs201920130244@gmail.com>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
Xiang Mei (Microsoft) <xmei5@asu.edu>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_nat: reject unsupported target families
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
netfilter: ecache: fix inverted time_after() check
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
netfilter: nf_conncount: fix zone comparison in tuple dedup
Xiang Mei <xmei5@asu.edu>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
Florian Westphal <fw@strlen.de>
netfilter: nf_nat_sip: reload possible stale data pointer
Haoze Xie <royenheart@gmail.com>
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_cluster: reject template conntracks in hash match
David Carlier <devnexen@gmail.com>
netfilter: nfnl_cthelper: apply per-class values when updating policies
Muhammad Bilal <meatuni001@gmail.com>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: mediatek: mt8183: Release reserved memory on cleanup
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: mediatek: mt8192: Release reserved memory on cleanup
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: vesafb: fix memory leak in vesafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: i740fb: fix potential memory leak in i740fb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
Li RongQing <lirongqing@baidu.com>
fbdev: sm712: Fix operator precedence in big_swap macro
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
Sean Christopherson <seanjc@google.com>
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
Matthew Rosato <mjrosato@linux.ibm.com>
KVM: s390: pci: Fix handling of AIF enable without AISB
Hyunwoo Kim <imv4bel@gmail.com>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
Haoxiang Li <haoxiang_li2024@163.com>
KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
Nickolay Goppen <setotau@mainlining.org>
arm64: dts: qcom: sdm630: describe adsp_mem region properly
Mark Rutland <mark.rutland@arm.com>
arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
Yong Wang <edragain@163.com>
net: ife: require ETH_HLEN to be pullable in ife_decode()
Zhengchuan Liang <zcliangcn@gmail.com>
net: atm: reject out-of-range traffic classes in QoS validation
Michael Bommarito <michael.bommarito@gmail.com>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: SOF: topology: validate vendor array size before parsing
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
Zhang Tianci <zhangtianci.1997@bytedance.com>
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
Wentao Liang <vulab@iscas.ac.cn>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
Wentao Liang <vulab@iscas.ac.cn>
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
Guangshuo Li <lgs201920130244@gmail.com>
smb: client: fix overflow in passthrough ioctl bounds check
Harman Kalra <hkalra@marvell.com>
octeontx2-af: fix VF bringup affecting PF promiscuous state
Li RongQing <lirongqing@baidu.com>
net/mlx5: Fix L3 tunnel entropy refcount leak
Wang Yan <wangyan01@kylinos.cn>
selftests/net: fix EVP_MD_CTX leak in tcp_mmap
Timur Tabi <ttabi@nvidia.com>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
Cao Guanghui <caoguanghui@kylinos.cn>
dm era: fix NULL pointer dereference in metadata_open()
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: pin upper rpc_clnt across the TLS connect_worker
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
Guangshuo Li <lgs201920130244@gmail.com>
cifs: validate DFS referral string offsets
Rongguang Wei <weirongguang@kylinos.cn>
s390/zcrypt: Remove the empty file
Julian Anastasov <ja@ssi.bg>
ipvs: ensure inner headers in ICMP errors are in headroom
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: use parsed transport offset in TCP state lookup
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: pass parsed transport offset to state handlers
Eric Dumazet <edumazet@google.com>
ipv6: mcast: Fix potential UAF in MLD delayed work
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Replace locking comments with lockdep annotations.
Eric Dumazet <edumazet@google.com>
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
Suman Ghosh <sumang@marvell.com>
octeontx2-pf: check DMAC extraction support before filtering
Samuel Moelius <sam.moelius@trailofbits.com>
net/sched: cake: reject overhead values that underflow length
Enrico Pozzobon <enrico.pozzobon@dissecto.com>
net: usb: lan78xx: disable VLAN filter in promiscuous mode
Oleksij Rempel <o.rempel@pengutronix.de>
net: usb: lan78xx: move functions to avoid forward definitions
Chuck Lever <cel@kernel.org>
net/tls: Consume empty data records in tls_sw_read_sock()
Hui Wang <hui.wang@canonical.com>
ring-buffer: Fix event length with forced 8-byte alignment
Weiming Shi <bestswngs@gmail.com>
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
Pauli Virtanen <pav@iki.fi>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
Cen Zhang <zzzccc427@gmail.com>
Bluetooth: MGMT: Fix adv monitor add failure cleanup
Cen Zhang <zzzccc427@gmail.com>
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
Eric Dumazet <edumazet@google.com>
amt: fix size calculation in amt_get_size()
Xiang Mei <xmei5@asu.edu>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
Xiang Mei <xmei5@asu.edu>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
Shigeru Yoshida <syoshida@redhat.com>
qede: fix off-by-one in BD ring consumption on build_skb failure
Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>
net: microchip: vcap: fix races on the shared Super VCAP block
Feng Liu <feliu@nvidia.com>
net/mlx5e: Fix HV VHCA stats agent registration race
Feng Liu <feliu@nvidia.com>
net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_connmark: reject invalid shift parameters
Zhixing Chen <running910@gmail.com>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
Feng Wu <wufengwufengwufeng@gmail.com>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_u32: reject invalid shift counts
Qihang <q.h.hack.winter@gmail.com>
gue: validate REMCSUM private option length
Xiang Mei <xmei5@asu.edu>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
selftests/hid: Cover hid_bpf_get_data() size overflow
Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: convert the hid_bpf selftests with struct_ops
Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: force using our compiled libbpf headers
Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: do not manually call headers_install
Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: ensure we can compile the tests on kernels pre-6.3
Anshuman Khandual <anshuman.khandual@arm.com>
arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
Ryan Roberts <ryan.roberts@arm.com>
arm64/mm: convert ptep_clear() to ptep_get_and_clear()
Ryan Roberts <ryan.roberts@arm.com>
arm64/mm: convert set_pte_at() to set_ptes(..., 1)
Ryan Roberts <ryan.roberts@arm.com>
arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep)
Lee Jones <lee@kernel.org>
HID: core: Fix OOB read in hid_get_report for numbered reports
Georgiy Osokin <g.osokin@auroraos.dev>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
Myeonghun Pak <mhun512@gmail.com>
ata: sata_gemini: unwind clocks on IDE pinctrl errors
Michael Bommarito <michael.bommarito@gmail.com>
minix: avoid overflow in bitmap block count calculation
David Howells <dhowells@redhat.com>
afs: Fix unchecked-length string display in debug statement
David Howells <dhowells@redhat.com>
afs: Fix the volume AFS_VOLUME_RM_TREE is set on
David Howells <dhowells@redhat.com>
afs: Fix vllist leak
David Howells <dhowells@redhat.com>
afs: Fix callback service message parsers to pass through -EAGAIN
Zilin Guan <zilin@seu.edu.cn>
afs: use kvfree() to free memory allocated by kvcalloc()
Dan Carpenter <error27@gmail.com>
afs: Fix error code in afs_extract_vl_addrs()
Christian Brauner <brauner@kernel.org>
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
Samuel Moelius <sam.moelius@trailofbits.com>
net/sched: hhf: clear heavy-hitter state on reset
Viacheslav Bocharov <v@baodeep.com>
pinctrl: meson: restore non-sleeping GPIO access
Vladimir Zapolskiy <vz@kernel.org>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
ZhangGuoDong <zhangguodong@kylinos.cn>
smb: move some duplicate definitions to common/cifsglob.h
Haofeng Li <lihaofeng@kylinos.cn>
ksmbd: reject undersized DACLs before parsing ACEs
Sechang Lim <rhkrqnwk98@gmail.com>
net/sched: act_bpf: use rcu_dereference_bh() to read the filter
Gleb Markov <markov.gi@npc-ksb.ru>
cxgb4: Fix decode strings dump for T6 adapters
Longjun Tang <tanglongjun@kylinos.cn>
virtio_net: disable cb when NAPI is busy-polled
Qingshuang Fu <fuqingshuang@kylinos.cn>
irqchip/ts4800: Fix missing chained handler cleanup on remove
Yuho Choi <dbgh9129@gmail.com>
irqchip/gic-v3-its: Fix OF node reference leak
Martin Kaiser <martin@kaiser.cx>
tracing: eprobe: read the complete FILTER_PTR_STRING pointer
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/events: Fix to check the simple_tsk_fn creation
Ido Schimmel <idosch@nvidia.com>
bridge: stp: Fix a potential use-after-free when deleting a bridge
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
Rosen Penev <rosenp@gmail.com>
net: gianfar: dispose irq mappings on probe failure and device removal
Petr Wozniak <petr.wozniak@gmail.com>
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
Xiang Mei <xmei5@asu.edu>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus) Fix passing events to regulator core
Matti Vaittinen <mazziesaccount@gmail.com>
hwmon: adm1275: Prevent reading uninitialized stack
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: DEC: Ensure RTC platform device deregistration upon failure
Yousef Alhouseen <alhouseenyousef@gmail.com>
sctp: fix SCTP_RESET_STREAMS stream list length limit
Wei Fang <wei.fang@nxp.com>
net: enetc: check the number of BDs needed for xdp_frame
Matvey Kovalev <matvey.kovalev@ispras.ru>
qede: fix out-of-bounds check for cqe->len_list[]
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
seg6: validate SRH length before reading fixed fields
Pengpeng Hou <pengpeng@iscas.ac.cn>
gpio: htc-egpio: use managed gpiochip registration
Pengpeng Hou <pengpeng@iscas.ac.cn>
gpio: mvebu: fail probe if gpiochip registration fails
Pengpeng Hou <pengpeng@iscas.ac.cn>
spi: sh-msiof: abort transfers when reset times out
Martin Kaiser <martin@kaiser.cx>
tracing: probes: fix typo in a log message
Rob Herring (Arm) <robh@kernel.org>
dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
Ruoyu Wang <ruoyuw560@gmail.com>
net: sungem: fix probe error cleanup
Yun Zhou <yun.zhou@windriver.com>
net: mvneta: re-enable percpu interrupt on resume
Haoxiang Li <haoxiang_li2024@163.com>
rtc: cmos: unregister HPET IRQ handler on probe failure
Fredrik M Olsson <fredrik.m.olsson@axis.com>
rtc: ds1307: Fix off-by-one issue with wday for rx8130
Huiwen He <hehuiwen@kylinos.cn>
smb/client: preserve errors from smb2_set_sparse()
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in disable_policy sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in forwarding sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in disable_ipv6 sysctl
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
Eric Dumazet <edumazet@google.com>
veth: fix NAPI leak in XDP enable error path
Aleksandrova Alyona <aga@itb.spb.ru>
net: dsa: sja1105: round up PTP perout pin duration
Xiang Mei <xmei5@asu.edu>
net, bpf: check master for NULL in xdp_master_redirect()
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
Koichiro Den <den@valinux.co.jp>
NTB: epf: Fix doorbell bitmask and IRQ vector handling
Koichiro Den <den@valinux.co.jp>
NTB: epf: Report 0-based doorbell vector via ntb_db_event()
Koichiro Den <den@valinux.co.jp>
NTB: epf: Make db_valid_mask cover only real doorbell bits
Florian Westphal <fw@strlen.de>
netfilter: nft_compat: ebtables emulation must reject non-bridge targets
Runyu Xiao <runyu.xiao@seu.edu.cn>
netfilter: nft_synproxy: stop bypassing the priv->info snapshot
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
Mathias Krause <minipli@grsecurity.net>
netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
Bradley Morgan <include@grrlz.net>
bpf: Disable xfrm_decode_session hook attachment
Xu Kuohai <xukuohai@huawei.com>
bpf, lsm: Add disabled BPF LSM hook list
Kuniyuki Iwashima <kuniyu@google.com>
ipv4: fib: Don't ignore error route in local/main tables.
Xiang Mei <xmei5@asu.edu>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
Stepan Ionichev <sozdayvek@gmail.com>
rtc: msc313: fix NULL deref in shared IRQ handler at probe
Mohamed Khalfella <mkhalfella@purestorage.com>
i40e: Fix i40e_debug() to use struct i40e_hw argument
Lukasz Czapnik <lukasz.czapnik@intel.com>
ice: fix AQ error code comparison in ice_set_pauseparam()
Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
Xiang Mei <xmei5@asu.edu>
drm/edid: fix OOB read in drm_parse_tiled_block()
Amery Hung <ameryhung@gmail.com>
bpf: Fix effective prog array index with BPF_F_PREORDER
Avinash Duduskar <avinash.duduskar@gmail.com>
bpf: zero-initialize the fib lookup flow struct
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
bpf: Fix stack slot index in nospec checks
Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
Antoni Pokusinski <apokusinski01@gmail.com>
rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
Geetha sowjanya <gakula@marvell.com>
octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
Subbaraya Sundeep <sbhatta@marvell.com>
octeontx2-pf: Clear stats of all resources when freeing resources
Geetha sowjanya <gakula@marvell.com>
octeontx2-af: mcs: Fix unsupported secy stats read
Wayen Yan <win847@gmail.com>
net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
Weiming Shi <bestswngs@gmail.com>
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
Ruoyu Wang <ruoyuw560@gmail.com>
net: marvell: prestera: initialize err in prestera_port_sfp_bind
Aboorva Devarajan <aboorvad@linux.ibm.com>
selftests/mm: fix exclusive_cow test fork() handling
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: clarify alternate unmapping in compaction_test
Bhargav Joshi <j.bhargav.u@gmail.com>
irqchip/crossbar: Fix parent domain resource leak
Florian Westphal <fw@strlen.de>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
Florian Westphal <fw@strlen.de>
netfilter: nf_reject: skip iphdr options when looking for icmp header
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: annotate "pos" for concurrent readers/writers
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: Fix data race between add and dump in all hash types
Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
Aleksandr Nogikh <nogikh@google.com>
ieee802154: fix kernel-infoleak in dgram_recvmsg()
Ivan Abramov <i.abramov@mt-integration.ru>
ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
Xu Rao <raoxu@uniontech.com>
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
ACPI: resource: Amend kernel-doc style
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure
Breno Leitao <leitao@debian.org>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
Cen Zhang <zzzccc427@gmail.com>
ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
Yun Zhou <yun.zhou@windriver.com>
flow_dissector: check device type before reading ETH_ADDRS
Cosmin Ratiu <cratiu@nvidia.com>
devlink: Fix parent ref leak in devl_rate_node_create()
Ioana Ciornei <ioana.ciornei@nxp.com>
dpaa2-switch: fix VLAN upper check not rejecting bridge join
Xiang Mei <xmei5@asu.edu>
virtio-net: fix len check in receive_big()
Quang Nguyen <quang.nguyen.wx@renesas.com>
spi: rpc-if: Use correct device for hardware reinitialization on resume
Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
PCI: iproc: Restore .map_irq() for the platform bus driver
Xin Long <lucien.xin@gmail.com>
sctp: hold socket lock when dumping endpoints in sctp_diag
Jakub Kicinski <kuba@kernel.org>
net: psample: fix info leak in PSAMPLE_ATTR_DATA
Ratheesh Kannoth <rkannoth@marvell.com>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
drm/amdgpu: initialize irq.lock spinlock earlier
Mario Limonciello <mario.limonciello@amd.com>
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
Yunxiang Li <Yunxiang.Li@amd.com>
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
Sen Wang <sen@ti.com>
ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
Arnaldo Carvalho de Melo <acme@redhat.com>
perf cs-etm: Require full global header in auxtrace_info size check
Arnaldo Carvalho de Melo <acme@redhat.com>
perf cs-etm: Validate num_cpu before metadata allocation
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Use snprintf() for guestmount path construction
Eric Dumazet <edumazet@google.com>
xfrm: validate selector family and prefixlen during match
Eric Dumazet <edumazet@google.com>
xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
Mike Yu <yumike@google.com>
xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path
Steffen Klassert <steffen.klassert@secunet.com>
xfrm: Use the XFRM_GRO to indicate a GRO call on input
Jisheng Zhang <jszhang@kernel.org>
spi: dw: fix wrong BAUDR setting after resume
Pengpeng Hou <pengpeng@iscas.ac.cn>
gpio: mlxbf3: fail probe if gpiochip registration fails
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use snprintf() for root_dir path construction
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
Pengpeng Hou <pengpeng@iscas.ac.cn>
sparc: led: avoid trimming a newline from empty writes
John Johansen <john.johansen@canonical.com>
apparmor: fix label can not be immediately before a declaration
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Prevent reuse of dynamic address on device add failure
Zygmunt Krynicki <me@zygoon.pl>
apparmor: put secmark label after secid lookup
Zygmunt Krynicki <me@zygoon.pl>
apparmor: aa_getprocattr free procattr leak on format failure
Maxime Bélair <maxime.belair@canonical.com>
apparmor: fix potential UAF in aa_replace_profiles
Ryan Lee <ryan.lee@canonical.com>
apparmor: grab ns lock and refresh when looking up changehat child profiles
John Johansen <john.johansen@canonical.com>
apparmor: fix rawdata_f_data implicit flex array
Zygmunt Krynicki <me@zygoon.pl>
apparmor: aa_label_alloc use aa_label_free on alloc failure
Ruoyu Wang <ruoyuw560@gmail.com>
apparmor: check label build before no_new_privs test
Andrew Morton <akpm@linux-foundation.org>
security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
Yuanhe Shu <xiangzao@linux.alibaba.com>
Revert "PCI/MSI: Unmap MSI-X region on error"
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: mediatek: Use actual physical address instead of virt_to_phys()
Ryder Lee <ryder.lee@mediatek.com>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Add bounds checks to elf_read_build_id() note iteration
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix mount_overload() snprintf truncation and toupper range
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix filename__write_int() writing uninitialized stack data
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Fix thread__set_comm_from_proc() on empty comm file
Arnaldo Carvalho de Melo <acme@redhat.com>
perf intel-pt: Fix snprintf size tracking bug in insn decoder
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Bounds-check .gnu_debuglink section data
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix missing null termination in filename__read_int/ull()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
Arnaldo Carvalho de Melo <acme@redhat.com>
perf pmu: Fix pmu_id() heap underwrite on empty identifier file
James Clark <james.clark@linaro.org>
perf cs-etm: Queue context packets for frontend
James Clark <james.clark@arm.com>
perf cs-etm: Create decoders after both AUX and HW_ID search passes
Besar Wicaksono <bwicaksono@nvidia.com>
perf cs-etm: Fix incorrect or missing decoder for raw trace
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Return sendctx slot after Send preparation failure
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Repost Receive buffers for malformed replies
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Sanitize the reply credit grant after parsing
Chris Mason <clm@meta.com>
xprtrdma: Fix bcall rep leak and unbounded peek
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Resize reply buffers before reposting receives
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Document and assert reply-handler invariants
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Check frwr_wp_create() during connect
Arnaldo Carvalho de Melo <acme@redhat.com>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Fix idle-hist callchain display using wrong rb_first variant
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
PCI: rcar-host: Remove unused LIST_HEAD(res)
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file
Jamie Nguyen <jamien@nvidia.com>
fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
Shuvam Pandey <shuvampandey1@gmail.com>
PCI: meson: Propagate devm_add_action_or_reset() failure
Li RongQing <lirongqing@baidu.com>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
Mike Snitzer <snitzer@kernel.org>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
Mike Snitzer <snitzer@kernel.org>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
Clark Wang <xiaoning.wang@nxp.com>
nfs: keep PG_UPTODATE clear after read errors in page groups
Dai Ngo <dai.ngo@oracle.com>
NFSv4/pnfs: defer return_range callbacks until after inode unlock
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Decouple req recycling from RPC completion
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Use sendctx DMA state for Send signaling
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Post receive buffers after RPC completion
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Avoid 250 ms delay on backlog wakeup
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Remove temp allocation of rpcrdma_rep objects
Sagi Grimberg <sagi@grimberg.me>
pNFS/filelayout: fix cheking if a layout is striped
Phillip Varney <pbvarney@protonmail.com>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz
Nuno Sá <nuno.sa@analog.com>
dmaengine: Fix possible use after free
Icenowy Zheng <zhengxingda@iscas.ac.cn>
dmaengine: qcom: gpi: set DMA_PRIVATE capability
Arnaldo Carvalho de Melo <acme@redhat.com>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf mmap: Fix NULL deref in aio cleanup on alloc failure
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Clean up idle_threads entry on init failure
Arnaldo Carvalho de Melo <acme@redhat.com>
perf c2c: Bounds-check CPU and node IDs before bitmap and array access
Arnaldo Carvalho de Melo <acme@redhat.com>
perf mmap: Guard cpu__get_node() return in aio_bind()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Add bounds check to cpu__get_node()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Fix NULL dereference in latency_runtime_event
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Replace BUG_ON on invalid CPU with graceful skip
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Guard test_bit from out-of-bounds sample CPU
Rui Qi <qirui.001@bytedance.com>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
Shengjiu Wang <shengjiu.wang@nxp.com>
dmaengine: imx-sdma: Refine spba bus searching in probe
Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
drm/amd/display: Add missing kdoc for ALLM parameters
Jamie Nguyen <jamien@nvidia.com>
fs/ntfs3: fix mount failure on 64K page-size kernels
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: add bounds check to run_get_highest_vcn()
Rosen Penev <rosenp@gmail.com>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
Yuho Choi <dbgh9129@gmail.com>
clk: at91: keep securam node alive while mapping it
Aldo Conte <aldocontelk@gmail.com>
iio: tcs3472: power down chip on probe failure
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
Guilherme Ivo Bozi <guilherme.bozi@usp.br>
iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
Joshua Crofts <joshua.crofts1@gmail.com>
iio: magnetometer: ak8975: fix potential kernel stack memory leak
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: si1133: prevent race condition on timeout
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: si1133: reset counter to prevent race condition
Arnaldo Carvalho de Melo <acme@redhat.com>
perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
James Kim <james010kim@gmail.com>
char: tlclk: fix use-after-free in tlclk_cleanup()
Seungjin Bae <eeodqql09@gmail.com>
usb: host: max3421: Reject hub port requests for non-existent ports
Seungjin Bae <eeodqql09@gmail.com>
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
Guangshuo Li <lgs201920130244@gmail.com>
staging: most: video: avoid double free on video register failure
Sergey Senozhatsky <senozhatsky@chromium.org>
mailbox: mtk-adsp: fix UAF during device teardown
Leo Yan <leo.yan@arm.com>
perf pmu: Skip test on Arm64 when #slots is zero
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
phy: phy-can-transceiver: Check driver match and driver data against NULL
Sumit Kumar <sumit.kumar@oss.qualcomm.com>
bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
Rong Zhang <i@rong.moe>
PCI: loongson: Do not ignore downstream devices on external bridges
Ian Rogers <irogers@google.com>
perf sched: Add missing mmap2 handler in timehist
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
x86/platform/olpc: xo15: Drop wakeup source on driver removal
Guixin Liu <kanie@linux.alibaba.com>
PCI: Check ROM header and data structure addr before accessing
Guixin Liu <kanie@linux.alibaba.com>
PCI: Introduce named defines for PCI ROM
Carlos Bilbao <carlos.bilbao@kernel.org>
PCI/ASPM: Don't reconfigure ASPM entering low-power state
Leo Yan <leo.yan@arm.com>
coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
Yingchao Deng <yingchao.deng@oss.qualcomm.com>
coresight: cti: Fix DT filter signals silently ignored
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: nvec: fix use-after-free in nvec_rx_completed()
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/9p: fix race condition on rdma->state in trans_rdma.c
Aleksandr Nogikh <nogikh@google.com>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
Charles Keepax <ckeepax@opensource.cirrus.com>
mfd: cs42l43: Sanity check firmware size
Guangshuo Li <lgs201920130244@gmail.com>
ksmbd: fix use-after-free in same_client_has_lease()
Brett Creeley <brett.creeley@amd.com>
ionic: Fix check in ionic_get_link_ext_stats
Eric Dumazet <edumazet@google.com>
tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
Eric Dumazet <edumazet@google.com>
tipc: fix UAF in tipc_l2_send_msg()
Gui-Dong Han <hanguidong02@gmail.com>
KEYS: Use acquire when reading state in keyring search
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
Yadan Fan <ydfan@suse.com>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()
Sechang Lim <rhkrqnwk98@gmail.com>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
Weiming Shi <bestswngs@gmail.com>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
Leon Hwang <leon.hwang@linux.dev>
bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
Leo Yan <leo.yan@arm.com>
selftests/bpf: Initialize operation name before use
Huiwen He <hehuiwen@kylinos.cn>
smb/client: always return a value for FS_IOC_GETFLAGS
Jian Zhang <zhangjian496@huawei.com>
cifs: remove all cifs files before kill super
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
Florian Westphal <fw@strlen.de>
netfilter: nf_conncount: callers must hold rcu read lock
Runyu Xiao <runyu.xiao@seu.edu.cn>
kcm: use WRITE_ONCE() when changing lower socket callbacks
Ovidiu Panait <ovidiu.panait.rb@renesas.com>
net: bcmgenet: Use weighted round-robin TX DMA arbitration
Ruoyu Wang <ruoyuw560@gmail.com>
net: wwan: t7xx: check skb_clone in control TX
Dragos Tatulea <dtatulea@nvidia.com>
net/mlx5: Check max_macs devlink param value against max capability
Sun Jian <sun.jian.kdev@gmail.com>
bpf: Run generic devmap egress prog on private skb
Aditya Garg <gargaditya@linux.microsoft.com>
net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
Aditya Garg <gargaditya@linux.microsoft.com>
net: mana: initialize gdma queue id to INVALID_QUEUE_ID
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Chuck Lever <chuck.lever@oracle.com>
handshake: Require admin permission for DONE command
Lucas Tsai <lucas_tsai@richtek.com>
power: supply: core: fix supplied_from allocations
Guangshuo Li <lgs201920130244@gmail.com>
ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
Lars Pöschel <lars.poeschel@edag.com>
spi: xilinx: use FIFO occupancy register to determine buffer size
Herbert Xu <herbert@gondor.apana.org.au>
crypto: rng - Free default RNG on module exit
Felix Gu <ustc.gu@gmail.com>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
Felix Gu <ustc.gu@gmail.com>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
Dave Jiang <dave.jiang@intel.com>
cxl/test: Add check after kzalloc() memory in alloc_mock_res()
Michael Bommarito <michael.bommarito@gmail.com>
tipc: reject inverted service ranges from peer bindings
Michael Bommarito <michael.bommarito@gmail.com>
tipc: prevent snt_unacked underflow on CONN_ACK
Michael Bommarito <michael.bommarito@gmail.com>
tipc: require net admin for TIPCv2 netlink mutators
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_hfsc: Don't make class passive twice
Xin Long <lucien.xin@gmail.com>
sctp: validate embedded address parameter length
Xiang Mei <xmei5@asu.edu>
bridge: cfm: reject invalid CCM interval at configuration time
Kuniyuki Iwashima <kuniyu@google.com>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: cls_flow: Dont expose folded kernel pointers
HyeongJun An <sammiee5311@gmail.com>
ASoC: tegra: tegra210_ahub: Validate written enum value
HyeongJun An <sammiee5311@gmail.com>
ASoC: fsl: fsl_audmix: Validate written enum values
HyeongJun An <sammiee5311@gmail.com>
ASoC: codecs: hdac_hdmi: Validate written enum value
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
Maher Sanalla <msanalla@nvidia.com>
RDMA/mlx5: Fix undefined shift of user RQ WQE size
Patrisious Haddad <phaddad@nvidia.com>
RDMA/mlx5: Remove raw RSS QP restrack tracking
Maxwell Doose <m32285159@gmail.com>
fs: efs: remove unneeded debug prints
Samuel Moelius <sam.moelius@trailofbits.com>
Bluetooth: vhci: validate devcoredump state before side effects
Samuel Moelius <sam.moelius@trailofbits.com>
Bluetooth: hci: validate codec capability element length
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
Heiko Carstens <hca@linux.ibm.com>
s390/process: Fix kernel thread function pointer type
Daniel Borkmann <daniel@iogearbox.net>
bpf: Tighten cgroup storage cookie checks for prog arrays
Sergey Shtylyov <s.shtylyov@auroraos.dev>
of: cpu: add check in __of_find_n_match_cpu_property()
Dave Jiang <dave.jiang@intel.com>
cxl/test: Zero out LSA backing memory to avoid leaking to user
Dave Jiang <dave.jiang@intel.com>
cxl/test: Fix integer overflow in mock LSA bounds checks
Yonghong Song <yonghong.song@linux.dev>
selftests/bpf: Fix bpf_iter/task_vma test
Aditya Prakash Srivastava <aditya.ansh182@gmail.com>
ext4: fix kernel BUG in ext4_write_inline_data_end
Louis Scalbert <louis.scalbert@6wind.com>
bonding: 3ad: fix mux port state on oper down
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
longlong yan <yanlonglong@kylinos.cn>
tools/virtio: check mmap return value in vringh_test
Qing Ming <a0yami@mailbox.org>
vhost/net: complete zerocopy ubufs only once
Zhang Tianci <zhangtianci.1997@bytedance.com>
vduse: Requeue failed read to send_list head
Qihang Tang <q.h.hack.winter@gmail.com>
vhost/vdpa: validate virtqueue index in mmap and fault paths
Qihang Tang <q.h.hack.winter@gmail.com>
vduse: hold vduse_lock across IDR lookup in open path
Val Packett <val@packett.cool>
ASoC: codecs: aw88261: fix incorrect masks for boost regs
Ruoyu Wang <ruoyuw560@gmail.com>
spi: meson-spifc: fix runtime PM leak on remove
Jason Gunthorpe <jgg@ziepe.ca>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
Johannes Thumshirn <johannes.thumshirn@wdc.com>
btrfs: zoned: don't account data relocation space-info in statfs free space
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
hwmon: (it87) Clamp negative values to zero in set_fan()
David Laight <david.laight.linux@gmail.com>
fbdev: sm501fb: Fix buffer errors in OF binding code
Filipe Manana <fdmanana@suse.com>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
Ryder Lee <ryder.lee@mediatek.com>
wifi: mt76: mt7921: fix potential tx_retries underflow
Ryder Lee <ryder.lee@mediatek.com>
wifi: mt76: mt7915: fix potential tx_retries underflow
Bjoern A. Zeeb <bz@FreeBSD.org>
wifi: mt76: fix argument to ieee80211_is_first_frag()
Hongyan Xia <hongyan.xia@transsion.com>
sched/fair: Fix cpu_util runnable_avg arithmetic
Wolfram Sang <wsa+renesas@sang-engineering.com>
hwspinlock: qcom: avoid uninitialized struct members
Hui Zhu <zhuhui@kylinos.cn>
vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
Luca Leonardo Scorcia <l.scorcia@gmail.com>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
Luca Leonardo Scorcia <l.scorcia@gmail.com>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
Mike Christie <michael.christie@oracle.com>
scsi: target: Remove tcm_loop target reset handling
David Disseldorp <ddiss@suse.de>
scsi: target: Fix hexadecimal CHAP_I handling
Yuho Choi <dbgh9129@gmail.com>
watchdog: unregister PM notifier on watchdog unregister
Al Viro <viro@zeniv.linux.org.uk>
configfs: fix lockless traversals of ->s_children
Dmitry Vyukov <dvyukov@google.com>
firmware_loader: Fix recursive lock in device_cache_fw_images()
Felix Gu <ustc.gu@gmail.com>
spi: ep93xx: fix double-free of zeropage on DMA setup failure
Jason Gunthorpe <jgg@ziepe.ca>
IB/mlx5: Properly support implicit ODP rereg_mr
Jason Gunthorpe <jgg@ziepe.ca>
IB/mlx5: Don't take the rereg_mr fallback without a new translation
Pengjie Zhang <zhangpengjie2@huawei.com>
cpufreq: Documentation: fix conservative governor freq_step description
Yuho Choi <dbgh9129@gmail.com>
ACPI: IPMI: Fix message kref handling on dead device
Kyle Zeng <kylebot@openai.com>
ALSA: seq: Clear variable event pointer on read
Rui Qi <qirui.001@bytedance.com>
riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
HyeongJun An <sammiee5311@gmail.com>
ALSA: seq: Fix partial userptr event expansion
Tristan Madani <tristan@talencesecurity.com>
wifi: wcn36xx: fix OOB read from short trigger BA firmware response
Tristan Madani <tristan@talencesecurity.com>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
Tristan Madani <tristan@talencesecurity.com>
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
Leon Hwang <leon.hwang@linux.dev>
bpf: Update transport_header when encapsulating UDP tunnel in lwt
Leon Hwang <leon.hwang@linux.dev>
bpf: Check tail zero of bpf_prog_info
Alexander Stein <alexander.stein@ew.tq-group.com>
arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Initialize iwmr->access during MR registration
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Fix OOB read during CQ MR registration
Jason Gunthorpe <jgg@ziepe.ca>
IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: conntrack: revert ct extension genid infrastructure
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
Zhang Cen <rollkingzzc@gmail.com>
ocfs2/dlm: require a ref for locking_state debugfs open
Zhang Cen <rollkingzzc@gmail.com>
ocfs2: reject FITRIM ranges shorter than a cluster
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: fix buffer head management in ocfs2_read_blocks()
Zhang Cen <rollkingzzc@gmail.com>
ocfs2: rebase copied fsdlm LVB pointers in locking_state
Sandipan Das <sandipan.das@amd.com>
perf/x86/amd/core: Always use the NMI latency mitigation
Woojin Ji <random6.xyz@gmail.com>
bpftool: Use libbpf error code for flow dissector query
Yunxiang Li <Yunxiang.Li@amd.com>
drm/amdgpu: set sub_block_index for mca ras sub-blocks
Al Viro <viro@zeniv.linux.org.uk>
configfs_lookup(): don't leave ->s_dentry dangling on failure
Alexander Potapenko <glider@google.com>
lib/test_meminit: use && for bools
Guanyou.Chen <chenguanyou9338@gmail.com>
sched: restore timer_slack_ns when resetting RT policy on fork
Danila Chernetsov <listdansp@mail.ru>
ext2: fix ignored return value of generic_write_sync()
Sang-Heon Jeon <ekffu200098@gmail.com>
mm/fake-numa: fix under-allocation detection in uniform split
Deepanshu Kartikey <kartikey406@gmail.com>
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
Chanwoo Lee <cw9316.lee@samsung.com>
scsi: ufs: Fix wrong value printed in unexpected UPIU response case
Dan Carpenter <error27@gmail.com>
scsi: pm8001: Fix error code in non_fatal_log_show()
Martin Wilck <martin.wilck@suse.com>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
Alison Schofield <alison.schofield@intel.com>
nvdimm/btt: Handle preemption in BTT lane acquisition
Yuho Choi <dbgh9129@gmail.com>
ARM: imx31: Fix IIM mapping leak in revision check
Bart Van Assche <bvanassche@acm.org>
ata: libata: Fix ata_exec_internal()
J. Neuschäfer <j.ne@posteo.net>
HID: wiimote: Fix table layout and whitespace errors
Yuho Choi <dbgh9129@gmail.com>
ARM: imx3: Fix CCM node reference leak
John Madieu <john.madieu.xa@bp.renesas.com>
ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
Zhang Yi <yi.zhang@huawei.com>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
Chen Cheng <chencheng@fnnas.com>
md/raid10: reset read_slot when reusing r10bio for discard
Danilo Krummrich <dakr@kernel.org>
rpmsg: use generic driver_override infrastructure
Renjiang Han <renjiang.han@oss.qualcomm.com>
media: qcom: venus: relax encoder frame/blur step size on v6
Renjiang Han <renjiang.han@oss.qualcomm.com>
media: qcom: venus: relax encoder frame/blur dimension steps on v4
Renjiang Han <renjiang.han@oss.qualcomm.com>
media: qcom: venus: drop extra padding in NV12 raw size calculation
Tristan Madani <tristmd@gmail.com>
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
Tristan Madani <tristmd@gmail.com>
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
zhoumin <teczm@foxmail.com>
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
Jessica Zhang <jessica.zhang@oss.qualcomm.com>
drm/msm/dp: Fix the ISR_* enum values
Jessica Zhang <jessica.zhang@oss.qualcomm.com>
drm/msm/dp: fix HPD state status bit shift value
Weili Qian <qianweili@huawei.com>
crypto: hisilicon/qm - disable error report before flr
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
ocfs2: kill osb->system_file_mutex lock
ZhengYuan Huang <gality369@gmail.com>
ocfs2: don't BUG_ON an invalid journal dinode
Dan Carpenter <error27@gmail.com>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
Davidlohr Bueso <dave@stgolabs.net>
dax/kmem: account for partial discontiguous resource upon removal
Carlos Llamas <cmllamas@google.com>
libbpf: Fix UAF in strset__add_str()
Michael Bommarito <michael.bommarito@gmail.com>
libbpf: Harden parse_vma_segs() path parsing
Timur Tabi <ttabi@nvidia.com>
drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
Mikko Perttunen <mperttunen@nvidia.com>
drm/tegra: Fix iommu_map_sgtable() return value check
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Fix iommu_map_sgtable() return value check
Felix Gu <ustc.gu@gmail.com>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Allow entries in BO caches to be freed
Ion Agorria <ion@agorria.com>
drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
Svyatoslav Ryhel <clamor95@gmail.com>
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
Jiayuan Chen <jiayuan.chen@linux.dev>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback
Eric Dumazet <edumazet@google.com>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
Breno Leitao <leitao@debian.org>
workqueue: drop spurious '*' from print_worker_info() fn declaration
Nilay Shroff <nilay@linux.ibm.com>
nvme-multipath: fix flex array size in struct nvme_ns_head
Charles Keepax <ckeepax@opensource.cirrus.com>
pinctrl: cs42l43: Fix polarity on debounce
Zhang Cen <rollkingzzc@gmail.com>
ALSA: seq: midi: Serialize output teardown with event_input
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: spi-nor: Drop duplicate Kconfig dependency
Rosen Penev <rosenp@gmail.com>
mips: n64: add __iomem for writel call
Rosen Penev <rosenp@gmail.com>
mips: ralink: mt7621: add missing __iomem
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: DEC: Remove do_IRQ() call indirection
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: Fix big-endian stack argument fetching in o32 wrapper
Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
PM: sleep: Use complete() in device_pm_sleep_init()
Tao Cui <cuitao@kylinos.cn>
RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup
Lianfa Weng <wenglianfa@huawei.com>
RDMA/hns: Fix warning in poll cq direct mode
Guangshuo Li <lgs201920130244@gmail.com>
IB/mlx4: Fix refcount leak in add_port() error path
Zhu Yanjun <yanjun.zhu@linux.dev>
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
Samuel Holland <samuel@sholland.org>
bus: sunxi-rsb: Always check register address validity
Ronaldo Nunez <rnunez@baylibre.com>
pwm: imx27: Fix variable truncation in .apply()
Lifeng Zheng <zhenglifeng1@huawei.com>
cpufreq: conservative: Simplify frequency limit handling
Pengjie Zhang <zhangpengjie2@huawei.com>
cpufreq: Documentation: fix sampling_down_factor range
Saravana Kannan <saravanak@google.com>
Revert "treewide: Fix probing of devices in DT overlays"
Zhang Yuwei <zhangyuwei20@huawei.com>
driver core: Use mod_delayed_work to prevent lost deferred probe work
Stepan Ionichev <sozdayvek@gmail.com>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
Pengpeng Hou <pengpeng@iscas.ac.cn>
tracing: Bound synthetic-field strings with seq_buf
Harshal Dev <harshal.dev@oss.qualcomm.com>
arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node
Geert Uytterhoeven <geert+renesas@glider.be>
firmware: arm_scmi: Fix OOB in scmi_power_name_get()
Sven Püschel <s.pueschel@pengutronix.de>
media: rockchip: rga: fix too small buffer size
Eric Dumazet <edumazet@google.com>
net/sched: sch_drr: annotate data-races around cl->deficit
Chen-Yu Tsai <wenst@chromium.org>
regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
Randy Dunlap <rdunlap@infradead.org>
bitops: use common function parameter names
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sysfs: clamp show() return value in sysfs_kf_read()
Sudeep Holla <sudeep.holla@kernel.org>
firmware: arm_scmi: Read sensor config as 32-bit value
Zilin Guan <zilin@seu.edu.cn>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
Sara Venkatesh <sarajvenkatesh@gmail.com>
RDMA/srpt: fix integer overflow in immediate data length check
Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()
Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
Linmao Li <lilinmao@kylinos.cn>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
Eric Dumazet <edumazet@google.com>
net/sched: sch_htb: annotate data-races (I)
Eric Dumazet <edumazet@google.com>
net/sched: sch_htb: do not change sch->flags in htb_dump()
Qiang Ma <maqianga@uniontech.com>
spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
Sean Christopherson <seanjc@google.com>
crypto: ccp - Treat zero-length cert chain as query for blob lengths
Eric Dumazet <edumazet@google.com>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
Stepan Ionichev <sozdayvek@gmail.com>
clk: scpi: Unregister child clock providers on remove
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
thermal: hwmon: Fix critical temperature attribute removal
Pengpeng Hou <pengpeng@iscas.ac.cn>
evm: terminate and bound the evm_xattrs read buffer
Lin He <helin52@huawei.com>
drm/hisilicon/hibmc: use clock to look up the PLL value
Lin He <helin52@huawei.com>
drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
arm64: dts: qcom: sm8450: Fix ICE reg size
Cristian Marussi <cristian.marussi@arm.com>
clk: scmi: Fix clock rate rounding
Chen-Yu Tsai <wenst@chromium.org>
arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
Sean Christopherson <seanjc@google.com>
iommu/amd: Fix a stale comment about which legacy mode is user visible
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
nilfs2: fix backing_dev_info reference leak
Alexander Aring <aahringo@redhat.com>
dlm: fix add msg handle in send_queue ordered
Weiming Shi <bestswngs@gmail.com>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
Thorsten Blum <thorsten.blum@linux.dev>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
Lothar Rubusch <l.rubusch@gmail.com>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic
Kuniyuki Iwashima <kuniyu@google.com>
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
Peng Fan <peng.fan@nxp.com>
arm64: dts: imx8x-colibri: Correct SODIMM PAD settings
Weixin Guo <2298701336@qq.com>
arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
Felix Gu <ustc.gu@gmail.com>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
Nas Chung <nas.chung@chipsnmedia.com>
media: v4l2-common: Add YUV24 format info
Samuel Holland <samuel@sholland.org>
media: cedrus: Fix failure to clean up hardware on probe failure
Felix Gu <ustc.gu@gmail.com>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
Balakrishnan Sambath <balakrishnan.s@microchip.com>
watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
Yingjie Gao <gaoyingjie@uniontech.com>
watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
Tristan Madani <tristan@talencesecurity.com>
wifi: ath9k: fix OOB access from firmware tx status queue ID
Xingjing Deng <micro6947@gmail.com>
kconfig: fix potential NULL pointer dereference in conf_askvalue
Tristan Madani <tristan@talencesecurity.com>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
Shin-Yi Lin <isaiah@realtek.com>
wifi: rtw89: Correct data type for scan index to avoid infinite loop
Danilo Krummrich <dakr@kernel.org>
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
Jon Hunter <jonathanh@nvidia.com>
arm64: tegra: Fix Tegra234 MGBE PTP clock
Louis Kotze <loukot@gmail.com>
wifi: cfg80211: fix grammar in MLO group key error message
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning
Diederik de Haas <diederik@cknow-tech.com>
arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
Baolin Liu <liubaolin@kylinos.cn>
Documentation: proc: fix section numbering in table of contents
Aaron Tomlin <atomlin@atomlin.com>
libbpf: Report error when a negative kprobe offset is specified
Yuho Choi <dbgh9129@gmail.com>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
Werner Kasselman <werner@verivus.ai>
drm/radeon: fix integer overflow in radeon_align_pitch()
Werner Kasselman <werner@verivus.ai>
drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drm/tidss: Drop extra drm_mode_config_reset() call
Thomas Zimmermann <tzimmermann@suse.de>
drm/rockchip: Test for imported buffers with drm_gem_is_imported()
Chen Ni <nichen@iscas.ac.cn>
clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()
Ian Bridges <icb@fastmail.org>
fbcon: fix NULL pointer dereference for a console without vc_data
David Howells <dhowells@redhat.com>
afs: Fix further netns teardown to cancel the preallocation charger
Matvey Kovalev <matvey.kovalev@ispras.ru>
afs: fix NULL pointer dereference in afs_get_tree()
David Howells <dhowells@redhat.com>
afs: Fix netns teardown to cancel the preallocation charger
David Howells <dhowells@redhat.com>
rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
Jeffrey Altman <jaltman@auristor.com>
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
serial: 8250_omap: clear rx_running on zero-length DMA completes
Stephan Gerhold <stephan.gerhold@linaro.org>
serial: msm: Disable DMA for kernel console UART
Guoniu Zhou <guoniu.zhou@oss.nxp.com>
dt-bindings: power: imx93: Add MIPI PHY power domain
Chen-Yu Tsai <wens@kernel.org>
dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Fix sequence number when no EOF
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Fix buffer sequence in frame gaps
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Avoid partial metadata buffers
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
bpf: Prefer dirty packs for eBPF allocations
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
bpf: Prefer packs that won't trigger an IBPB flush on allocation
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
bpf: Skip redundant IBPB in pack allocator
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
bpf: Restrict JIT predictor flush to cBPF
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
x86/bugs: Enable IBPB flush on BPF JIT allocation
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
bpf: Support for hardening against JIT spraying
Eric Biggers <ebiggers@kernel.org>
crypto: hisi-trng - Remove crypto_rng interface
Eric Biggers <ebiggers@kernel.org>
crypto: crypto4xx - Remove insecure and unused rng_alg
Herbert Xu <herbert@gondor.apana.org.au>
crypto: crypto4xx - Remove ahash-related code
Stephen Dolan <sdolan@janestreet.com>
x86/mm: Fix check/use ordering in switch_mm_irqs_off()
Eric Biggers <ebiggers@kernel.org>
crypto: sun4i-ss - Remove insecure and unused rng_alg
Sagi Grimberg <sagi@grimberg.me>
nvmet-tcp: Fix potential UAF when ddgst mismatch
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
Hyunwoo Kim <imv4bel@gmail.com>
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
Hyunwoo Kim <imv4bel@gmail.com>
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
Adam Li <adamli@os.amperecomputing.com>
sched/fair: Only update stats for allowed CPUs when looking for dst group
Chao Shi <coshi036@gmail.com>
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
ChenXiaoSong <chenxiaosong@kylinos.cn>
smb/server: do not require delete access for non-replacing links
Darrick J. Wong <djwong@kernel.org>
xfs: resample the data fork mapping after cycling ILOCK
Weiming Shi <bestswngs@gmail.com>
xfs: fail recovery on a committed log item with no regions
Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
smb: client: reject overlapping data areas in SMB2 responses
Joanne Koong <joannelkoong@gmail.com>
fuse: re-lock request before returning from fuse_ref_folio()
Alberto Ruiz <aruiz@redhat.com>
fuse: fix device node leak in cuse_process_init_reply()
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/siw: bound Read Response placement to the RREAD length
Zhenhao Wan <whi4ed0g@gmail.com>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maplecontrol - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maplemouse - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maple_keyb - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: mms114 - fix multi-touch slot corruption
Florian Fuchs <fuchsfl@gmail.com>
Input: maplemouse - fix NULL pointer dereference in open()
Bryam Vargas <hexlabsecurity@proton.me>
Input: mms114 - reject an oversized device packet size
Bryam Vargas <hexlabsecurity@proton.me>
Input: touchwin - reset the packet index on every complete packet
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: mms114 - fix touch indexing for MMS134S and MMS136
Bryam Vargas <hexlabsecurity@proton.me>
Input: iforce - bound the device-reported force-feedback effect index
Bryam Vargas <hexlabsecurity@proton.me>
Input: goodix - clamp the device-reported contact count
Ranjan Kumar <kumarranja@chromium.org>
Input: elan_i2c - prevent division by zero and arithmetic underflow
Bryam Vargas <hexlabsecurity@proton.me>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Bryam Vargas <hexlabsecurity@proton.me>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Haoxiang Li <haoxiang_li2024@163.com>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
Guillermo Rodríguez <guille.rodriguez@gmail.com>
i2c: stm32f7: truncate clock period instead of rounding it
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
i2c: mpc: Fix timeout calculations
Johan Hovold <johan@kernel.org>
i2c: core: fix adapter deregistration race
Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
udmabuf: fix DMA direction mismatch in release_udmabuf()
Sean Christopherson <seanjc@google.com>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Sean Christopherson <seanjc@google.com>
KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
Koichiro Den <den@valinux.co.jp>
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
Bryam Vargas <hexlabsecurity@proton.me>
exfat: bound uniname advance in exfat_find_dir_entry()
Andrii Kuchmenko <capyenglishlite@gmail.com>
module: decompress: check return value of module_extend_max_pages()
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Huihui Huang <hhhuang@smu.edu.sg>
tracing: Prevent out-of-bounds read in glob matching
Janne Grunau <j@jannau.net>
watchdog: apple: Add "apple,t8103-wdt" compatible
Vasily Khoruzhick <vasilykh@arista.com>
EDAC/i10nm: Don't fail probing if ADXL is missing
Carlos Song <carlos.song@nxp.com>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
Carlos Song <carlos.song@nxp.com>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
Mark Rutland <mark.rutland@arm.com>
arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - remove useless wrapper
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - drop workqueue mechanism for SEC1
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - move code in current_desc_hdr() into a standalone function
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - validate RSA CRT component lengths
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix the fips_enabled priority boost
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix returning success on failure in CTR_DRBG
Ruijie Li <ruijieli51@gmail.com>
crypto: pcrypt - restore callback for non-parallel fallback
Anastasia Tishchenko <sv3iry@gmail.com>
crypto: ecc - Fix carry overflow in vli multiplication
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Eric Biggers <ebiggers@kernel.org>
crypto: af_alg - Remove zero-copy support from skcipher and aead
Bryam Vargas <hexlabsecurity@proton.me>
isofs: bound Rock Ridge symlink components to the SL record
Bryam Vargas <hexlabsecurity@proton.me>
partitions: aix: bound the pp_count scan to the ppe array
Qu Wenruo <wqu@suse.com>
btrfs: do not trim a device which is not writeable
Achkinazi, Igor <Igor.Achkinazi@dell.com>
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
Mikulas Patocka <mpatocka@redhat.com>
dm-ioctl: report an error if a device has no table
Wentao Liang <vulab@iscas.ac.cn>
hwrng: jh7110 - fix refcount leak in starfive_trng_read()
Bryam Vargas <hexlabsecurity@proton.me>
udf: validate sparing table length as an entry count, not a byte count
Bryam Vargas <hexlabsecurity@proton.me>
udf: validate VAT header length against the VAT inode size
Michael Bommarito <michael.bommarito@gmail.com>
udf: validate free block extents against the partition length
Maciej W. Rozycki <macro@orcam.me.uk>
PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
Liviu Stan <liviu.stan@analog.com>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
Paul Menzel <pmenzel@molgen.mpg.de>
usb: typec: ucsi: cancel pending work on system suspend
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
Madhu M <madhu.m@intel.com>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
Andrei Kuchynski <akuchynski@chromium.org>
usb: typec: ucsi: Invert DisplayPort role assignment
Badhri Jagan Sridharan <badhri@google.com>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
usb: typec: class: drop PD lookup reference
Myeonghun Pak <mhun512@gmail.com>
usb: typec: anx7411: use devm_pm_runtime_enable()
Sam Day <me@samcday.com>
usbip: vudc: fix NULL deref in vep_dequeue()
Yichong Chen <chenyichong@uniontech.com>
usbip: tools: support SuperSpeedPlus devices
Xu Rao <raoxu@uniontech.com>
USB: usb-storage: ene_ub6250: restore media-ready check
Johan Hovold <johan@kernel.org>
USB: ulpi: fix memory leak on registration failure
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix write buffer corruption
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix hard lockup on disconnect
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix broken rx after throttle
Fabio Porcedda <fabio.porcedda@gmail.com>
USB: serial: option: add Telit Cinterion FE990D50 compositions
Johan Hovold <johan@kernel.org>
USB: serial: keyspan_pda: fix information leak
Haoxiang Li <haoxiang_li2024@163.com>
usb: mtu3: unmap request DMA on queue failure
Myeonghun Pak <mhun512@gmail.com>
USB: misc: uss720: unregister parport on probe failure
Xu Rao <raoxu@uniontech.com>
USB: storage: include US_FL_NO_SAME in quirks mask
Myeonghun Pak <mhun512@gmail.com>
usb: sl811-hcd: disable controller wakeup on remove
Johan Hovold <johan@kernel.org>
USB: legousbtower: fix use-after-free on disconnect race
Erich E. Hoover <erich.e.hoover@gmail.com>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix use-after-free on disconnect
Johan Hovold <johan@kernel.org>
USB: ldusb: fix use-after-free on disconnect race
Johan Hovold <johan@kernel.org>
USB: idmouse: fix use-after-free on disconnect race
Xu Rao <raoxu@uniontech.com>
usb: gadget: f_printer: take kref only for successful open
Jimmy Hu <hhhuuu@google.com>
usb: gadget: udc: Fix use-after-free in gadget_match_driver
Maoyi Xie <maoyixie.tju@gmail.com>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
Dawei Feng <dawei.feng@seu.edu.cn>
usb: free iso schedules on failed submit
WenTao Liang <vulab@iscas.ac.cn>
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
Haoxiang Li <haoxiang_li2024@163.com>
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
Jared Baldridge <jrb@expunge.us>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner
Maoyi Xie <maoyixie.tju@gmail.com>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
Dawei Feng <dawei.feng@seu.edu.cn>
bpf: Restore sysctl new-value from 1 to 0
Zhao Zhang <zzhan461@ucr.edu>
bpf: Reject fragmented frames in devmap
Alexey Nepomnyashih <sdl@nppct.ru>
xfs: fix unreachable BIGTIME check in dquot flush validation
Yousef Alhouseen <alhouseenyousef@gmail.com>
xfs: use null daddr for unset first bad log block
Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
media: mtk-jpeg: cancel workqueue on release for supported platforms only
Deepanshu Kartikey <kartikey406@gmail.com>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Tristan Madani <tristan@talencesecurity.com>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
Maoyi Xie <maoyixie.tju@gmail.com>
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Manish Khadka <maskmemanish@gmail.com>
HID: letsketch: fix UAF on inrange_timer at driver unbind
Myeonghun Pak <mhun512@gmail.com>
HID: wacom: stop hardware after post-start probe failures
Yichong Chen <chenyichong@uniontech.com>
tools/mm/slabinfo: fix total_objects attribute name
Xuewen Wang <wangxuewen@kylinos.cn>
tools/mm/slabinfo: Fix trace disable logic inversion
Lukas Wunner <lukas@wunner.de>
X.509: Fix validation of ASN.1 certificate header
Kartik Rajput <kkartik@nvidia.com>
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
WenTao Liang <vulab@iscas.ac.cn>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
Yuho Choi <dbgh9129@gmail.com>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Tianxiang Chen <nanmu@xiaomi.com>
cpufreq: Fix hotplug-suspend race during reboot
Steven Rostedt <rostedt@goodmis.org>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
Fushuai Wang <wangfushuai@baidu.com>
cpufreq: intel_pstate: Sync policy->cur during CPU offline
Guangshuo Li <lgs201920130244@gmail.com>
firmware_loader: fix device reference leak in firmware_upload_register()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
OPP: of: Fix potential memory leak in opp_parse_supplies()
Norbert Manthey <nmanthey@amazon.de>
smb: client: mask server-provided mode to 07777 in modefromsid
Zihan Xi <xizh2024@lzu.edu.cn>
smb: client: harden POSIX SID length parsing
Zihan Xi <xizh2024@lzu.edu.cn>
smb: client: use unaligned reads in parse_posix_ctxt()
Haoxiang Li <haoxiang_li2024@163.com>
smb: client: Fix next buffer leak in receive_encrypted_standard()
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix double-free in SMB2_close() replay
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix double-free in SMB2_open() replay
Zhao Zhang <zzhan461@ucr.edu>
smb: client: fix double-free in SMB2_flush() replay
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix change notify replay double-free
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix double-free in SMB2_ioctl() replay
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix query_info() replay double-free
Henrique Carvalho <henrique.carvalho@suse.com>
smb: client: fix query directory replay double-free
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: use opener credentials for delete-on-close
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: run set info with opener credentials
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: require source read access for duplicate extents
Davide Ornaghi <d.ornaghi97@gmail.com>
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: serialize QUERY_DIRECTORY requests per file
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
Dan Carpenter <error27@gmail.com>
smb/client: Fix error code in smb2_aead_req_alloc()
Junrui Luo <moonafterrain@outlook.com>
coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
Deepanshu Kartikey <kartikey406@gmail.com>
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: handle attr_set_size() errors when truncating files
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: fsync files by syncing parent inodes
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: L2CAP: validate option length before reading conf opt value
Yousef Alhouseen <alhouseenyousef@gmail.com>
Bluetooth: fix UAF in bt_accept_dequeue()
Maoyi Xie <maoyixie.tju@gmail.com>
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
Yousef Alhouseen <alhouseenyousef@gmail.com>
Bluetooth: bnep: pin L2CAP connection during netdev registration
Sergey Senozhatsky <senozhatsky@chromium.org>
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
Xiang Mei <xmei5@asu.edu>
netfilter: ebtables: terminate table name before find_table_lock()
Florian Westphal <fw@strlen.de>
netfilter: ebtables: module names must be null-terminated
Pratham Gupta <pratham36gupta@gmail.com>
netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
Qi Zheng <zhengqi.arch@bytedance.com>
mm: shrinker: fix NULL pointer dereference in debugfs
Andrei Kuchynski <akuchynski@chromium.org>
mfd: cros_ec: Delay dev_set_drvdata() until probe success
Wyatt Feng <bronzed_45_vested@icloud.com>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Yuyang Huang <yuyanghuang@google.com>
ipv4: igmp: remove multicast group from hash table on device destruction
Runyu Xiao <runyu.xiao@seu.edu.cn>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
Runyu Xiao <runyu.xiao@seu.edu.cn>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path
Koichiro Den <den@valinux.co.jp>
NTB: epf: Avoid calling pci_irq_vector() from hardirq context
Yunpeng Tian <shionthanatos@gmail.com>
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
Thomas Gleixner <tglx@kernel.org>
debugobjects: Plug race against a concurrent OOM disable
Samuel Page <sam@bynar.io>
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Chi Wang <wangchi@kylinos.cn>
audit: Fix data races of skb_queue_len() readers on audit_queue
Zijing Yin <yzjaurora@gmail.com>
net: af_key: initialize alg_key_len for IPComp states
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
Dawei Feng <dawei.feng@seu.edu.cn>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB write in HT_caps_handler()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
Arnd Bergmann <arnd@arndb.de>
staging: media: atomisp: reduce load_primary_binaries() stack usage
Ricardo Ribalda <ribalda@chromium.org>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: vme_user: fix location monitor leak in tsi148 bridge
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: vme_user: fix location monitor leak in fake bridge
Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
smb: client: restrict implied bcc[0] exemption to responses without data area
Michael Tautschnig <tautschn@amazon.com>
staging: vme_user: bound slave read/write to the kern_buf size
Samuel Page <sam@bynar.io>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
6lowpan: fix NHC entry use-after-free on error path
Runyu Xiao <runyu.xiao@seu.edu.cn>
usb: dwc3: run gadget disconnect from sleepable suspend context
Alan Stern <stern@rowland.harvard.edu>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
Michael Bommarito <michael.bommarito@gmail.com>
hwrng: virtio: clamp device-reported used.len at copy_data()
Johan Hovold <johan@kernel.org>
virtio-mmio: fix device release warning on module unload
Xiang Mei <xmei5@asu.edu>
netfilter: ipset: fix race between dump and ip_set_list resize
SeongJae Park <sj@kernel.org>
mm/damon/ops-common: handle extreme intervals in damon_hot_score()
Ratheesh Kannoth <rkannoth@marvell.com>
PCI: host-common: Request bus reassignment when not probe-only
Mahesh Vaidya <mahesh.vaidya@altera.com>
PCI: altera: Do not dispose parent IRQ mapping
Myeonghun Pak <mhun512@gmail.com>
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
胡连勤 <hulianqin@vivo.com>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
Carlos Llamas <cmllamas@google.com>
binder: fix UAF in binder_free_transaction()
Carlos Llamas <cmllamas@google.com>
binder: fix UAF in binder_thread_release()
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix wakeup source leak on probe failure
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix use-after-free on marvell probe failure
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix use-after-free on registration failure
Zenm Chen <zenmchen@gmail.com>
Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
Junrui Luo <moonafterrain@outlook.com>
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
Alex Williamson <alex.williamson@nvidia.com>
vfio/pci: Fix racy bitfields and tighten struct layout
Alex Williamson <alex.williamson@nvidia.com>
vfio/pci: Release the VGA arbiter client on register_device() failure
Alex Williamson <alex.williamson@nvidia.com>
vfio/pci: Latch disable_idle_d3 per device
Raghavendra Rao Ananta <rananta@google.com>
vfio/pci: Use a private flag to prevent power state change with VFs
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Roll back quirk control caches on write errors
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
Darvell Long <contact@darvell.me>
ALSA: usb-audio: avoid kobject path lookup in DualSense match
HyeongJun An <sammiee5311@gmail.com>
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: ice1712: check snd_ctl_new1() return value
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: gus: check snd_ctl_new1() return value
Maoyi Xie <maoyixie.tju@gmail.com>
ALSA: firewire: isight: bound the sample count to the packet payload
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: es1938: check snd_ctl_new1() return value
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: cmipci: check snd_ctl_new1() return value
Maoyi Xie <maoyixie.tju@gmail.com>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: ymfpci: check snd_ctl_new1() return value
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: virtio: Add missing 384 kHz PCM rate mapping
Liviu Stan <liviu.stan@analog.com>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
Javier Carrasco <javier.carrasco.cruz@gmail.com>
iio: light: veml6030: fix channel type when pushing events
Stepan Ionichev <sozdayvek@gmail.com>
iio: light: tsl2591: return actual error from probe IRQ failure
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: opt3001: fix missing state reset on timeout
Biren Pandya <birenpandya@gmail.com>
iio: light: gp2ap002: fix runtime PM leak on read error
Vidhu Sarwal <vidhu.linux@gmail.com>
iio: light: al3010: fix incorrect scale for the highest gain range
Andreas Kempe <andreas.kempe@actia.se>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
Runyu Xiao <runyu.xiao@seu.edu.cn>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
Stepan Ionichev <sozdayvek@gmail.com>
iio: gyro: bmg160: wait full startup time after mode change at probe
Stepan Ionichev <sozdayvek@gmail.com>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Lars-Peter Clausen <lars@metafoo.de>
iio: event: Fix event FIFO reset race
Maxwell Doose <m32285159@gmail.com>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Pengpeng Hou <pengpeng@iscas.ac.cn>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
Maxwell Doose <m32285159@gmail.com>
iio: adc: spear: Initialize completion before requesting IRQ
Maxwell Doose <m32285159@gmail.com>
iio: adc: lpc32xx: Initialize completion before requesting IRQ
Biren Pandya <birenpandya@gmail.com>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
Bryam Vargas <hexlabsecurity@proton.me>
iio: accel: bmc150: clamp the device-reported FIFO frame count
Griffin Kroah-Hartman <griffin@kroah.com>
usb: gadget: function: rndis: add length check for header
Griffin Kroah-Hartman <griffin@kroah.com>
usb: gadget: function: rndis: add length check to response query
Jonas Jelonek <jelonek.jonas@gmail.com>
MIPS: smp: report dying CPU to RCU in stop_this_cpu()
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
net: Drop the lock in skb_may_tx_timestamp()
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Add PIO for early access before ACPI PCI root register
Philo Lu <lulie@linux.alibaba.com>
virtio_net: Support dynamic rss indirection table size
Fuad Tabba <tabba@google.com>
arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
Marc Zyngier <maz@kernel.org>
arm64: Revamp HCR_EL2.E2H RES1 detection
Ahmed Genidi <ahmed.genidi@arm.com>
KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
Mark Rutland <mark.rutland@arm.com>
KVM: arm64: Initialize HCR_EL2.E2H early
Marc Zyngier <maz@kernel.org>
arm64: Fix early handling of FEAT_E2H0 not being implemented
Marc Zyngier <maz@kernel.org>
arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative
Marc Zyngier <maz@kernel.org>
arm64: sysreg: Add layout for ID_AA64MMFR4_EL1
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - rename first/last to first_desc/last_desc
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - fix SEC1 32k ahash request limitation
Eric Biggers <ebiggers@google.com>
crypto: talitos - stop using crypto_ahash::init
Goetz Goerisch <ggoerisch@gmail.com>
Revert "crypto: talitos - fix SEC1 32k ahash request limitation"
Goetz Goerisch <ggoerisch@gmail.com>
Revert "crypto: talitos - rename first/last to first_desc/last_desc"
Taeyang Lee <0wn@theori.io>
perf/core: Detach event groups during remove_on_exec
Alice Ryhl <aliceryhl@google.com>
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: NFIT: core: Fix possible NULL pointer dereference
Jeremy Linton <jeremy.linton@arm.com>
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
Florian Fainelli <florian.fainelli@broadcom.com>
perf trace beauty fcntl: Fix build with older kernel headers
Claudia Draghicescu <claudia.rosu@nxp.com>
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
Darrick J. Wong <djwong@kernel.org>
xfs: move ->iop_recover to xfs_defer_op_type
Darrick J. Wong <djwong@kernel.org>
xfs: use xfs_defer_finish_one to finish recovered work items
Darrick J. Wong <djwong@kernel.org>
xfs: dump the recovered xattri log item if corruption happens
Darrick J. Wong <djwong@kernel.org>
xfs: recreate work items when recovering intent items
Jiayuan Chen <jiayuan.chen@shopee.com>
mm/vmscan: flush deferred TLB before freeing large folios
Jiayuan Chen <jiayuan.chen@shopee.com>
team: fix header_ops type confusion with non-Ethernet ports
Eric Dumazet <edumazet@google.com>
bonding: prevent potential infinite loop in bond_header_parse()
Jiayuan Chen <jiayuan.chen@shopee.com>
bonding: fix type confusion in bond_setup_by_slave()
Hangbin Liu <liuhangbin@gmail.com>
bonding: fix xfrm offload feature setup on active-backup mode
Hangbin Liu <liuhangbin@gmail.com>
bonding: use common function to compute the features
Hangbin Liu <liuhangbin@gmail.com>
net: add a common function to compute features for upper devices
Cosmin Ratiu <cratiu@nvidia.com>
bonding: Correctly support GSO ESP offload
Jianbo Liu <jianbol@nvidia.com>
bonding: add ESP offload features when slaves support
Daniel Borkmann <daniel@iogearbox.net>
bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
Daniel Borkmann <daniel@iogearbox.net>
net, team, bonding: Add netdev_base_features helper
Hangbin Liu <liuhangbin@gmail.com>
net: team: rename team to team_core for linking
NeilBrown <neil@brown.name>
nfsd: change nfs4_client_to_reclaim() to allocate data
NeilBrown <neilb@ownmail.net>
nfsd: move name lookup out of nfsd4_list_rec_dir()
John Johansen <john.johansen@canonical.com>
apparmor: advertise the tcp fast open fix is applied
Trond Myklebust <trond.myklebust@hammerspace.com>
nfsd: Don't reset the write verifier on a commit EAGAIN
Michael Bommarito <michael.bommarito@gmail.com>
NFSv4/flexfiles: reject zero filehandle version count
Mingyu Wang <25181214217@stu.xidian.edu.cn>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
Johan Hovold <johan@kernel.org>
i2c: core: fix adapter registration race
Johan Hovold <johan@kernel.org>
i2c: core: fix adapter debugfs creation
Johan Hovold <johan@kernel.org>
i2c: core: fix NULL-deref on adapter registration failure
Johan Hovold <johan@kernel.org>
i2c: core: fix hang on adapter registration failure
Johan Hovold <johan@kernel.org>
i2c: core: fix irq domain leak on adapter registration failure
Denis Arefev <arefev@swemel.ru>
block: Avoid mounting the bdev pseudo-filesystem in userspace
Sean Christopherson <seanjc@google.com>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
Keshav Verma <iganschel@gmail.com>
f2fs: fix listxattr handling of corrupted xattr entries
Chao Yu <chao@kernel.org>
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
Ruipeng Qi <ruipengqi3@gmail.com>
f2fs: fix potential deadlock in f2fs_balance_fs()
Bryam Vargas <hexlabsecurity@proton.me>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Chao Yu <chao@kernel.org>
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
Wenjie Qi <qwjhust@gmail.com>
f2fs: validate orphan inode entry count
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
device property: initialize the remaining fields of fwnode_handle in fwnode_init()
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
Tiezhu Yang <yangtiezhu@loongson.cn>
drm/amd: Fix set but not used warnings
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
slimbus: Convert to platform remove callback returning void
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: Fix probe error path ordering
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtk: Fix btmtk.c undefined reference build error
Wentao Guan <guanwentao@uniontech.com>
perf: Fix dangling cgroup pointer in cpuctx backport
Kiryl Shutsemau <kas@kernel.org>
userfaultfd: gate must_wait writability check on pte_present()
Jiande Lu <jiande.lu@mediatek.com>
Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btusb: mediatek: return error for failed reg access
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btusb: mediatek: remove the unnecessary goto tag
Hao Qin <hao.qin@mediatek.com>
Bluetooth: btusb: mediatek: add MT7922 subsystem reset
Hao Qin <hao.qin@mediatek.com>
Bluetooth: btusb: mediatek: reset the controller before downloading the fw
Sean Wang <sean.wang@mediatek.com>
Bluetooth: btmtk: apply the common btmtk_fw_get_filename
Huacai Chen <chenhuacai@kernel.org>
LoongArch: Report dying CPU to RCU in stop_this_cpu()
Baokun Li <libaokun1@huawei.com>
ext4: get rid of ppath in get_ext_path()
Jeff Layton <jlayton@kernel.org>
nfsd: reset write verifier on deferred writeback errors
Chris Mason <clm@meta.com>
nfsd: release layout stid on setlease failure
Daniel Borkmann <daniel@iogearbox.net>
bpf, arm64: Reject out-of-range B.cond targets
-------------
Diffstat:
Documentation/admin-guide/pm/cpufreq.rst | 6 +-
Documentation/crypto/userspace-if.rst | 31 +-
.../media/allwinner,sun4i-a10-video-engine.yaml | 10 +
.../devicetree/bindings/net/renesas,ether.yaml | 3 +-
.../pinctrl/nvidia,tegra234-pinmux-aon.yaml | 4 +
.../bindings/pinctrl/nvidia,tegra234-pinmux.yaml | 4 +
.../bindings/regulator/mt6359-regulator.yaml | 43 --
Documentation/driver-api/nvdimm/btt.rst | 5 +-
Documentation/driver-api/pci/pci.rst | 3 +
Documentation/filesystems/proc.rst | 14 +-
Documentation/netlink/specs/handshake.yaml | 1 +
Makefile | 7 +-
arch/alpha/kernel/pci-sysfs.c | 13 +-
arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 4 +-
arch/arm/configs/sunxi_defconfig | 1 -
arch/arm/mach-imx/cpu-imx31.c | 9 +-
arch/arm/mach-imx/mm-imx3.c | 2 +
.../dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 3 +
arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi | 4 +-
arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 2 +-
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 +-
.../qcom/sdm845-db845c-navigation-mezzanine.dtso | 5 +
arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 +-
arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +-
arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts | 6 +-
arch/arm64/include/asm/el2_setup.h | 56 +-
arch/arm64/include/asm/kvm_hyp.h | 1 +
arch/arm64/include/asm/pgtable.h | 14 +-
arch/arm64/kernel/efi.c | 2 +-
arch/arm64/kernel/entry-fpsimd.S | 16 +-
arch/arm64/kernel/head.S | 20 +-
arch/arm64/kernel/hw_breakpoint.c | 9 +
arch/arm64/kernel/mte.c | 2 +-
arch/arm64/kvm/arm.c | 2 +
arch/arm64/kvm/guest.c | 2 +-
arch/arm64/kvm/hyp/nvhe/hyp-init.S | 3 +-
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 12 +
arch/arm64/kvm/hyp/nvhe/psci-relay.c | 3 +
arch/arm64/kvm/vgic/vgic-its.c | 2 +
arch/arm64/kvm/vgic/vgic.c | 11 +-
arch/arm64/lib/insn.c | 2 +
arch/arm64/mm/fault.c | 6 +-
arch/arm64/mm/hugetlbpage.c | 18 +-
arch/arm64/mm/kasan_init.c | 2 +-
arch/arm64/mm/mmu.c | 23 +-
arch/arm64/mm/pageattr.c | 4 +-
arch/arm64/mm/trans_pgd.c | 2 +-
arch/arm64/tools/sysreg | 39 +-
arch/loongarch/include/asm/acpi.h | 2 +
arch/loongarch/include/asm/pgtable.h | 4 +
arch/loongarch/kernel/acpi.c | 28 +
arch/loongarch/kernel/setup.c | 2 +
arch/loongarch/kernel/smp.c | 1 +
arch/loongarch/pci/acpi.c | 2 +
arch/mips/dec/int-handler.S | 2 +-
arch/mips/dec/platform.c | 6 +-
arch/mips/dec/prom/init.c | 6 +-
arch/mips/dec/setup.c | 6 -
arch/mips/fw/lib/call_o32.S | 2 +-
arch/mips/include/asm/dec/prom.h | 15 +-
arch/mips/kernel/mips-mt-fpaff.c | 28 +-
arch/mips/kernel/smp.c | 2 +
arch/mips/mm/init.c | 12 +-
arch/mips/n64/init.c | 2 +-
arch/mips/ralink/mt7621.c | 2 +-
arch/mips/sgi-ip22/ip22-gio.c | 7 +-
arch/powerpc/kexec/core_64.c | 4 +-
arch/powerpc/perf/core-fsl-emb.c | 3 +-
arch/powerpc/platforms/cell/spufs/file.c | 6 +-
arch/powerpc/platforms/powernv/setup.c | 3 +-
.../platforms/pseries/papr_platform_attributes.c | 8 +-
arch/riscv/kernel/cacheinfo.c | 2 +-
arch/riscv/kernel/machine_kexec.c | 3 +
arch/riscv/kernel/probes/rethook_trampoline.S | 3 +
arch/riscv/kernel/stacktrace.c | 2 +-
arch/riscv/net/bpf_jit_core.c | 3 +-
arch/s390/kernel/perf_cpum_cf.c | 3 +
arch/s390/kernel/process.c | 2 +-
arch/s390/kvm/pci.c | 12 +-
arch/sparc/kernel/led.c | 2 +-
arch/x86/boot/compressed/acpi.c | 7 +-
arch/x86/boot/early_serial_console.c | 11 +-
arch/x86/events/amd/brs.c | 10 +-
arch/x86/events/amd/core.c | 6 +-
arch/x86/events/amd/lbr.c | 3 +-
arch/x86/events/intel/uncore_snb.c | 7 -
arch/x86/include/asm/nospec-branch.h | 4 +
arch/x86/kernel/cpu/bugs.c | 50 +-
arch/x86/kvm/lapic.c | 8 +-
arch/x86/kvm/vmx/vmx.c | 38 +-
arch/x86/mm/numa_emulation.c | 17 +-
arch/x86/mm/tlb.c | 16 +-
arch/x86/net/bpf_jit_comp.c | 3 +-
arch/x86/platform/olpc/olpc-xo15-sci.c | 1 +
block/bdev.c | 11 +-
block/partitions/aix.c | 9 +
crypto/af_alg.c | 69 +--
crypto/algif_aead.c | 8 +-
crypto/algif_skcipher.c | 49 +-
crypto/asymmetric_keys/verify_pefile.c | 2 +
crypto/asymmetric_keys/x509_loader.c | 2 +-
crypto/drbg.c | 4 +-
crypto/ecc.c | 31 +-
crypto/ecrdsa.c | 2 +-
crypto/pcrypt.c | 4 +
crypto/rng.c | 11 +
drivers/acpi/acpi_ipmi.c | 4 +-
drivers/acpi/acpi_tad.c | 6 +-
drivers/acpi/bus.c | 70 +++
drivers/acpi/cppc_acpi.c | 11 +-
drivers/acpi/nfit/core.c | 89 +++-
drivers/acpi/pfr_telemetry.c | 6 +-
drivers/acpi/pfr_update.c | 6 +-
drivers/acpi/resource.c | 6 +-
drivers/acpi/thermal.c | 2 +-
drivers/android/binder.c | 19 +-
drivers/ata/libata-core.c | 19 +-
drivers/ata/pata_pxa.c | 1 +
drivers/ata/sata_gemini.c | 2 +-
drivers/base/dd.c | 7 +-
drivers/base/firmware_loader/main.c | 3 +-
drivers/base/firmware_loader/sysfs_upload.c | 8 +-
drivers/base/power/main.c | 6 +-
drivers/base/property.c | 4 +-
drivers/block/drbd/drbd_receiver.c | 5 +
drivers/bluetooth/Kconfig | 2 +
drivers/bluetooth/bpa10x.c | 8 +-
drivers/bluetooth/btmtk.c | 470 ++++++++++++++++-
drivers/bluetooth/btmtk.h | 23 +-
drivers/bluetooth/btmtksdio.c | 5 +-
drivers/bluetooth/btnxpuart.c | 6 +
drivers/bluetooth/btrtl.c | 5 +-
drivers/bluetooth/btusb.c | 418 ++-------------
drivers/bluetooth/hci_qca.c | 2 +-
drivers/bluetooth/hci_vhci.c | 10 +
drivers/bus/imx-weim.c | 6 -
drivers/bus/mhi/ep/main.c | 9 +-
drivers/bus/sunxi-rsb.c | 3 +
drivers/char/hw_random/jh7110-trng.c | 13 +-
drivers/char/hw_random/virtio-rng.c | 23 +-
drivers/char/tlclk.c | 4 +
drivers/char/tpm/eventlog/tpm1.c | 4 +-
drivers/char/tpm/tpm-dev.c | 2 +-
drivers/char/tpm/tpm_tis_core.c | 35 +-
drivers/char/tpm/tpmrm-dev.c | 2 +-
drivers/clk/at91/pmc.c | 2 +-
drivers/clk/clk-scmi.c | 4 +-
drivers/clk/clk-scpi.c | 2 +-
drivers/clk/qcom/a53-pll.c | 2 +-
drivers/clocksource/timer-sun5i.c | 3 +
drivers/clocksource/timer-tegra186.c | 3 +-
drivers/cpufreq/acpi-cpufreq.c | 4 +-
drivers/cpufreq/amd-pstate.c | 7 +-
drivers/cpufreq/apple-soc-cpufreq.c | 4 +-
drivers/cpufreq/bmips-cpufreq.c | 4 +-
drivers/cpufreq/cppc_cpufreq.c | 3 +-
drivers/cpufreq/cpufreq-dt.c | 3 +-
drivers/cpufreq/cpufreq.c | 2 +
drivers/cpufreq/cpufreq_conservative.c | 12 +-
drivers/cpufreq/e_powersaver.c | 3 +-
drivers/cpufreq/intel_pstate.c | 14 +-
drivers/cpufreq/mediatek-cpufreq-hw.c | 4 +-
drivers/cpufreq/mediatek-cpufreq.c | 4 +-
drivers/cpufreq/omap-cpufreq.c | 3 +-
drivers/cpufreq/pasemi-cpufreq.c | 6 +-
drivers/cpufreq/pcc-cpufreq.c | 8 +-
drivers/cpufreq/powernow-k6.c | 5 +-
drivers/cpufreq/powernow-k7.c | 3 +-
drivers/cpufreq/powernow-k8.c | 6 +-
drivers/cpufreq/powernv-cpufreq.c | 4 +-
drivers/cpufreq/ppc_cbe_cpufreq.c | 3 +-
drivers/cpufreq/qcom-cpufreq-hw.c | 5 +-
drivers/cpufreq/qoriq-cpufreq.c | 4 +-
drivers/cpufreq/scmi-cpufreq.c | 4 +-
drivers/cpufreq/scpi-cpufreq.c | 4 +-
drivers/cpufreq/sh-cpufreq.c | 4 +-
drivers/cpufreq/sparc-us2e-cpufreq.c | 3 +-
drivers/cpufreq/sparc-us3-cpufreq.c | 3 +-
drivers/cpufreq/speedstep-centrino.c | 10 +-
drivers/cpufreq/tegra194-cpufreq.c | 4 +-
drivers/cpufreq/vexpress-spc-cpufreq.c | 5 +-
drivers/crypto/allwinner/Kconfig | 8 -
drivers/crypto/allwinner/sun4i-ss/Makefile | 1 -
drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c | 36 --
drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c | 69 ---
drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h | 20 -
drivers/crypto/amcc/crypto4xx_alg.c | 106 ----
drivers/crypto/amcc/crypto4xx_core.c | 130 +----
drivers/crypto/amcc/crypto4xx_core.h | 11 -
drivers/crypto/amcc/crypto4xx_reg_def.h | 11 -
drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +-
drivers/crypto/atmel-ecc.c | 2 +-
drivers/crypto/atmel-sha204a.c | 29 +-
drivers/crypto/caam/caamalg.c | 12 +-
drivers/crypto/caam/caamalg_qi.c | 12 +-
drivers/crypto/caam/caamalg_qi2.c | 12 +-
drivers/crypto/caam/caamhash.c | 4 +-
drivers/crypto/caam/key_gen.c | 4 +-
drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 4 +-
drivers/crypto/ccp/sev-dev.c | 3 +-
drivers/crypto/hisilicon/Kconfig | 1 -
drivers/crypto/hisilicon/qm.c | 4 +-
drivers/crypto/hisilicon/trng/trng.c | 298 +----------
.../intel/qat/qat_common/adf_accel_devices.h | 2 +
drivers/crypto/intel/qat/qat_common/adf_aer.c | 7 +-
.../crypto/intel/qat/qat_common/adf_common_drv.h | 2 +
drivers/crypto/intel/qat/qat_common/adf_isr.c | 39 ++
drivers/crypto/intel/qat/qat_common/adf_sriov.c | 20 +-
.../crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +-
drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c | 4 +-
drivers/crypto/talitos.c | 576 +++++++++++----------
drivers/crypto/talitos.h | 12 +
drivers/dax/kmem.c | 6 +
drivers/dma-buf/udmabuf.c | 5 +-
drivers/dma/dmaengine.c | 3 +-
drivers/dma/dw-edma/dw-edma-core.h | 2 +-
drivers/dma/dw-edma/dw-edma-v0-core.c | 6 +
drivers/dma/imx-sdma.c | 4 +-
drivers/dma/qcom/gpi.c | 1 +
drivers/dma/tegra186-gpc-dma.c | 7 +
drivers/edac/i10nm_base.c | 14 +-
drivers/edac/skx_common.c | 3 +
drivers/firewire/net.c | 5 +-
drivers/firmware/arm_scmi/power.c | 6 +-
drivers/firmware/arm_scmi/sensors.c | 2 +-
drivers/fpga/dfl.c | 2 +
drivers/fpga/microchip-spi.c | 3 +
drivers/gpio/gpio-eic-sprd.c | 8 +-
drivers/gpio/gpio-f7188x.c | 6 +-
drivers/gpio/gpio-htc-egpio.c | 6 +-
drivers/gpio/gpio-mlxbf3.c | 3 +-
drivers/gpio/gpio-mvebu.c | 5 +-
drivers/gpio/gpio-palmas.c | 19 +
drivers/gpio/gpio-sch.c | 32 +-
drivers/gpio/gpio-timberdale.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 16 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 25 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 -
drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 3 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 3 +-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 5 +
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 1 +
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 11 +-
.../amd/display/modules/info_packet/info_packet.c | 2 +
drivers/gpu/drm/drm_edid.c | 8 +
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 78 +--
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 11 +
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 22 -
drivers/gpu/drm/i915/gt/intel_region_lmem.c | 2 +-
drivers/gpu/drm/msm/dp/dp_display.c | 4 +-
drivers/gpu/drm/msm/dp/dp_reg.h | 4 +-
.../gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c | 3 +-
drivers/gpu/drm/radeon/radeon_gem.c | 13 +-
drivers/gpu/drm/radeon/radeon_ring.c | 4 +-
drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 2 +-
drivers/gpu/drm/tegra/dc.c | 4 +-
drivers/gpu/drm/tegra/gem.c | 22 +-
drivers/gpu/drm/tegra/gr2d.c | 19 +-
drivers/gpu/drm/tegra/gr3d.c | 19 +-
drivers/gpu/drm/tegra/submit.c | 3 +-
drivers/gpu/drm/tidss/tidss_kms.c | 2 -
drivers/gpu/host1x/bus.c | 62 ++-
drivers/gpu/host1x/job.c | 10 +-
drivers/hid/hid-appleir.c | 45 +-
drivers/hid/hid-core.c | 7 +
drivers/hid/hid-letsketch.c | 36 +-
drivers/hid/hid-lg-g15.c | 16 +
drivers/hid/hid-logitech-hidpp.c | 1 -
drivers/hid/hid-multitouch.c | 32 +-
drivers/hid/hid-picolcd_core.c | 3 +-
drivers/hid/hid-playstation.c | 12 +
drivers/hid/hid-sensor-hub.c | 77 ++-
drivers/hid/hid-wiimote-modules.c | 58 +--
drivers/hid/wacom_sys.c | 12 +-
drivers/hwmon/Kconfig | 1 +
drivers/hwmon/asus_atk0110.c | 3 +
drivers/hwmon/it87.c | 3 +
drivers/hwmon/occ/common.c | 34 +-
drivers/hwmon/occ/common.h | 1 +
drivers/hwmon/pmbus/adm1275.c | 2 +-
drivers/hwmon/pmbus/pmbus_core.c | 13 +-
drivers/hwmon/w83627hf.c | 4 +
drivers/hwmon/w83793.c | 1 +
drivers/hwspinlock/qcom_hwspinlock.c | 5 +-
.../hwtracing/coresight/coresight-cti-platform.c | 1 +
drivers/hwtracing/coresight/coresight-etb10.c | 6 +-
drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 +-
drivers/hwtracing/coresight/ultrasoc-smb.c | 1 +
drivers/i2c/busses/i2c-mlxbf.c | 4 +-
drivers/i2c/busses/i2c-mpc.c | 2 +-
drivers/i2c/busses/i2c-mt65xx.c | 2 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/i2c-core-base.c | 85 +--
drivers/i2c/i2c-core-of.c | 5 -
drivers/i3c/master.c | 19 +-
drivers/iio/accel/bmc150-accel-core.c | 2 +
drivers/iio/accel/kxsd9.c | 5 +-
drivers/iio/accel/mma8452.c | 2 +
drivers/iio/adc/lpc32xx_adc.c | 4 +-
drivers/iio/adc/spear_adc.c | 3 +-
drivers/iio/adc/ti-ads124s08.c | 3 +-
drivers/iio/adc/xilinx-ams.c | 5 +
drivers/iio/chemical/scd30_core.c | 19 +-
.../iio/common/inv_sensors/inv_sensors_timestamp.c | 26 +-
drivers/iio/common/st_sensors/st_sensors_core.c | 23 +-
drivers/iio/gyro/bmg160_core.c | 16 +-
drivers/iio/imu/adis_trigger.c | 2 +-
drivers/iio/imu/bmi160/bmi160_core.c | 3 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 44 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 3 +
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 1 +
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +-
drivers/iio/industrialio-event.c | 5 +-
drivers/iio/light/al3010.c | 2 +-
drivers/iio/light/gp2ap002.c | 2 +-
drivers/iio/light/opt3001.c | 6 +-
drivers/iio/light/si1133.c | 14 +-
drivers/iio/light/tcs3472.c | 38 +-
drivers/iio/light/tsl2591.c | 6 +-
drivers/iio/light/veml6030.c | 8 +-
drivers/iio/magnetometer/ak8975.c | 15 +
drivers/iio/orientation/hid-sensor-rotation.c | 40 +-
drivers/iio/pressure/mpl115.c | 8 +-
drivers/iio/temperature/ltc2983.c | 5 +-
drivers/infiniband/core/cm.c | 13 +-
drivers/infiniband/core/counters.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_hem.c | 8 +-
drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
drivers/infiniband/hw/irdma/verbs.c | 19 +-
drivers/infiniband/hw/irdma/verbs.h | 1 -
drivers/infiniband/hw/mlx4/mlx4_ib.h | 1 +
drivers/infiniband/hw/mlx4/mr.c | 9 +-
drivers/infiniband/hw/mlx4/sysfs.c | 45 +-
drivers/infiniband/hw/mlx5/devx.c | 30 +-
drivers/infiniband/hw/mlx5/main.c | 17 +-
drivers/infiniband/hw/mlx5/mr.c | 17 +-
drivers/infiniband/hw/mlx5/qp.c | 12 +-
drivers/infiniband/sw/rxe/rxe_mmap.c | 19 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 33 +-
drivers/infiniband/sw/siw/siw_qp_rx.c | 9 +
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +-
drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +-
drivers/input/joystick/iforce/iforce-packets.c | 18 +-
drivers/input/joystick/maplecontrol.c | 3 +-
drivers/input/keyboard/maple_keyb.c | 4 +-
drivers/input/misc/ims-pcu.c | 117 ++++-
drivers/input/mouse/elan_i2c_core.c | 36 +-
drivers/input/mouse/maplemouse.c | 9 +-
drivers/input/rmi4/rmi_bus.c | 4 +-
drivers/input/rmi4/rmi_f30.c | 2 +-
drivers/input/rmi4/rmi_f3a.c | 2 +-
drivers/input/touchscreen/goodix.c | 3 +-
drivers/input/touchscreen/mms114.c | 26 +-
drivers/input/touchscreen/touchwin.c | 15 +-
drivers/iommu/amd/amd_iommu_types.h | 11 +-
drivers/irqchip/irq-crossbar.c | 10 +-
drivers/irqchip/irq-gic-v3-its.c | 6 +-
drivers/irqchip/irq-ts4800.c | 10 +
drivers/leds/uleds.c | 3 +-
drivers/mailbox/mtk-adsp-mailbox.c | 9 +-
drivers/md/dm-bufio.c | 4 +-
drivers/md/dm-era-target.c | 10 +-
drivers/md/dm-integrity.c | 3 -
drivers/md/dm-ioctl.c | 9 +-
drivers/md/dm-log.c | 3 +
drivers/md/dm-stats.c | 10 +-
drivers/md/dm-thin-metadata.c | 67 +--
drivers/md/dm-verity-loadpin.c | 2 +-
drivers/md/dm-verity-target.c | 2 +-
drivers/md/raid1.c | 6 +
drivers/md/raid10.c | 1 +
.../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 +-
.../media/platform/nxp/imx8-isi/imx8-isi-core.c | 24 +-
drivers/media/platform/qcom/venus/helpers.c | 4 +-
.../media/platform/qcom/venus/hfi_platform_v4.c | 20 +-
.../media/platform/qcom/venus/hfi_platform_v6.c | 16 +-
drivers/media/platform/rockchip/rga/rga-hw.c | 2 +-
drivers/media/platform/rockchip/rga/rga-hw.h | 2 +-
drivers/media/usb/uvc/uvc_video.c | 122 +++--
drivers/media/v4l2-core/v4l2-common.c | 1 +
drivers/memstick/core/ms_block.c | 4 +
drivers/mfd/cros_ec_dev.c | 3 +-
drivers/mfd/cs42l43.c | 2 +-
drivers/mfd/sm501.c | 4 +-
drivers/mfd/tps6586x.c | 2 +-
drivers/mmc/host/vub300.c | 26 +-
drivers/mtd/devices/mchp23k256.c | 2 +-
drivers/mtd/devices/slram.c | 22 +-
drivers/mtd/maps/vmu-flash.c | 1 +
drivers/mtd/nand/onenand/onenand_samsung.c | 7 +-
drivers/mtd/nand/raw/fsl_ifc_nand.c | 9 +-
drivers/mtd/nand/raw/lpc32xx_mlc.c | 12 +-
drivers/mtd/nand/raw/lpc32xx_slc.c | 12 +-
drivers/mtd/nand/raw/nand_base.c | 2 +-
drivers/mtd/nand/raw/pl35x-nand-controller.c | 2 +-
drivers/mtd/spi-nor/Kconfig | 1 -
drivers/mtd/spi-nor/swp.c | 11 +-
drivers/net/amt.c | 6 +-
drivers/net/bonding/bond_3ad.c | 1 +
drivers/net/bonding/bond_main.c | 133 ++---
drivers/net/bonding/bond_netlink.c | 16 +-
drivers/net/can/usb/esd_usb.c | 5 +-
drivers/net/dsa/sja1105/sja1105_ptp.c | 2 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 23 +-
.../ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 -
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 2 +-
drivers/net/ethernet/freescale/enetc/enetc.c | 7 +
drivers/net/ethernet/freescale/fman/fman.c | 4 +-
drivers/net/ethernet/freescale/gianfar.c | 16 +-
drivers/net/ethernet/intel/i40e/i40e_debug.h | 2 +-
drivers/net/ethernet/intel/ice/ice_common.c | 1 -
drivers/net/ethernet/intel/ice/ice_ethtool.c | 12 +-
drivers/net/ethernet/intel/ice/ice_main.c | 16 +-
drivers/net/ethernet/intel/ice/ice_vf_lib.c | 2 +-
drivers/net/ethernet/marvell/mvneta.c | 3 +
drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 6 +-
.../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 3 +-
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 +-
.../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 10 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 44 +-
.../net/ethernet/marvell/prestera/prestera_main.c | 2 +-
drivers/net/ethernet/mediatek/mtk_ppe.c | 4 +-
.../ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c | 29 +-
.../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 47 +-
.../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c | 8 +-
.../net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h | 6 +-
.../net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 3 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 12 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
.../net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
.../ethernet/microchip/lan966x/lan966x_vcap_impl.c | 5 +-
.../ethernet/microchip/sparx5/sparx5_switchdev.c | 4 +-
.../ethernet/microchip/sparx5/sparx5_vcap_impl.c | 5 +-
drivers/net/ethernet/microchip/vcap/vcap_api.c | 72 +--
drivers/net/ethernet/microchip/vcap/vcap_api.h | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_debugfs.c | 8 +-
.../microchip/vcap/vcap_api_debugfs_kunit.c | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_kunit.c | 3 +-
.../net/ethernet/microchip/vcap/vcap_api_private.h | 3 +
drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +
drivers/net/ethernet/microsoft/mana/mana_en.c | 3 +-
.../net/ethernet/pensando/ionic/ionic_ethtool.c | 11 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 9 +-
.../net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h | 1 +
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 78 +--
drivers/net/ethernet/sun/sungem.c | 13 +-
drivers/net/ethernet/sunplus/spl2sw_phy.c | 6 +-
drivers/net/ieee802154/ca8210.c | 9 +-
drivers/net/macsec.c | 9 +-
drivers/net/phy/sfp.c | 1 +
drivers/net/team/Makefile | 1 +
drivers/net/team/{team.c => team_core.c} | 68 ++-
drivers/net/thunderbolt/main.c | 8 +-
drivers/net/usb/gl620a.c | 6 +-
drivers/net/usb/kalmia.c | 8 +
drivers/net/usb/lan78xx.c | 318 ++++++------
drivers/net/usb/net1080.c | 2 +-
drivers/net/veth.c | 2 +
drivers/net/virtio_net.c | 55 +-
drivers/net/vxlan/vxlan_core.c | 8 +-
drivers/net/wan/ixp4xx_hss.c | 4 +-
drivers/net/wireless/ath/ath9k/xmit.c | 5 +
drivers/net/wireless/ath/wcn36xx/smd.c | 13 +
drivers/net/wireless/cisco/airo.c | 4 +-
drivers/net/wireless/intersil/hostap/hostap_main.c | 1 +
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 5 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 +-
drivers/net/wireless/realtek/rtw88/pci.c | 5 +
drivers/net/wireless/realtek/rtw89/fw.c | 2 +-
drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +-
drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 3 +
drivers/net/wwan/t7xx/t7xx_port_wwan.c | 2 +
drivers/ntb/hw/epf/ntb_hw_epf.c | 89 ++--
drivers/nvdimm/btt.c | 14 +-
drivers/nvdimm/nd.h | 11 +-
drivers/nvdimm/region_devs.c | 66 +--
drivers/nvme/host/core.c | 2 +-
drivers/nvme/host/multipath.c | 6 +
drivers/nvme/target/auth.c | 20 +-
drivers/nvme/target/fabrics-cmd-auth.c | 60 ++-
drivers/nvme/target/fabrics-cmd.c | 15 +-
drivers/nvme/target/nvmet.h | 8 +-
drivers/nvme/target/rdma.c | 18 +-
drivers/nvme/target/tcp.c | 5 +-
drivers/of/cpu.c | 2 +-
drivers/of/dynamic.c | 1 -
drivers/of/platform.c | 5 -
drivers/opp/of.c | 3 +-
drivers/pci/Makefile | 2 +-
drivers/pci/controller/dwc/pci-imx6.c | 4 +-
drivers/pci/controller/dwc/pci-meson.c | 4 +-
drivers/pci/controller/dwc/pcie-designware-host.c | 2 +-
.../pci/controller/mobiveil/pcie-mobiveil-host.c | 8 +-
drivers/pci/controller/pci-host-common.c | 4 +
drivers/pci/controller/pci-loongson.c | 31 +-
drivers/pci/controller/pcie-altera-msi.c | 2 +-
drivers/pci/controller/pcie-altera.c | 32 +-
drivers/pci/controller/pcie-iproc-bcma.c | 2 +-
drivers/pci/controller/pcie-iproc-platform.c | 2 +-
drivers/pci/controller/pcie-iproc.c | 1 -
drivers/pci/controller/pcie-iproc.h | 2 -
drivers/pci/controller/pcie-mediatek-gen3.c | 4 +-
drivers/pci/controller/pcie-mediatek.c | 132 +++--
drivers/pci/controller/pcie-rcar-host.c | 1 -
drivers/pci/controller/pcie-xilinx-nwl.c | 2 +-
drivers/pci/endpoint/functions/pci-epf-ntb.c | 21 +-
drivers/pci/endpoint/functions/pci-epf-vntb.c | 9 +-
drivers/pci/msi/msi.c | 4 +-
drivers/pci/pci-sysfs.c | 14 +-
drivers/pci/pci.c | 139 -----
drivers/pci/pci.h | 4 +
drivers/pci/quirks.c | 51 +-
drivers/pci/rebar.c | 218 ++++++++
drivers/pci/rom.c | 149 +++++-
drivers/pci/setup-bus.c | 104 ++--
drivers/pci/setup-res.c | 53 --
drivers/phy/phy-can-transceiver.c | 3 +
drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 2 +-
drivers/pinctrl/mediatek/pinctrl-mt8167.c | 2 +-
drivers/pinctrl/mediatek/pinctrl-mt8516.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +-
drivers/platform/x86/amd/pmc/pmc-quirks.c | 39 ++
drivers/platform/x86/amd/pmc/pmc.c | 60 ++-
drivers/platform/x86/amd/pmc/pmc.h | 1 +
drivers/platform/x86/xo15-ebook.c | 7 +-
drivers/pmdomain/imx/imx8m-blk-ctrl.c | 46 +-
drivers/power/supply/charger-manager.c | 6 +-
drivers/power/supply/cpcap-battery.c | 11 +-
drivers/power/supply/power_supply_core.c | 11 +-
drivers/pwm/pwm-imx27.c | 8 +-
drivers/rapidio/devices/tsi721.c | 3 +-
drivers/regulator/core.c | 4 +-
drivers/regulator/ltc3676.c | 10 +-
drivers/regulator/scmi-regulator.c | 6 +-
drivers/remoteproc/qcom_common.c | 14 +-
drivers/reset/reset-imx7.c | 6 +
drivers/reset/reset-sunxi.c | 4 +-
drivers/rpmsg/qcom_glink_native.c | 2 -
drivers/rpmsg/rpmsg_core.c | 43 +-
drivers/rpmsg/virtio_rpmsg_bus.c | 1 -
drivers/rtc/rtc-abx80x.c | 3 +-
drivers/rtc/rtc-cmos.c | 6 +
drivers/rtc/rtc-ds1307.c | 30 +-
drivers/rtc/rtc-mpfs.c | 2 +-
drivers/rtc/rtc-msc313.c | 4 +-
drivers/s390/char/monwriter.c | 3 +
drivers/s390/crypto/zcrypt_cex2a.c | 0
drivers/s390/crypto/zcrypt_cex2a.h | 0
drivers/s390/crypto/zcrypt_cex2c.c | 0
drivers/s390/crypto/zcrypt_cex2c.h | 0
drivers/scsi/elx/efct/efct_hw.c | 2 +
drivers/scsi/elx/efct/efct_unsol.c | 1 +
drivers/scsi/hpsa.c | 4 +
drivers/scsi/lpfc/lpfc_init.c | 3 +-
drivers/scsi/pm8001/pm8001_ctl.c | 5 +-
drivers/scsi/scsi_scan.c | 2 +-
drivers/scsi/scsi_transport_sas.c | 101 ++--
drivers/scsi/sg.c | 7 +-
drivers/scsi/smartpqi/smartpqi_init.c | 2 +-
drivers/slimbus/qcom-ctrl.c | 5 +-
drivers/slimbus/qcom-ngd-ctrl.c | 62 +--
drivers/soc/fsl/qe/qe.c | 3 +
drivers/soc/ti/k3-ringacc.c | 4 +-
drivers/spi/spi-dw.h | 1 +
drivers/spi/spi-ep93xx.c | 1 +
drivers/spi/spi-fsl-lpspi.c | 18 +-
drivers/spi/spi-hisi-kunpeng.c | 6 +-
drivers/spi/spi-meson-spifc.c | 1 +
drivers/spi/spi-rpc-if.c | 6 +-
drivers/spi/spi-sh-msiof.c | 10 +-
drivers/spi/spi-uniphier.c | 4 +-
drivers/spi/spi-xilinx.c | 11 +-
drivers/spi/spi.c | 5 -
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 6 +-
drivers/staging/media/atomisp/pci/sh_css.c | 6 +-
drivers/staging/media/ipu3/ipu3-css-params.c | 8 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +-
drivers/staging/most/video/video.c | 7 +-
drivers/staging/nvec/nvec.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 93 ++--
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 20 +-
drivers/staging/rtl8723bs/core/rtw_security.c | 2 +-
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 23 +-
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 +
drivers/staging/vme_user/vme_fake.c | 8 +
drivers/staging/vme_user/vme_tsi148.c | 8 +
drivers/staging/vme_user/vme_user.c | 22 +
drivers/target/iscsi/iscsi_target_auth.c | 6 +-
drivers/target/loopback/tcm_loop.c | 64 ---
drivers/target/target_core_fabric_lib.c | 89 +++-
drivers/target/target_core_internal.h | 3 +-
drivers/target/target_core_pr.c | 12 +-
drivers/thermal/intel/therm_throt.c | 7 +-
drivers/thermal/thermal_hwmon.c | 5 +-
drivers/tty/serial/8250/8250_mid.c | 31 +-
drivers/tty/serial/8250/8250_omap.c | 3 +-
drivers/tty/serial/msm_serial.c | 3 +-
drivers/ufs/core/ufshcd.c | 2 +-
drivers/usb/atm/ueagle-atm.c | 36 +-
drivers/usb/cdns3/cdnsp-mem.c | 2 +
drivers/usb/class/cdc-acm.c | 3 +
drivers/usb/common/ulpi.c | 23 +-
drivers/usb/core/quirks.c | 6 +
drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +-
drivers/usb/dwc3/gadget.c | 43 +-
drivers/usb/fotg210/fotg210-hcd.c | 6 +-
drivers/usb/gadget/composite.c | 5 +-
drivers/usb/gadget/function/f_fs.c | 5 +-
drivers/usb/gadget/function/f_printer.c | 3 +-
drivers/usb/gadget/function/rndis.c | 20 +-
drivers/usb/gadget/udc/core.c | 29 +-
drivers/usb/host/ehci-sched.c | 11 +-
drivers/usb/host/max3421-hcd.c | 8 +
drivers/usb/host/sl811-hcd.c | 1 +
drivers/usb/host/xhci.c | 11 +-
drivers/usb/misc/chaoskey.c | 1 -
drivers/usb/misc/idmouse.c | 45 +-
drivers/usb/misc/iowarrior.c | 21 +-
drivers/usb/misc/ldusb.c | 38 +-
drivers/usb/misc/legousbtower.c | 37 +-
drivers/usb/misc/uss720.c | 5 +-
drivers/usb/mtu3/mtu3_gadget.c | 1 +
drivers/usb/serial/digi_acceleport.c | 43 +-
drivers/usb/serial/keyspan_pda.c | 2 +-
drivers/usb/serial/option.c | 16 +
drivers/usb/storage/ene_ub6250.c | 3 +-
drivers/usb/storage/usb.c | 2 +-
drivers/usb/typec/anx7411.c | 4 +-
drivers/usb/typec/class.c | 1 +
drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 +-
drivers/usb/typec/tcpm/tcpm.c | 7 +-
drivers/usb/typec/ucsi/displayport.c | 7 +-
drivers/usb/typec/ucsi/ucsi.c | 20 +
drivers/usb/typec/ucsi/ucsi.h | 1 +
drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +-
drivers/usb/usbip/vudc.h | 1 -
drivers/usb/usbip/vudc_dev.c | 4 +-
drivers/vdpa/vdpa_user/vduse_dev.c | 72 ++-
drivers/vfio/pci/mlx5/cmd.h | 13 +-
drivers/vfio/pci/vfio_pci_core.c | 37 +-
drivers/vfio/vfio_main.c | 3 +-
drivers/vhost/net.c | 15 +-
drivers/vhost/vdpa.c | 29 +-
drivers/video/fbdev/aty/radeon_base.c | 1 +
drivers/video/fbdev/broadsheetfb.c | 8 +-
drivers/video/fbdev/carminefb.c | 1 +
drivers/video/fbdev/core/fbcon.c | 14 +-
drivers/video/fbdev/hecubafb.c | 6 +-
drivers/video/fbdev/i740fb.c | 1 +
drivers/video/fbdev/metronomefb.c | 8 +-
drivers/video/fbdev/nvidia/nvidia.c | 1 +
drivers/video/fbdev/s3fb.c | 1 +
drivers/video/fbdev/sm501fb.c | 16 +-
drivers/video/fbdev/sm712.h | 2 +-
drivers/video/fbdev/tdfxfb.c | 1 +
drivers/video/fbdev/tridentfb.c | 1 +
drivers/video/fbdev/uvesafb.c | 4 +-
drivers/video/fbdev/vesafb.c | 1 +
drivers/virtio/virtio_mmio.c | 26 +-
drivers/watchdog/apple_wdt.c | 1 +
drivers/watchdog/sama5d4_wdt.c | 48 +-
drivers/watchdog/sp5100_tco.c | 3 +-
drivers/watchdog/sprd_wdt.c | 5 +-
drivers/watchdog/watchdog_core.c | 3 +
drivers/xen/gntdev.c | 8 +-
drivers/xen/xen-scsiback.c | 30 +-
fs/9p/vfs_inode.c | 9 +
fs/afs/cell.c | 2 +
fs/afs/cmservice.c | 2 -
fs/afs/fs_operation.c | 2 +-
fs/afs/rxrpc.c | 11 +-
fs/afs/super.c | 3 +-
fs/afs/vl_list.c | 10 +-
fs/afs/volume.c | 2 +-
fs/btrfs/btrfs_inode.h | 2 +
fs/btrfs/extent-tree.c | 17 +-
fs/btrfs/file.c | 12 +-
fs/btrfs/inode.c | 138 +++--
fs/btrfs/ordered-data.c | 12 +
fs/btrfs/ordered-data.h | 2 +
fs/btrfs/reflink.c | 5 +-
fs/btrfs/super.c | 3 +-
fs/configfs/dir.c | 57 +-
fs/dlm/midcomms.c | 4 +-
fs/efs/file.c | 21 +-
fs/exfat/dir.c | 61 ++-
fs/exfat/exfat_fs.h | 7 +-
fs/exfat/inode.c | 2 +-
fs/exfat/namei.c | 331 ++++++------
fs/ext2/file.c | 9 +-
fs/ext4/extents.c | 5 +-
fs/ext4/inode.c | 3 +-
fs/ext4/ioctl.c | 12 +-
fs/ext4/move_extent.c | 34 +-
fs/f2fs/checkpoint.c | 14 +-
fs/f2fs/data.c | 29 ++
fs/f2fs/f2fs.h | 1 +
fs/f2fs/gc.c | 50 +-
fs/f2fs/inode.c | 30 +-
fs/f2fs/segment.c | 8 +
fs/f2fs/xattr.c | 6 +-
fs/fs-writeback.c | 133 +++--
fs/fuse/cuse.c | 4 +-
fs/fuse/dev.c | 2 +-
fs/hfs/bfind.c | 2 +-
fs/hfs/bnode.c | 56 +-
fs/hfs/brec.c | 2 +-
fs/hfs/btree.c | 2 +-
fs/hfs/btree.h | 71 +--
fs/hfs/hfs_fs.h | 88 ++--
fs/hfs/inode.c | 3 +-
fs/hfsplus/bfind.c | 2 +-
fs/hfsplus/bnode.c | 62 +--
fs/hfsplus/brec.c | 2 +-
fs/hfsplus/btree.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 40 +-
fs/isofs/rock.c | 11 +
fs/jbd2/journal.c | 2 +
fs/lockd/svcsubs.c | 4 +-
fs/minix/minix.h | 2 +-
fs/namei.c | 4 +
fs/nfs/callback_proc.c | 9 +-
fs/nfs/dir.c | 2 +
fs/nfs/filelayout/filelayout.c | 2 +
fs/nfs/flexfilelayout/flexfilelayout.c | 33 ++
fs/nfs/flexfilelayout/flexfilelayout.h | 16 +
fs/nfs/pnfs.c | 4 +-
fs/nfs/read.c | 25 +-
fs/nfsd/nfs4layouts.c | 4 +-
fs/nfsd/nfs4recover.c | 120 ++---
fs/nfsd/nfs4state.c | 22 +-
fs/nfsd/vfs.c | 42 +-
fs/nilfs2/segment.c | 22 +
fs/nilfs2/super.c | 2 -
fs/ntfs3/attrib.c | 14 +
fs/ntfs3/dir.c | 2 +-
fs/ntfs3/file.c | 48 +-
fs/ntfs3/frecord.c | 51 ++
fs/ntfs3/fslog.c | 131 ++++-
fs/ntfs3/index.c | 45 +-
fs/ntfs3/inode.c | 8 +
fs/ntfs3/lznt.c | 2 +-
fs/ntfs3/namei.c | 2 +-
fs/ntfs3/ntfs_fs.h | 5 +-
fs/ntfs3/run.c | 9 +-
fs/ocfs2/alloc.c | 2 +-
fs/ocfs2/aops.c | 13 +-
fs/ocfs2/buffer_head_io.c | 7 +-
fs/ocfs2/dlm/dlmdebug.c | 16 +-
fs/ocfs2/dlmglue.c | 17 +
fs/ocfs2/inode.c | 150 +++++-
fs/ocfs2/journal.c | 13 +-
fs/ocfs2/journal.h | 3 +
fs/ocfs2/move_extents.c | 4 +-
fs/ocfs2/ocfs2.h | 2 -
fs/ocfs2/quota_local.c | 2 +-
fs/ocfs2/stack_user.c | 10 +-
fs/ocfs2/super.c | 2 -
fs/ocfs2/sysfile.c | 9 +-
fs/orangefs/dir.c | 7 +-
fs/proc/array.c | 15 +-
fs/proc/base.c | 184 +++----
fs/proc/fd.c | 31 +-
fs/proc/generic.c | 9 +-
fs/proc/internal.h | 6 +-
fs/proc/namespaces.c | 16 +-
fs/proc/proc_net.c | 2 +-
fs/smb/client/cifs_swn.c | 329 +++++++++---
fs/smb/client/cifsacl.c | 2 +-
fs/smb/client/cifsglob.h | 19 +-
fs/smb/client/connect.c | 3 +
fs/smb/client/inode.c | 30 +-
fs/smb/client/ioctl.c | 12 +-
fs/smb/client/misc.c | 8 +
fs/smb/client/smb2misc.c | 52 +-
fs/smb/client/smb2ops.c | 56 +-
fs/smb/client/smb2pdu.c | 22 +-
fs/smb/client/trace.h | 2 +
fs/smb/common/cifsglob.h | 30 ++
fs/smb/server/connection.c | 101 +++-
fs/smb/server/connection.h | 6 +
fs/smb/server/oplock.c | 13 +-
fs/smb/server/server.c | 12 +
fs/smb/server/smb2pdu.c | 146 ++++--
fs/smb/server/smb_common.h | 14 +-
fs/smb/server/smbacl.c | 7 +-
fs/smb/server/vfs.c | 29 +-
fs/smb/server/vfs_cache.c | 119 ++++-
fs/smb/server/vfs_cache.h | 3 +
fs/sysfs/file.c | 4 +
fs/udf/balloc.c | 5 +-
fs/udf/super.c | 11 +-
fs/userfaultfd.c | 14 +-
fs/xfs/libxfs/xfs_defer.c | 22 +-
fs/xfs/libxfs/xfs_defer.h | 14 +
fs/xfs/libxfs/xfs_log_recover.h | 4 +-
fs/xfs/xfs_attr_item.c | 115 ++--
fs/xfs/xfs_bmap_item.c | 92 ++--
fs/xfs/xfs_dquot.c | 16 +-
fs/xfs/xfs_extfree_item.c | 117 ++---
fs/xfs/xfs_log_recover.c | 52 +-
fs/xfs/xfs_refcount_item.c | 127 ++---
fs/xfs/xfs_reflink.c | 36 ++
fs/xfs/xfs_rmap_item.c | 151 +++---
fs/xfs/xfs_trans.h | 4 -
include/acpi/acpi_bus.h | 2 +
include/asm-generic/bitops/lock.h | 22 +-
include/crypto/drbg.h | 18 +-
include/dt-bindings/power/fsl,imx93-power.h | 1 +
include/linux/audit.h | 8 +
include/linux/backing-dev-defs.h | 4 +
include/linux/bitops.h | 2 +
include/linux/bpf.h | 3 +
include/linux/bpf_local_storage.h | 3 -
include/linux/cpufreq.h | 2 +-
include/linux/damon.h | 8 +-
include/linux/device.h | 5 +-
include/linux/etherdevice.h | 3 +-
include/linux/f2fs_fs.h | 1 +
include/linux/filter.h | 15 +-
include/linux/fs.h | 5 +
include/linux/fwnode.h | 2 +
include/linux/glob.h | 1 +
include/linux/hid-sensor-hub.h | 25 +
include/linux/hid.h | 29 ++
include/linux/host1x.h | 7 +
include/linux/if_ether.h | 3 +-
include/linux/iio/common/inv_sensors_timestamp.h | 3 +-
include/linux/inetdevice.h | 5 +
include/linux/jiffies.h | 13 +
include/linux/netdev_features.h | 25 +
include/linux/netdevice.h | 7 +-
include/linux/nfs_page.h | 1 +
include/linux/pci.h | 4 +-
include/linux/rpmsg.h | 4 -
include/linux/seqlock.h | 110 ++++
include/linux/sunrpc/clnt.h | 1 +
include/linux/sunrpc/xprt.h | 2 +
include/linux/vfio_pci_core.h | 15 +-
include/linux/vmalloc.h | 4 +-
include/linux/writeback.h | 2 +
include/net/addrconf.h | 10 +-
include/net/bluetooth/hci.h | 21 +-
include/net/bluetooth/hci_core.h | 39 +-
include/net/bluetooth/l2cap.h | 11 +-
include/net/bonding.h | 1 +
include/net/fib_rules.h | 5 +
include/net/gue.h | 2 +-
include/net/ip_fib.h | 7 +-
include/net/ip_vs.h | 3 +-
include/net/netfilter/nf_conntrack_extend.h | 12 -
include/net/netfilter/nf_queue.h | 1 +
include/net/rtnetlink.h | 2 +
include/net/sctp/sctp.h | 3 +-
include/net/sock.h | 2 +-
include/net/tc_act/tc_pedit.h | 18 +-
include/net/xfrm.h | 15 +-
include/uapi/linux/bpf.h | 1 +
io_uring/io-wq.c | 2 +-
kernel/audit.c | 85 ++-
kernel/bpf/bpf_lsm.c | 34 +-
kernel/bpf/cgroup.c | 110 ++--
kernel/bpf/core.c | 70 ++-
kernel/bpf/devmap.c | 19 +
kernel/bpf/dispatcher.c | 2 +-
kernel/bpf/hashtab.c | 21 +-
kernel/bpf/helpers.c | 12 +-
kernel/bpf/inode.c | 13 +-
kernel/bpf/lpm_trie.c | 10 +-
kernel/bpf/syscall.c | 5 +-
kernel/bpf/verifier.c | 3 +-
kernel/cgroup/cpuset.c | 7 +-
kernel/cpu.c | 20 +-
kernel/events/core.c | 19 +-
kernel/fork.c | 9 +-
kernel/module/decompress.c | 2 +
kernel/sched/core.c | 1 +
kernel/sched/fair.c | 25 +-
kernel/sched/features.h | 8 +
kernel/time/posix-cpu-timers.c | 3 +-
kernel/time/time.c | 2 +-
kernel/trace/bpf_trace.c | 11 +-
kernel/trace/ring_buffer.c | 3 +-
kernel/trace/trace_eprobe.c | 2 +-
kernel/trace/trace_events_filter.c | 6 +-
kernel/trace/trace_events_hist.c | 41 +-
kernel/trace/trace_osnoise.c | 4 +-
kernel/trace/trace_probe.c | 3 +-
kernel/trace/trace_probe.h | 2 +-
kernel/workqueue.c | 2 +-
lib/debugobjects.c | 17 +
lib/glob.c | 31 +-
lib/test_meminit.c | 2 +-
mm/backing-dev.c | 5 +
mm/damon/core.c | 2 +-
mm/damon/ops-common.c | 1 +
mm/damon/sysfs-schemes.c | 17 +-
mm/filemap.c | 2 +-
mm/madvise.c | 3 +-
mm/mincore.c | 3 +-
mm/mm_init.c | 13 +-
mm/shrinker_debug.c | 30 +-
mm/slab.h | 17 +-
mm/vmscan.c | 6 +-
net/6lowpan/nhc.c | 2 +-
net/9p/client.c | 2 +
net/9p/trans_rdma.c | 19 +-
net/atm/common.c | 2 +
net/batman-adv/distributed-arp-table.c | 30 +-
net/batman-adv/fragmentation.c | 8 +-
net/batman-adv/gateway_client.c | 3 +-
net/batman-adv/main.c | 13 +-
net/batman-adv/routing.c | 3 +-
net/batman-adv/soft-interface.c | 17 +-
net/batman-adv/soft-interface.h | 2 +
net/batman-adv/translation-table.c | 5 +-
net/bluetooth/6lowpan.c | 74 +--
net/bluetooth/af_bluetooth.c | 17 +-
net/bluetooth/bnep/core.c | 27 +-
net/bluetooth/hci_codec.c | 2 +-
net/bluetooth/hci_conn.c | 56 +-
net/bluetooth/hci_core.c | 83 ++-
net/bluetooth/hci_event.c | 29 +-
net/bluetooth/hci_sync.c | 197 +++++--
net/bluetooth/iso.c | 20 +-
net/bluetooth/l2cap_core.c | 159 ++++--
net/bluetooth/l2cap_sock.c | 107 ++--
net/bluetooth/mgmt.c | 8 +-
net/bluetooth/msft.c | 2 +-
net/bluetooth/rfcomm/tty.c | 4 +-
net/bluetooth/sco.c | 62 ++-
net/bluetooth/smp.c | 27 +-
net/bridge/br_cfm.c | 6 +
net/bridge/br_cfm_netlink.c | 4 +-
net/bridge/br_if.c | 3 +
net/bridge/br_stp.c | 3 +-
net/bridge/netfilter/ebtables.c | 22 +-
net/bridge/netfilter/nft_meta_bridge.c | 4 +-
net/can/bcm.c | 127 ++++-
net/can/isotp.c | 9 +-
net/core/dev.c | 88 ++++
net/core/fib_rules.c | 6 +-
net/core/filter.c | 28 +-
net/core/flow_dissector.c | 12 +-
net/core/lwt_bpf.c | 12 +
net/core/rtnetlink.c | 8 +
net/core/skbuff.c | 23 +-
net/devlink/rate.c | 10 +-
net/ethernet/eth.c | 9 +-
net/handshake/genl.c | 2 +-
net/ieee802154/core.c | 2 +-
net/ieee802154/header_ops.c | 9 +-
net/ieee802154/ieee802154.h | 17 +
net/ieee802154/netlink.c | 36 +-
net/ife/ife.c | 2 +-
net/ipv4/esp4_offload.c | 2 +-
net/ipv4/igmp.c | 15 +-
net/ipv4/ip_gre.c | 9 +-
net/ipv4/ip_vti.c | 3 +
net/ipv4/ipip.c | 3 +
net/ipv4/netfilter/nf_reject_ipv4.c | 2 +-
net/ipv4/sysctl_net_ipv4.c | 10 +-
net/ipv4/tcp_output.c | 4 +-
net/ipv6/addrconf.c | 23 +-
net/ipv6/esp6_offload.c | 2 +-
net/ipv6/ip6_gre.c | 6 +
net/ipv6/ip6_vti.c | 3 +
net/ipv6/mcast.c | 165 +++---
net/ipv6/netfilter.c | 4 +-
net/ipv6/netfilter/ip6t_ah.c | 5 +
net/ipv6/netfilter/ip6t_hbh.c | 1 +
net/ipv6/netfilter/ip6t_rt.c | 3 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 3 +-
net/ipv6/route.c | 9 +-
net/ipv6/seg6.c | 3 +
net/ipv6/sit.c | 3 +
net/kcm/kcmsock.c | 8 +-
net/key/af_key.c | 1 +
net/llc/af_llc.c | 1 +
net/llc/llc_conn.c | 1 -
net/mac80211/main.c | 3 +-
net/mac80211/tx.c | 17 +-
net/mac802154/iface.c | 6 +-
net/netfilter/ipset/ip_set_core.c | 12 +-
net/netfilter/ipset/ip_set_hash_gen.h | 67 ++-
net/netfilter/ipvs/ip_vs_app.c | 10 +-
net/netfilter/ipvs/ip_vs_conn.c | 4 +-
net/netfilter/ipvs/ip_vs_core.c | 36 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 11 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 +-
net/netfilter/ipvs/ip_vs_xmit.c | 6 +-
net/netfilter/nf_conncount.c | 23 +-
net/netfilter/nf_conntrack_core.c | 79 +--
net/netfilter/nf_conntrack_ecache.c | 2 +-
net/netfilter/nf_conntrack_extend.c | 32 +-
net/netfilter/nf_conntrack_irc.c | 6 +-
net/netfilter/nf_conntrack_netlink.c | 2 +-
net/netfilter/nf_conntrack_seqadj.c | 2 +
net/netfilter/nf_nat_core.c | 10 +
net/netfilter/nf_nat_sip.c | 11 +
net/netfilter/nf_queue.c | 14 +
net/netfilter/nfnetlink_cthelper.c | 4 +-
net/netfilter/nfnetlink_osf.c | 6 +-
net/netfilter/nfnetlink_queue.c | 3 +
net/netfilter/nft_compat.c | 24 +-
net/netfilter/nft_log.c | 58 +--
net/netfilter/nft_synproxy.c | 9 +-
net/netfilter/xt_AUDIT.c | 58 +--
net/netfilter/xt_cluster.c | 2 +-
net/netfilter/xt_connmark.c | 14 +-
net/netfilter/xt_nat.c | 9 +
net/netfilter/xt_rateest.c | 2 +-
net/netfilter/xt_u32.c | 12 +-
net/openvswitch/conntrack.c | 2 +-
net/openvswitch/flow_netlink.c | 201 +++++--
net/phonet/af_phonet.c | 5 +-
net/psample/psample.c | 6 +-
net/qrtr/af_qrtr.c | 2 +-
net/rxrpc/recvmsg.c | 5 +-
net/sched/act_api.c | 13 +-
net/sched/act_bpf.c | 2 +-
net/sched/act_ct.c | 7 +-
net/sched/act_pedit.c | 13 +-
net/sched/cls_api.c | 25 +-
net/sched/cls_bpf.c | 10 +-
net/sched/cls_flow.c | 12 +-
net/sched/sch_cake.c | 5 +-
net/sched/sch_codel.c | 48 +-
net/sched/sch_drr.c | 8 +-
net/sched/sch_fq_codel.c | 41 +-
net/sched/sch_hfsc.c | 24 +-
net/sched/sch_hhf.c | 27 +
net/sched/sch_htb.c | 14 +-
net/sched/sch_multiq.c | 2 +-
net/sched/sch_taprio.c | 2 +-
net/sched/sch_teql.c | 126 +++--
net/sctp/diag.c | 67 ++-
net/sctp/sm_make_chunk.c | 10 +-
net/sctp/sm_statefuns.c | 23 +-
net/sctp/socket.c | 38 +-
net/smc/smc_cdc.c | 15 +-
net/socket.c | 2 +-
net/sunrpc/clnt.c | 19 +-
net/sunrpc/svcsock.c | 10 +
net/sunrpc/xdr.c | 14 +-
net/sunrpc/xprt.c | 16 +
net/sunrpc/xprtrdma/backchannel.c | 5 +-
net/sunrpc/xprtrdma/frwr_ops.c | 2 +-
net/sunrpc/xprtrdma/rpc_rdma.c | 172 ++++--
net/sunrpc/xprtrdma/transport.c | 85 ++-
net/sunrpc/xprtrdma/verbs.c | 167 ++++--
net/sunrpc/xprtrdma/xprt_rdma.h | 7 +-
net/sunrpc/xprtsock.c | 16 +-
net/tipc/bcast.c | 22 +-
net/tipc/bcast.h | 2 +-
net/tipc/bearer.c | 1 +
net/tipc/core.c | 5 +
net/tipc/discover.c | 14 +-
net/tipc/name_distr.c | 13 +-
net/tipc/netlink.c | 12 +
net/tipc/node.c | 15 +-
net/tipc/socket.c | 3 +
net/tls/tls_sw.c | 11 +
net/wireless/nl80211.c | 2 +-
net/xfrm/espintcp.c | 34 +-
net/xfrm/xfrm_input.c | 6 +-
net/xfrm/xfrm_interface_core.c | 3 +
net/xfrm/xfrm_policy.c | 32 +-
net/xfrm/xfrm_state.c | 2 +-
net/xfrm/xfrm_user.c | 20 +-
samples/trace_events/trace-events-sample.c | 4 +
scripts/kconfig/conf.c | 6 +-
security/apparmor/apparmorfs.c | 9 +-
security/apparmor/domain.c | 58 ++-
security/apparmor/label.c | 2 +-
security/apparmor/net.c | 2 +
security/apparmor/policy.c | 5 +-
security/apparmor/procattr.c | 2 +
security/integrity/evm/evm_secfs.c | 16 +-
security/keys/keyring.c | 2 +-
security/selinux/hooks.c | 61 ++-
sound/aoa/fabrics/layout.c | 6 +
sound/core/init.c | 11 +-
sound/core/seq/seq_clientmgr.c | 1 +
sound/core/seq/seq_memory.c | 4 +-
sound/core/seq/seq_midi.c | 55 +-
sound/firewire/isight.c | 3 +-
sound/isa/gus/gus_pcm.c | 2 +
sound/pci/cmipci.c | 6 +
sound/pci/es1938.c | 2 +
sound/pci/ice1712/aureon.c | 2 +
sound/pci/ice1712/ice1712.c | 8 +
sound/pci/ice1712/ice1724.c | 6 +
sound/pci/ymfpci/ymfpci_main.c | 6 +
sound/soc/codecs/adau1372.c | 5 +
sound/soc/codecs/aw88261.c | 12 +-
sound/soc/codecs/cs35l56.c | 14 +-
sound/soc/codecs/hdac_hdmi.c | 4 +-
sound/soc/codecs/tlv320aic3x.c | 25 +-
sound/soc/fsl/fsl_asrc_dma.c | 20 +
sound/soc/fsl/fsl_audmix.c | 6 +
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 11 +
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 9 +
sound/soc/qcom/qdsp6/q6apm.c | 8 +
sound/soc/sh/rcar/rsnd.h | 2 +-
sound/soc/sof/ipc3-control.c | 79 ++-
sound/soc/sof/ipc4-control.c | 11 +-
sound/soc/sof/topology.c | 5 +-
sound/soc/tegra/tegra210_ahub.c | 4 +-
sound/usb/caiaq/input.c | 2 +-
sound/usb/midi2.c | 5 +
sound/usb/mixer_quirks.c | 101 ++--
sound/usb/mixer_scarlett.c | 4 +-
sound/usb/mixer_us16x08.c | 127 +++--
sound/virtio/virtio_pcm.c | 3 +-
sound/virtio/virtio_pcm_ops.c | 3 +-
tools/bpf/bpftool/net.c | 4 +-
tools/include/linux/bitops.h | 2 +
tools/include/uapi/linux/bpf.h | 1 +
tools/lib/api/fs/fs.c | 19 +-
tools/lib/bpf/libbpf.c | 9 +-
tools/lib/bpf/strset.c | 62 ++-
tools/lib/bpf/usdt.c | 16 +-
tools/lib/symbol/kallsyms.c | 5 +-
tools/mm/slabinfo.c | 6 +-
tools/perf/builtin-annotate.c | 3 +-
tools/perf/builtin-c2c.c | 20 +-
tools/perf/builtin-diff.c | 3 +-
tools/perf/builtin-report.c | 3 +-
tools/perf/builtin-sched.c | 69 ++-
tools/perf/tests/pmu-events.c | 24 +-
tools/perf/trace/beauty/fcntl.c | 16 +
tools/perf/util/bpf-event.c | 18 +-
tools/perf/util/bpf-utils.c | 16 +
tools/perf/util/cpumap.c | 28 +-
tools/perf/util/cs-etm-base.c | 4 +-
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +-
tools/perf/util/cs-etm.c | 522 ++++++++++++-------
tools/perf/util/cs-etm.h | 8 +-
tools/perf/util/event.c | 15 +-
tools/perf/util/header.c | 54 ++
tools/perf/util/hist.c | 7 +-
.../util/intel-pt-decoder/intel-pt-insn-decoder.c | 11 +-
tools/perf/util/machine.c | 10 +-
tools/perf/util/mmap.c | 18 +-
tools/perf/util/pmu.c | 10 +-
tools/perf/util/probe-finder.c | 4 +-
tools/perf/util/symbol-elf.c | 48 +-
tools/perf/util/symbol-minimal.c | 11 +-
tools/perf/util/symbol.c | 2 +-
tools/perf/util/thread.c | 5 +
tools/power/x86/intel-speed-select/isst-daemon.c | 9 +-
tools/testing/cxl/test/cxl.c | 8 +-
tools/testing/cxl/test/mem.c | 6 +-
.../selftests/bpf/prog_tests/verifier_log.c | 1 +
.../selftests/bpf/progs/bpf_iter_task_vma.c | 2 +-
tools/testing/selftests/hid/Makefile | 10 +-
tools/testing/selftests/hid/hid_bpf.c | 70 ++-
tools/testing/selftests/hid/progs/hid.c | 94 +++-
.../testing/selftests/hid/progs/hid_bpf_helpers.h | 84 ++-
tools/testing/selftests/mm/compaction_test.c | 3 +
tools/testing/selftests/mm/hmm-tests.c | 63 ++-
tools/testing/selftests/net/tcp_mmap.c | 4 +
tools/usb/usbip/libsrc/usbip_common.c | 2 +
tools/usb/usbip/libsrc/usbip_device_driver.c | 4 +
tools/usb/usbip/libsrc/vhci_driver.c | 1 +
tools/virtio/vringh_test.c | 5 +
virt/kvm/eventfd.c | 12 +-
virt/kvm/kvm_main.c | 16 +-
1187 files changed, 14330 insertions(+), 8071 deletions(-)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0001/1266] bpf, arm64: Reject out-of-range B.cond targets
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0002/1266] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
` (997 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Puranjay Mohan,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 48d83d94930eb4db4c93d2de44838b9455cff626 ]
aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to
compute a 19-bit signed byte offset for a conditional branch,
but unlike its siblings aarch64_insn_gen_branch_imm() and
aarch64_insn_gen_comp_branch_imm(), it does not check whether
label_imm_common() returned its out-of-range sentinel (range)
before feeding the value to aarch64_insn_encode_immediate().
aarch64_insn_encode_immediate() unconditionally masks the value
with the 19-bit field mask, so an offset that was rejected by
label_imm_common() gets silently truncated. With the sentinel
value SZ_1M, the resulting field ends up with bit 18 (the sign
bit of the 19-bit signed displacement) set, and the CPU decodes
it as a ~1 MiB *backward* branch, producing an incorrectly
targeted B.cond instruction. For code-gen locations like the
emit_bpf_tail_call() this function is the only barrier between
an overflowing displacement and a silently miscompiled branch.
Fix it by returning AARCH64_BREAK_FAULT when the offset is out
of range, so callers see a loud failure instead of a silently
misencoded branch. validate_code() scans the generated image
for any AARCH64_BREAK_FAULT and then lets the JIT fail.
Fixes: 345e0d35ecdd ("arm64: introduce aarch64_insn_gen_cond_branch_imm()")
Fixes: c94ae4f7c5ec ("arm64: insn: remove BUG_ON from codegen")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20260415121403.639619-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/lib/insn.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/lib/insn.c b/arch/arm64/lib/insn.c
index 7232b1e70a125f..cb845b3649a188 100644
--- a/arch/arm64/lib/insn.c
+++ b/arch/arm64/lib/insn.c
@@ -338,6 +338,8 @@ u32 aarch64_insn_gen_cond_branch_imm(unsigned long pc, unsigned long addr,
long offset;
offset = label_imm_common(pc, addr, SZ_1M);
+ if (offset >= SZ_1M)
+ return AARCH64_BREAK_FAULT;
insn = aarch64_insn_get_bcond_value();
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0002/1266] nfsd: release layout stid on setlease failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0001/1266] bpf, arm64: Reject out-of-range B.cond targets Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0003/1266] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
` (996 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever, Chuck Lever, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.
A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.
nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()
Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ cel: no ls_fence_work in 6.6.y; dropped INIT_DELAYED_WORK hunk ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4layouts.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 308214378fd352..84bb200e24adea 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
BUG_ON(!ls->ls_file);
if (nfsd4_layout_setlease(ls)) {
- nfsd_file_put(ls->ls_file);
- put_nfs4_file(fp);
- kmem_cache_free(nfs4_layout_stateid_cache, ls);
+ nfs4_put_stid(stp);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0003/1266] nfsd: reset write verifier on deferred writeback errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0001/1266] bpf, arm64: Reject out-of-range B.cond targets Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0002/1266] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0004/1266] ext4: get rid of ppath in get_ext_path() Greg Kroah-Hartman
` (995 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever, Chuck Lever, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.
nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to
detect deferred writeback errors, but neither rotates the server's write
verifier (nn->writeverf) when this check fails. Every other
durable-storage-failure path in these functions calls
commit_reset_write_verifier() before returning an error.
The missing rotation means clients holding UNSTABLE write data under the
current verifier will COMMIT, receive the unchanged verifier back, and
conclude their data is durable — silently dropping data that failed
writeback. This violates the UNSTABLE+COMMIT durability contract
(RFC 1813 §3.3.7, RFC 8881 §18.32).
Add commit_reset_write_verifier() calls at both filemap_check_wb_err()
error sites, matching the pattern used by adjacent error paths in the
same functions. The helper already filters -EAGAIN and -ESTALE
internally, so the calls are unconditionally safe.
Reported-by: Chris Mason <clm@meta.com>
Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ cel: 6.6.y predates the commit_reset_write_verifier() helper (v6.7);
open-coded nfsd_reset_write_verifier() and the reset tracepoint at
both sites, matching the other reset paths in these functions ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/vfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ae1f43eb515a81..6658c92340f20b 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1185,8 +1185,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
nfsd_stats_io_write_add(nn, exp, *cnt);
fsnotify_modify(file);
host_err = filemap_check_wb_err(file->f_mapping, since);
- if (host_err < 0)
+ if (host_err < 0) {
+ nfsd_reset_write_verifier(nn);
+ trace_nfsd_writeverf_reset(nn, rqstp, host_err);
goto out_nfserr;
+ }
if (stable && use_wgather) {
host_err = wait_for_concurrent_writes(file);
@@ -1330,6 +1333,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
nfsd_copy_write_verifier(verf, nn);
err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
since);
+ if (err2 < 0) {
+ nfsd_reset_write_verifier(nn);
+ trace_nfsd_writeverf_reset(nn, rqstp, err2);
+ }
err = nfserrno(err2);
break;
case -EINVAL:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0004/1266] ext4: get rid of ppath in get_ext_path()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0003/1266] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0005/1266] LoongArch: Report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
` (994 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Ojaswin Mujoo,
Theodore Tso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 6b854d552711aa33f59eda334e6d94a00d8825bb ]
The use of path and ppath is now very confusing, so to make the code more
readable, pass path between functions uniformly, and get rid of ppath.
After getting rid of ppath in get_ext_path(), its caller may pass an error
pointer to ext4_free_ext_path(), so it needs to teach ext4_free_ext_path()
and ext4_ext_drop_refs() to skip the error pointer. No functional changes.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20240822023545.1994557-13-libaokun@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/extents.c | 5 +++--
fs/ext4/move_extent.c | 34 +++++++++++++++++-----------------
2 files changed, 20 insertions(+), 19 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index a94798e23c1afb..9c2d23958146bf 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -114,7 +114,7 @@ static void ext4_ext_drop_refs(struct ext4_ext_path *path)
{
int depth, i;
- if (!path)
+ if (IS_ERR_OR_NULL(path))
return;
depth = path->p_depth;
for (i = 0; i <= depth; i++, path++) {
@@ -125,6 +125,8 @@ static void ext4_ext_drop_refs(struct ext4_ext_path *path)
void ext4_free_ext_path(struct ext4_ext_path *path)
{
+ if (IS_ERR_OR_NULL(path))
+ return;
ext4_ext_drop_refs(path);
kfree(path);
}
@@ -4242,7 +4244,6 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
path = ext4_find_extent(inode, map->m_lblk, NULL, 0);
if (IS_ERR(path)) {
err = PTR_ERR(path);
- path = NULL;
goto out;
}
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index d5636a2a718a8d..96a84de321690d 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -17,27 +17,23 @@
* get_ext_path() - Find an extent path for designated logical block number.
* @inode: inode to be searched
* @lblock: logical block number to find an extent path
- * @ppath: pointer to an extent path pointer (for output)
+ * @path: pointer to an extent path
*
- * ext4_find_extent wrapper. Return 0 on success, or a negative error value
- * on failure.
+ * ext4_find_extent wrapper. Return an extent path pointer on success,
+ * or an error pointer on failure.
*/
-static inline int
+static inline struct ext4_ext_path *
get_ext_path(struct inode *inode, ext4_lblk_t lblock,
- struct ext4_ext_path **ppath)
+ struct ext4_ext_path *path)
{
- struct ext4_ext_path *path = *ppath;
-
- *ppath = NULL;
path = ext4_find_extent(inode, lblock, path, EXT4_EX_NOCACHE);
if (IS_ERR(path))
- return PTR_ERR(path);
+ return path;
if (path[ext_depth(inode)].p_ext == NULL) {
ext4_free_ext_path(path);
- return -ENODATA;
+ return ERR_PTR(-ENODATA);
}
- *ppath = path;
- return 0;
+ return path;
}
/**
@@ -95,9 +91,11 @@ mext_check_coverage(struct inode *inode, ext4_lblk_t from, ext4_lblk_t count,
int ret = 0;
ext4_lblk_t last = from + count;
while (from < last) {
- *err = get_ext_path(inode, from, &path);
- if (*err)
- goto out;
+ path = get_ext_path(inode, from, path);
+ if (IS_ERR(path)) {
+ *err = PTR_ERR(path);
+ return ret;
+ }
ext = path[ext_depth(inode)].p_ext;
if (unwritten != ext4_ext_is_unwritten(ext))
goto out;
@@ -634,9 +632,11 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
int offset_in_page;
int unwritten, cur_len;
- ret = get_ext_path(orig_inode, o_start, &path);
- if (ret)
+ path = get_ext_path(orig_inode, o_start, path);
+ if (IS_ERR(path)) {
+ ret = PTR_ERR(path);
goto out;
+ }
ex = path[path->p_depth].p_ext;
cur_blk = le32_to_cpu(ex->ee_block);
cur_len = ext4_ext_get_actual_len(ex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0005/1266] LoongArch: Report dying CPU to RCU in stop_this_cpu()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0004/1266] ext4: get rid of ppath in get_ext_path() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0006/1266] Bluetooth: btmtk: apply the common btmtk_fw_get_filename Greg Kroah-Hartman
` (993 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huacai Chen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.
This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary
CPUs in stop_this_cpu(). And the function marks the CPU offline for the
scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps
expecting a quiescent state from CPUs that are now spinning forever with
interrupts disabled.
As long as nothing waits for an RCU grace period after smp_send_stop()
this is harmless, which is why it went unnoticed. However, since commit
91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on
PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures
without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()
returns false. Any irq_work_sync() issued in the reboot/shutdown/halt
path after smp_send_stop() then blocks on a grace period that can never
complete, hanging the reboot:
WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
...
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
rcu: Offline CPU 1 blocking current GP.
rcu: Offline CPU 2 blocking current GP.
rcu: Offline CPU 3 blocking current GP.
This issue needs some hacks to reproduce, and it was not noticed on
LoongArch because arch_irq_work_has_interrupt() usually returns true.
Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring
the generic CPU-hotplug offline path, so RCU stops waiting on the parked
CPUs and grace periods can still complete. LoongArch shuts down all CPUs
here without going through the CPU-hotplug mechanism, so this report is
not otherwise issued.
Cc: <stable@vger.kernel.org>
Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/smp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c
index ed67629454374f..d3fafa5cdf6bc8 100644
--- a/arch/loongarch/kernel/smp.c
+++ b/arch/loongarch/kernel/smp.c
@@ -613,6 +613,7 @@ static void stop_this_cpu(void *dummy)
set_cpu_online(smp_processor_id(), false);
calculate_cpu_foreign_map();
local_irq_disable();
+ rcu_report_dead(smp_processor_id());
while (true);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0006/1266] Bluetooth: btmtk: apply the common btmtk_fw_get_filename
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0005/1266] LoongArch: Report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0007/1266] Bluetooth: btusb: mediatek: reset the controller before downloading the fw Greg Kroah-Hartman
` (992 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit 7f935b21bee4d8a9f26b57ae6c3682161b247809 ]
Apply the common btmtk_fw_get_filename to avoid the similar coding in each
driver.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtksdio.c | 3 +++
drivers/bluetooth/btusb.c | 10 ++--------
2 files changed, 5 insertions(+), 8 deletions(-)
diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index e249aa7587833b..2be38c8e353efb 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -1111,6 +1111,9 @@ static int btmtksdio_setup(struct hci_dev *hdev)
return err;
}
+ btmtk_fw_get_filename(fwname, sizeof(fwname), dev_id,
+ fw_version, 0);
+
snprintf(fwname, sizeof(fwname),
"mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
dev_id & 0xffff, (fw_version & 0xff) + 1);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 9b2857a8e7ac1f..048929e336cf64 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2940,14 +2940,8 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
case 0x7922:
case 0x7961:
case 0x7925:
- if (dev_id == 0x7925)
- snprintf(fw_bin_name, sizeof(fw_bin_name),
- "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
- dev_id & 0xffff, dev_id & 0xffff, (fw_version & 0xff) + 1);
- else
- snprintf(fw_bin_name, sizeof(fw_bin_name),
- "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
- dev_id & 0xffff, (fw_version & 0xff) + 1);
+ btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
+ fw_version, 0);
err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
btmtk_usb_hci_wmt_sync);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0007/1266] Bluetooth: btusb: mediatek: reset the controller before downloading the fw
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0006/1266] Bluetooth: btmtk: apply the common btmtk_fw_get_filename Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0008/1266] Bluetooth: btusb: mediatek: add MT7922 subsystem reset Greg Kroah-Hartman
` (991 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Chris Lu, Hao Qin,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Qin <hao.qin@mediatek.com>
[ Upstream commit ccfc8948d7e4d93cab341a99774b24586717d89a ]
Reset the controller before downloading the firmware to improve its
reliability. This includes situations like cold or warm reboots, ensuring
the controller is in its initial state before starting the firmware
download.
Co-developed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Co-developed-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Hao Qin <hao.qin@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 048929e336cf64..c6b62437be2d5a 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2940,6 +2940,13 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
case 0x7922:
case 0x7961:
case 0x7925:
+ /* Reset the device to ensure it's in the initial state before
+ * downloading the firmware to ensure.
+ */
+
+ if (!test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
+ btusb_mtk_subsys_reset(hdev, dev_id);
+
btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
fw_version, 0);
@@ -2947,9 +2954,12 @@ static int btusb_mtk_setup(struct hci_dev *hdev)
btmtk_usb_hci_wmt_sync);
if (err < 0) {
bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+ clear_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
return err;
}
+ set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
+
/* It's Device EndPoint Reset Option Register */
btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0008/1266] Bluetooth: btusb: mediatek: add MT7922 subsystem reset
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0007/1266] Bluetooth: btusb: mediatek: reset the controller before downloading the fw Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0009/1266] Bluetooth: btusb: mediatek: remove the unnecessary goto tag Greg Kroah-Hartman
` (990 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Hao Qin,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Qin <hao.qin@mediatek.com>
[ Upstream commit 064aee501012eaeeeb40a2acb991598e0a89fac9 ]
Add the support of MT7922 bluetooth subsystem reset that was called the
auto revert to self-recover from the fatal error in the controller like
the host encounters HCI cmd timeout or the controller crashes.
Co-developed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Hao Qin <hao.qin@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c6b62437be2d5a..536b013ff7aedc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2811,7 +2811,16 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
u32 val;
int err;
- if (dev_id == 0x7925) {
+ if (dev_id == 0x7922) {
+ btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ val |= 0x00002020;
+ btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+ btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+ btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ val |= BIT(0);
+ btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+ msleep(100);
+ } else if (dev_id == 0x7925) {
btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
val |= (1 << 5);
btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
@@ -2851,6 +2860,9 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
if (err < 0)
bt_dev_err(hdev, "Reset timeout");
+ if (dev_id == 0x7922)
+ btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+
btusb_mtk_id_get(data, 0x70010200, &val);
if (!val)
bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0009/1266] Bluetooth: btusb: mediatek: remove the unnecessary goto tag
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0008/1266] Bluetooth: btusb: mediatek: add MT7922 subsystem reset Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0010/1266] Bluetooth: btusb: mediatek: return error for failed reg access Greg Kroah-Hartman
` (989 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Chris Lu,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit be71dfb9ad2042bba713975ef50c3a5b0429f1d2 ]
Remove the unnecessary goto tag whether there is an error or not, we have
to free the buffer at the end of the function.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 536b013ff7aedc..926ca7ecaf0cc2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2725,12 +2725,9 @@ static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
0x5E,
reg >> 16, reg & 0xffff,
buf, 4, USB_CTRL_SET_TIMEOUT);
- if (err < 0) {
+ if (err < 0)
bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
- goto err_free_buf;
- }
-err_free_buf:
kfree(buf);
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0010/1266] Bluetooth: btusb: mediatek: return error for failed reg access
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0009/1266] Bluetooth: btusb: mediatek: remove the unnecessary goto tag Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0011/1266] Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c Greg Kroah-Hartman
` (988 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Chris Lu,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit 3dcb122b30643444352ff4b9aa16367dd24d7571 ]
Update the code to immediately return an error code if accessing a
related register fails. This ensures that our desired logic for
subsequent register operations is maintained and allows us to promptly
catch any unexpected errors.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 114 ++++++++++++++++++++++++++++----------
1 file changed, 84 insertions(+), 30 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 926ca7ecaf0cc2..a7aa4c1dacb295 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2809,47 +2809,98 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
int err;
if (dev_id == 0x7922) {
- btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
val |= 0x00002020;
- btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
- btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
- btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
val |= BIT(0);
- btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
+ if (err < 0)
+ return err;
msleep(100);
} else if (dev_id == 0x7925) {
- btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
val |= (1 << 5);
- btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
val &= 0xFFFF00FF;
+ if (err < 0)
+ return err;
val |= (1 << 13);
- btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
- btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
val |= (1 << 0);
- btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
- btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
- btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
- btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+ if (err < 0)
+ return err;
msleep(100);
} else {
/* It's Device EndPoint Reset Option Register */
bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
- btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
- btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
-
+ err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
+ if (err < 0)
+ return err;
/* Reset the bluetooth chip via USB interface. */
- btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
- btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
- btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
- btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
- btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
+ if (err < 0)
+ return err;
/* MT7921 need to delay 20ms between toggle reset bit */
msleep(20);
- btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
- btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
+ if (err < 0)
+ return err;
+ err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
}
err = readx_poll_timeout(btusb_mtk_reset_done, hdev, val,
@@ -2857,11 +2908,14 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
if (err < 0)
bt_dev_err(hdev, "Reset timeout");
- if (dev_id == 0x7922)
- btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (dev_id == 0x7922) {
+ err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ }
- btusb_mtk_id_get(data, 0x70010200, &val);
- if (!val)
+ err = btusb_mtk_id_get(data, 0x70010200, &val);
+ if (err < 0 || !val)
bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0011/1266] Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0010/1266] Bluetooth: btusb: mediatek: return error for failed reg access Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0012/1266] Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices Greg Kroah-Hartman
` (987 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Wang, Chris Lu,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit 5c5e8c52e3cafaa6f71efd44a42a674271e5b3ad ]
Move btusb_mtk_[setup, shutdown] and related function from
btusb.c to btmtk.c which holds vendor specific stuff and
would make btusb.c clean.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtk.c | 454 +++++++++++++++++++++++++++++++++++++-
drivers/bluetooth/btmtk.h | 23 +-
drivers/bluetooth/btusb.c | 446 ++-----------------------------------
3 files changed, 484 insertions(+), 439 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 582915f9a8d700..8fd923de47c1f3 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -5,6 +5,8 @@
#include <linux/module.h>
#include <linux/firmware.h>
#include <linux/usb.h>
+#include <linux/iopoll.h>
+#include <asm/unaligned.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -573,8 +575,8 @@ static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
return err;
}
-int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
- struct btmtk_hci_wmt_params *wmt_params)
+static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
+ struct btmtk_hci_wmt_params *wmt_params)
{
struct btmtk_data *data = hci_get_priv(hdev);
struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
@@ -711,7 +713,453 @@ int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
kfree(wc);
return err;
}
-EXPORT_SYMBOL_GPL(btmtk_usb_hci_wmt_sync);
+
+static int btmtk_usb_func_query(struct hci_dev *hdev)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ int status, err;
+ u8 param = 0;
+
+ /* Query whether the function is enabled */
+ wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+ wmt_params.flag = 4;
+ wmt_params.dlen = sizeof(param);
+ wmt_params.data = ¶m;
+ wmt_params.status = &status;
+
+ err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to query function status (%d)", err);
+ return err;
+ }
+
+ return status;
+}
+
+static int btmtk_usb_uhw_reg_write(struct hci_dev *hdev, u32 reg, u32 val)
+{
+ struct btmtk_data *data = hci_get_priv(hdev);
+ int pipe, err;
+ void *buf;
+
+ buf = kzalloc(4, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ put_unaligned_le32(val, buf);
+
+ pipe = usb_sndctrlpipe(data->udev, 0);
+ err = usb_control_msg(data->udev, pipe, 0x02,
+ 0x5E,
+ reg >> 16, reg & 0xffff,
+ buf, 4, USB_CTRL_SET_TIMEOUT);
+ if (err < 0)
+ bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
+
+ kfree(buf);
+
+ return err;
+}
+
+static int btmtk_usb_uhw_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
+{
+ struct btmtk_data *data = hci_get_priv(hdev);
+ int pipe, err;
+ void *buf;
+
+ buf = kzalloc(4, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ pipe = usb_rcvctrlpipe(data->udev, 0);
+ err = usb_control_msg(data->udev, pipe, 0x01,
+ 0xDE,
+ reg >> 16, reg & 0xffff,
+ buf, 4, USB_CTRL_GET_TIMEOUT);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
+ goto err_free_buf;
+ }
+
+ *val = get_unaligned_le32(buf);
+ bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
+
+err_free_buf:
+ kfree(buf);
+
+ return err;
+}
+
+static int btmtk_usb_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
+{
+ struct btmtk_data *data = hci_get_priv(hdev);
+ int pipe, err, size = sizeof(u32);
+ void *buf;
+
+ buf = kzalloc(size, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ pipe = usb_rcvctrlpipe(data->udev, 0);
+ err = usb_control_msg(data->udev, pipe, 0x63,
+ USB_TYPE_VENDOR | USB_DIR_IN,
+ reg >> 16, reg & 0xffff,
+ buf, size, USB_CTRL_GET_TIMEOUT);
+ if (err < 0)
+ goto err_free_buf;
+
+ *val = get_unaligned_le32(buf);
+
+err_free_buf:
+ kfree(buf);
+
+ return err;
+}
+
+static int btmtk_usb_id_get(struct hci_dev *hdev, u32 reg, u32 *id)
+{
+ return btmtk_usb_reg_read(hdev, reg, id);
+}
+
+static u32 btmtk_usb_reset_done(struct hci_dev *hdev)
+{
+ u32 val = 0;
+
+ btmtk_usb_uhw_reg_read(hdev, MTK_BT_MISC, &val);
+
+ return val & MTK_BT_RST_DONE;
+}
+
+int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
+{
+ u32 val;
+ int err;
+
+ if (dev_id == 0x7922) {
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
+ val |= 0x00002020;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
+ val |= BIT(0);
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
+ if (err < 0)
+ return err;
+ msleep(100);
+ } else if (dev_id == 0x7925) {
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
+ val |= (1 << 5);
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
+ val &= 0xFFFF00FF;
+ val |= (1 << 13);
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
+ if (err < 0)
+ return err;
+ val |= (1 << 0);
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
+ if (err < 0)
+ return err;
+ msleep(100);
+ } else {
+ /* It's Device EndPoint Reset Option Register */
+ bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_WDT_STATUS, &val);
+ if (err < 0)
+ return err;
+ /* Reset the bluetooth chip via USB interface. */
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 1);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
+ if (err < 0)
+ return err;
+ /* MT7921 need to delay 20ms between toggle reset bit */
+ msleep(20);
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 0);
+ if (err < 0)
+ return err;
+ err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
+ if (err < 0)
+ return err;
+ }
+
+ err = readx_poll_timeout(btmtk_usb_reset_done, hdev, val,
+ val & MTK_BT_RST_DONE, 20000, 1000000);
+ if (err < 0)
+ bt_dev_err(hdev, "Reset timeout");
+
+ if (dev_id == 0x7922) {
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
+ if (err < 0)
+ return err;
+ }
+
+ err = btmtk_usb_id_get(hdev, 0x70010200, &val);
+ if (err < 0 || !val)
+ bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
+
+ return err;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_subsys_reset);
+
+int btmtk_usb_setup(struct hci_dev *hdev)
+{
+ struct btmtk_data *btmtk_data = hci_get_priv(hdev);
+ struct btmtk_hci_wmt_params wmt_params;
+ ktime_t calltime, delta, rettime;
+ struct btmtk_tci_sleep tci_sleep;
+ unsigned long long duration;
+ struct sk_buff *skb;
+ const char *fwname;
+ int err, status;
+ u32 dev_id = 0;
+ char fw_bin_name[64];
+ u32 fw_version = 0, fw_flavor = 0;
+ u8 param;
+
+ calltime = ktime_get();
+
+ err = btmtk_usb_id_get(hdev, 0x80000008, &dev_id);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to get device id (%d)", err);
+ return err;
+ }
+
+ if (!dev_id || dev_id != 0x7663) {
+ err = btmtk_usb_id_get(hdev, 0x70010200, &dev_id);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to get device id (%d)", err);
+ return err;
+ }
+ err = btmtk_usb_id_get(hdev, 0x80021004, &fw_version);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to get fw version (%d)", err);
+ return err;
+ }
+ err = btmtk_usb_id_get(hdev, 0x70010020, &fw_flavor);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to get fw flavor (%d)", err);
+ return err;
+ }
+ fw_flavor = (fw_flavor & 0x00000080) >> 7;
+ }
+
+ btmtk_data->dev_id = dev_id;
+
+ err = btmtk_register_coredump(hdev, btmtk_data->drv_name, fw_version);
+ if (err < 0)
+ bt_dev_err(hdev, "Failed to register coredump (%d)", err);
+
+ switch (dev_id) {
+ case 0x7663:
+ fwname = FIRMWARE_MT7663;
+ break;
+ case 0x7668:
+ fwname = FIRMWARE_MT7668;
+ break;
+ case 0x7922:
+ case 0x7961:
+ case 0x7925:
+ /* Reset the device to ensure it's in the initial state before
+ * downloading the firmware to ensure.
+ */
+
+ if (!test_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags))
+ btmtk_usb_subsys_reset(hdev, dev_id);
+
+ btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
+ fw_version, fw_flavor);
+
+ err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
+ btmtk_usb_hci_wmt_sync);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
+ clear_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
+ return err;
+ }
+
+ set_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
+
+ /* It's Device EndPoint Reset Option Register */
+ err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT,
+ MTK_EP_RST_IN_OUT_OPT);
+ if (err < 0)
+ return err;
+
+ /* Enable Bluetooth protocol */
+ param = 1;
+ wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+ wmt_params.flag = 0;
+ wmt_params.dlen = sizeof(param);
+ wmt_params.data = ¶m;
+ wmt_params.status = NULL;
+
+ err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+ return err;
+ }
+
+ hci_set_msft_opcode(hdev, 0xFD30);
+ hci_set_aosp_capable(hdev);
+
+ goto done;
+ default:
+ bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
+ dev_id);
+ return -ENODEV;
+ }
+
+ /* Query whether the firmware is already download */
+ wmt_params.op = BTMTK_WMT_SEMAPHORE;
+ wmt_params.flag = 1;
+ wmt_params.dlen = 0;
+ wmt_params.data = NULL;
+ wmt_params.status = &status;
+
+ err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
+ return err;
+ }
+
+ if (status == BTMTK_WMT_PATCH_DONE) {
+ bt_dev_info(hdev, "firmware already downloaded");
+ goto ignore_setup_fw;
+ }
+
+ /* Setup a firmware which the device definitely requires */
+ err = btmtk_setup_firmware(hdev, fwname,
+ btmtk_usb_hci_wmt_sync);
+ if (err < 0)
+ return err;
+
+ignore_setup_fw:
+ err = readx_poll_timeout(btmtk_usb_func_query, hdev, status,
+ status < 0 || status != BTMTK_WMT_ON_PROGRESS,
+ 2000, 5000000);
+ /* -ETIMEDOUT happens */
+ if (err < 0)
+ return err;
+
+ /* The other errors happen in btmtk_usb_func_query */
+ if (status < 0)
+ return status;
+
+ if (status == BTMTK_WMT_ON_DONE) {
+ bt_dev_info(hdev, "function already on");
+ goto ignore_func_on;
+ }
+
+ /* Enable Bluetooth protocol */
+ param = 1;
+ wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+ wmt_params.flag = 0;
+ wmt_params.dlen = sizeof(param);
+ wmt_params.data = ¶m;
+ wmt_params.status = NULL;
+
+ err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+ return err;
+ }
+
+ignore_func_on:
+ /* Apply the low power environment setup */
+ tci_sleep.mode = 0x5;
+ tci_sleep.duration = cpu_to_le16(0x640);
+ tci_sleep.host_duration = cpu_to_le16(0x640);
+ tci_sleep.host_wakeup_pin = 0;
+ tci_sleep.time_compensation = 0;
+
+ skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
+ HCI_INIT_TIMEOUT);
+ if (IS_ERR(skb)) {
+ err = PTR_ERR(skb);
+ bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
+ return err;
+ }
+ kfree_skb(skb);
+
+done:
+ rettime = ktime_get();
+ delta = ktime_sub(rettime, calltime);
+ duration = (unsigned long long)ktime_to_ns(delta) >> 10;
+
+ bt_dev_info(hdev, "Device setup in %llu usecs", duration);
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_setup);
+
+int btmtk_usb_shutdown(struct hci_dev *hdev)
+{
+ struct btmtk_hci_wmt_params wmt_params;
+ u8 param = 0;
+ int err;
+
+ /* Disable the device */
+ wmt_params.op = BTMTK_WMT_FUNC_CTRL;
+ wmt_params.flag = 0;
+ wmt_params.dlen = sizeof(param);
+ wmt_params.data = ¶m;
+ wmt_params.status = NULL;
+
+ err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
+ if (err < 0) {
+ bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+ return err;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
MODULE_AUTHOR("Mark Chen <mark-yw.chen@mediatek.com>");
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index 3055b9728ae250..fe41528ae509bf 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -140,6 +140,8 @@ struct btmtk_hci_wmt_params {
enum {
BTMTK_TX_WAIT_VND_EVT,
+ BTMTK_FIRMWARE_LOADED,
+ BTMTK_HW_RESET_ACTIVE,
};
typedef int (*btmtk_reset_sync_func_t)(struct hci_dev *, void *);
@@ -152,6 +154,7 @@ struct btmtk_coredump_info {
};
struct btmtk_data {
+ const char *drv_name;
unsigned long flags;
u32 dev_id;
btmtk_reset_sync_func_t reset_sync;
@@ -186,8 +189,11 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb);
void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
u32 fw_flavor);
-int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
- struct btmtk_hci_wmt_params *wmt_params);
+int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id);
+
+int btmtk_usb_setup(struct hci_dev *hdev);
+
+int btmtk_usb_shutdown(struct hci_dev *hdev);
#else
static inline int btmtk_set_bdaddr(struct hci_dev *hdev,
@@ -228,8 +234,17 @@ static void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id,
{
}
-static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
- struct btmtk_hci_wmt_params *wmt_params)
+static int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
+{
+ return -EOPNOTSUPP;
+}
+
+static int btmtk_usb_setup(struct hci_dev *hdev)
+{
+ return -EOPNOTSUPP;
+}
+
+static int btmtk_usb_shutdown(struct hci_dev *hdev)
{
return -EOPNOTSUPP;
}
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a7aa4c1dacb295..86c2aac507d673 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2686,241 +2686,6 @@ static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
return hci_recv_frame(hdev, skb);
}
-static int btusb_mtk_func_query(struct hci_dev *hdev)
-{
- struct btmtk_hci_wmt_params wmt_params;
- int status, err;
- u8 param = 0;
-
- /* Query whether the function is enabled */
- wmt_params.op = BTMTK_WMT_FUNC_CTRL;
- wmt_params.flag = 4;
- wmt_params.dlen = sizeof(param);
- wmt_params.data = ¶m;
- wmt_params.status = &status;
-
- err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to query function status (%d)", err);
- return err;
- }
-
- return status;
-}
-
-static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
-{
- struct hci_dev *hdev = data->hdev;
- int pipe, err;
- void *buf;
-
- buf = kzalloc(4, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
- put_unaligned_le32(val, buf);
-
- pipe = usb_sndctrlpipe(data->udev, 0);
- err = usb_control_msg(data->udev, pipe, 0x02,
- 0x5E,
- reg >> 16, reg & 0xffff,
- buf, 4, USB_CTRL_SET_TIMEOUT);
- if (err < 0)
- bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
-
- kfree(buf);
-
- return err;
-}
-
-static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val)
-{
- struct hci_dev *hdev = data->hdev;
- int pipe, err;
- void *buf;
-
- buf = kzalloc(4, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
- pipe = usb_rcvctrlpipe(data->udev, 0);
- err = usb_control_msg(data->udev, pipe, 0x01,
- 0xDE,
- reg >> 16, reg & 0xffff,
- buf, 4, USB_CTRL_SET_TIMEOUT);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
- goto err_free_buf;
- }
-
- *val = get_unaligned_le32(buf);
- bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
-
-err_free_buf:
- kfree(buf);
-
- return err;
-}
-
-static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
-{
- int pipe, err, size = sizeof(u32);
- void *buf;
-
- buf = kzalloc(size, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
- pipe = usb_rcvctrlpipe(data->udev, 0);
- err = usb_control_msg(data->udev, pipe, 0x63,
- USB_TYPE_VENDOR | USB_DIR_IN,
- reg >> 16, reg & 0xffff,
- buf, size, USB_CTRL_SET_TIMEOUT);
- if (err < 0)
- goto err_free_buf;
-
- *val = get_unaligned_le32(buf);
-
-err_free_buf:
- kfree(buf);
-
- return err;
-}
-
-static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
-{
- return btusb_mtk_reg_read(data, reg, id);
-}
-
-static u32 btusb_mtk_reset_done(struct hci_dev *hdev)
-{
- struct btusb_data *data = hci_get_drvdata(hdev);
- u32 val = 0;
-
- btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val);
-
- return val & MTK_BT_RST_DONE;
-}
-
-static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)
-{
- struct btusb_data *data = hci_get_drvdata(hdev);
- u32 val;
- int err;
-
- if (dev_id == 0x7922) {
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
- if (err < 0)
- return err;
- val |= 0x00002020;
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
- if (err < 0)
- return err;
- val |= BIT(0);
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, val);
- if (err < 0)
- return err;
- msleep(100);
- } else if (dev_id == 0x7925) {
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
- if (err < 0)
- return err;
- val |= (1 << 5);
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
- if (err < 0)
- return err;
- val &= 0xFFFF00FF;
- if (err < 0)
- return err;
- val |= (1 << 13);
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
- if (err < 0)
- return err;
- val |= (1 << 0);
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
- if (err < 0)
- return err;
- msleep(100);
- } else {
- /* It's Device EndPoint Reset Option Register */
- bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
- err = btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
- if (err < 0)
- return err;
- /* Reset the bluetooth chip via USB interface. */
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
- if (err < 0)
- return err;
- /* MT7921 need to delay 20ms between toggle reset bit */
- msleep(20);
- err = btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
- if (err < 0)
- return err;
- err = btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
- if (err < 0)
- return err;
- }
-
- err = readx_poll_timeout(btusb_mtk_reset_done, hdev, val,
- val & MTK_BT_RST_DONE, 20000, 1000000);
- if (err < 0)
- bt_dev_err(hdev, "Reset timeout");
-
- if (dev_id == 0x7922) {
- err = btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
- if (err < 0)
- return err;
- }
-
- err = btusb_mtk_id_get(data, 0x70010200, &val);
- if (err < 0 || !val)
- bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
-
- return err;
-}
-
static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
{
struct btusb_data *data = hci_get_drvdata(hdev);
@@ -2928,7 +2693,7 @@ static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
int err;
/* It's MediaTek specific bluetooth reset mechanism via USB */
- if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
+ if (test_and_set_bit(BTMTK_HW_RESET_ACTIVE, &btmtk_data->flags)) {
bt_dev_err(hdev, "last reset failed? Not resetting again");
return -EBUSY;
}
@@ -2940,10 +2705,10 @@ static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
btusb_stop_traffic(data);
usb_kill_anchored_urbs(&data->tx_anchor);
- err = btusb_mtk_subsys_reset(hdev, btmtk_data->dev_id);
+ err = btmtk_usb_subsys_reset(hdev, btmtk_data->dev_id);
usb_queue_reset_device(data->intf);
- clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags);
+ clear_bit(BTMTK_HW_RESET_ACTIVE, &btmtk_data->flags);
return err;
}
@@ -2951,206 +2716,23 @@ static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
static int btusb_mtk_setup(struct hci_dev *hdev)
{
struct btusb_data *data = hci_get_drvdata(hdev);
- struct btmtk_hci_wmt_params wmt_params;
- ktime_t calltime, delta, rettime;
- struct btmtk_tci_sleep tci_sleep;
- unsigned long long duration;
- struct sk_buff *skb;
- const char *fwname;
- int err, status;
- u32 dev_id = 0;
- char fw_bin_name[64];
- u32 fw_version = 0;
- u8 param;
- struct btmtk_data *mediatek;
-
- calltime = ktime_get();
-
- err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to get device id (%d)", err);
- return err;
- }
-
- if (!dev_id || dev_id != 0x7663) {
- err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to get device id (%d)", err);
- return err;
- }
- err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to get fw version (%d)", err);
- return err;
- }
- }
-
- mediatek = hci_get_priv(hdev);
- mediatek->dev_id = dev_id;
- mediatek->reset_sync = btusb_mtk_reset;
-
- err = btmtk_register_coredump(hdev, btusb_driver.name, fw_version);
- if (err < 0)
- bt_dev_err(hdev, "Failed to register coredump (%d)", err);
-
- switch (dev_id) {
- case 0x7663:
- fwname = FIRMWARE_MT7663;
- break;
- case 0x7668:
- fwname = FIRMWARE_MT7668;
- break;
- case 0x7922:
- case 0x7961:
- case 0x7925:
- /* Reset the device to ensure it's in the initial state before
- * downloading the firmware to ensure.
- */
-
- if (!test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
- btusb_mtk_subsys_reset(hdev, dev_id);
-
- btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
- fw_version, 0);
-
- err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
- btmtk_usb_hci_wmt_sync);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
- clear_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
- return err;
- }
-
- set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
-
- /* It's Device EndPoint Reset Option Register */
- btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
-
- /* Enable Bluetooth protocol */
- param = 1;
- wmt_params.op = BTMTK_WMT_FUNC_CTRL;
- wmt_params.flag = 0;
- wmt_params.dlen = sizeof(param);
- wmt_params.data = ¶m;
- wmt_params.status = NULL;
-
- err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
- return err;
- }
-
- hci_set_msft_opcode(hdev, 0xFD30);
- hci_set_aosp_capable(hdev);
- goto done;
- default:
- bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
- dev_id);
- return -ENODEV;
- }
-
- /* Query whether the firmware is already download */
- wmt_params.op = BTMTK_WMT_SEMAPHORE;
- wmt_params.flag = 1;
- wmt_params.dlen = 0;
- wmt_params.data = NULL;
- wmt_params.status = &status;
-
- err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
- return err;
- }
-
- if (status == BTMTK_WMT_PATCH_DONE) {
- bt_dev_info(hdev, "firmware already downloaded");
- goto ignore_setup_fw;
- }
-
- /* Setup a firmware which the device definitely requires */
- err = btmtk_setup_firmware(hdev, fwname,
- btmtk_usb_hci_wmt_sync);
- if (err < 0)
- return err;
-
-ignore_setup_fw:
- err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
- status < 0 || status != BTMTK_WMT_ON_PROGRESS,
- 2000, 5000000);
- /* -ETIMEDOUT happens */
- if (err < 0)
- return err;
-
- /* The other errors happen in btusb_mtk_func_query */
- if (status < 0)
- return status;
-
- if (status == BTMTK_WMT_ON_DONE) {
- bt_dev_info(hdev, "function already on");
- goto ignore_func_on;
- }
-
- /* Enable Bluetooth protocol */
- param = 1;
- wmt_params.op = BTMTK_WMT_FUNC_CTRL;
- wmt_params.flag = 0;
- wmt_params.dlen = sizeof(param);
- wmt_params.data = ¶m;
- wmt_params.status = NULL;
-
- err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
- return err;
- }
-
-ignore_func_on:
- /* Apply the low power environment setup */
- tci_sleep.mode = 0x5;
- tci_sleep.duration = cpu_to_le16(0x640);
- tci_sleep.host_duration = cpu_to_le16(0x640);
- tci_sleep.host_wakeup_pin = 0;
- tci_sleep.time_compensation = 0;
-
- skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
- HCI_INIT_TIMEOUT);
- if (IS_ERR(skb)) {
- err = PTR_ERR(skb);
- bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
- return err;
- }
- kfree_skb(skb);
-
-done:
- rettime = ktime_get();
- delta = ktime_sub(rettime, calltime);
- duration = (unsigned long long)ktime_to_ns(delta) >> 10;
+ struct btmtk_data *btmtk_data = hci_get_priv(hdev);
- bt_dev_info(hdev, "Device setup in %llu usecs", duration);
+ /* MediaTek WMT vendor cmd requiring below USB resources to
+ * complete the handshake.
+ */
+ btmtk_data->drv_name = btusb_driver.name;
+ btmtk_data->intf = data->intf;
+ btmtk_data->udev = data->udev;
+ btmtk_data->ctrl_anchor = &data->ctrl_anchor;
+ btmtk_data->reset_sync = btusb_mtk_reset;
- return 0;
+ return btmtk_usb_setup(hdev);
}
static int btusb_mtk_shutdown(struct hci_dev *hdev)
{
- struct btmtk_hci_wmt_params wmt_params;
- u8 param = 0;
- int err;
-
- /* Disable the device */
- wmt_params.op = BTMTK_WMT_FUNC_CTRL;
- wmt_params.flag = 0;
- wmt_params.dlen = sizeof(param);
- wmt_params.data = ¶m;
- wmt_params.status = NULL;
-
- err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
- if (err < 0) {
- bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
- return err;
- }
-
- return 0;
+ return btmtk_usb_shutdown(hdev);
}
static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0012/1266] Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0011/1266] Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0013/1266] Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown Greg Kroah-Hartman
` (986 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Lu, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit 67dba2c28fe0af7e25ea1aeade677162ed05310a ]
Use usb_autopm_get_interface() and usb_autopm_put_interface()
in btmtk_usb_shutdown(), it could send func ctrl after enabling
autosuspend.
Bluetooth: btmtk_usb_hci_wmt_sync() hci0: Execution of wmt command
timed out
Bluetooth: btmtk_usb_shutdown() hci0: Failed to send wmt func ctrl
(-110)
Fixes: 5c5e8c52e3ca ("Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtk.c | 7 +++++++
net/bluetooth/rfcomm/tty.c | 4 ++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 8fd923de47c1f3..29d4a04ea0d46a 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -1140,10 +1140,15 @@ EXPORT_SYMBOL_GPL(btmtk_usb_setup);
int btmtk_usb_shutdown(struct hci_dev *hdev)
{
+ struct btmtk_data *data = hci_get_priv(hdev);
struct btmtk_hci_wmt_params wmt_params;
u8 param = 0;
int err;
+ err = usb_autopm_get_interface(data->intf);
+ if (err < 0)
+ return err;
+
/* Disable the device */
wmt_params.op = BTMTK_WMT_FUNC_CTRL;
wmt_params.flag = 0;
@@ -1154,9 +1159,11 @@ int btmtk_usb_shutdown(struct hci_dev *hdev)
err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
if (err < 0) {
bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
+ usb_autopm_put_interface(data->intf);
return err;
}
+ usb_autopm_put_interface(data->intf);
return 0;
}
EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 912e37cb8310c6..389d7b47ad6132 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -201,14 +201,14 @@ static ssize_t address_show(struct device *tty_dev,
struct device_attribute *attr, char *buf)
{
struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
- return sprintf(buf, "%pMR\n", &dev->dst);
+ return sysfs_emit(buf, "%pMR\n", &dev->dst);
}
static ssize_t channel_show(struct device *tty_dev,
struct device_attribute *attr, char *buf)
{
struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
- return sprintf(buf, "%d\n", dev->channel);
+ return sysfs_emit(buf, "%d\n", dev->channel);
}
static DEVICE_ATTR_RO(address);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0013/1266] Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0012/1266] Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0014/1266] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
` (985 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiande Lu, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiande Lu <jiande.lu@mediatek.com>
[ Upstream commit 099799fa9b76c5c02b49e07005a85117a25b01ea ]
During the shutdown process, an interrupt occurs that
prematurely terminates the wait for the expected event.
This change replaces TASK_INTERRUPTIBLE with
TASK_UNINTERRUPTIBLE in the wait_on_bit_timeout call to ensure
the shutdown process completes as intended without being
interrupted by signals.
Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Signed-off-by: Jiande Lu <jiande.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtk.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 29d4a04ea0d46a..bd28a2d52af169 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -640,12 +640,7 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
* WMT command.
*/
err = wait_on_bit_timeout(&data->flags, BTMTK_TX_WAIT_VND_EVT,
- TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
- if (err == -EINTR) {
- bt_dev_err(hdev, "Execution of wmt command interrupted");
- clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
- goto err_free_wc;
- }
+ TASK_UNINTERRUPTIBLE, HCI_INIT_TIMEOUT);
if (err) {
bt_dev_err(hdev, "Execution of wmt command timed out");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0014/1266] userfaultfd: gate must_wait writability check on pte_present()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0013/1266] Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0015/1266] perf: Fix dangling cgroup pointer in cpuctx backport Greg Kroah-Hartman
` (984 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau, Sashiko AI review,
Lorenzo Stoakes, David Hildenbrand, Michal Hocko, Mike Rapoport,
Peter Xu, Suren Baghdasaryan, Vlastimil Babka, Balbir Singh,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <kas@kernel.org>
[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]
userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE
without taking the page table lock and then apply pte_write() /
huge_pte_write() to it. Those accessors decode bits from the present
encoding only; on a swap or migration entry they read the offset bits that
happen to share the same position and return an undefined result.
The intent of the check is "is this fault still WP-blocked?". A
non-marker swap entry means the page is in transit -- the userfault
context the original fault delivered against is no longer the same, and
the swap-in or migration completion path will re-deliver a fresh fault if
userspace still needs to handle it. Worst case under the current code the
garbage write bit says "wait", and the thread stays asleep until a
UFFDIO_WAKE that may never arrive.
Gate the writability check on pte_present() so the lockless re-check only
inspects present-PTE bits when the entry is actually present. The
non-present, non-marker case returns "don't wait" and lets the fault path
retry.
Link: https://lore.kernel.org/20260529172331.356655-6-kas@kernel.org
Fixes: 369cd2121be4 ("userfaultfd: hugetlbfs: userfaultfd_huge_must_wait for hugepmd ranges")
Fixes: 63b2d4174c4a ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl")
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree
predates the marker/return-style refactor of these functions ]
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/userfaultfd.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 74c468cc432e7f..49f07426259818 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -300,7 +300,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
*/
if (huge_pte_none_mostly(pte))
ret = true;
- if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
+ /*
+ * Gate the writability check on pte_present(): huge_pte_write() on a
+ * non-present migration entry decodes random offset bits. The
+ * migration completion path re-delivers the fault if still needed.
+ */
+ if (pte_present(pte) && !huge_pte_write(pte) && (reason & VM_UFFD_WP))
ret = true;
out:
return ret;
@@ -375,7 +380,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
ptent = ptep_get(pte);
if (pte_none_mostly(ptent))
ret = true;
- if (!pte_write(ptent) && (reason & VM_UFFD_WP))
+ /*
+ * Gate the writability check on pte_present(): pte_write() on a
+ * non-present swap/migration entry decodes random offset bits. The
+ * page-in path re-delivers the fault if it still needs userspace.
+ */
+ if (pte_present(ptent) && !pte_write(ptent) && (reason & VM_UFFD_WP))
ret = true;
pte_unmap(pte);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0015/1266] perf: Fix dangling cgroup pointer in cpuctx backport
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0014/1266] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0016/1266] Bluetooth: btmtk: Fix btmtk.c undefined reference build error Greg Kroah-Hartman
` (983 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <guanwentao@uniontech.com>
recently backport of ("perf: Fix dangling cgroup pointer in cpuctx")
use a middle version, so aligned with the upstream commit:
commit 3b7a34aebbdf ("perf: Fix dangling cgroup pointer in cpuctx")
This is a fix for stable v6.6.143 backport commit, so no upstream commit.
Link: https://lore.kernel.org/all/2026070200-uneaten-smock-4130@gregkh/
Fixes: ae1ada0af162 ("perf: Fix dangling cgroup pointer in cpuctx")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index a4187dea6402a7..73a86db06cc9b1 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2384,10 +2384,9 @@ __perf_remove_from_context(struct perf_event *event,
*/
if (flags & DETACH_EXIT)
state = PERF_EVENT_STATE_EXIT;
- if (flags & DETACH_DEAD) {
- event->pending_disable = 1;
+ if (flags & DETACH_DEAD)
state = PERF_EVENT_STATE_DEAD;
- }
+
event_sched_out(event, ctx);
if (event->state > PERF_EVENT_STATE_OFF)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0016/1266] Bluetooth: btmtk: Fix btmtk.c undefined reference build error
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0015/1266] perf: Fix dangling cgroup pointer in cpuctx backport Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0017/1266] slimbus: qcom-ngd-ctrl: Fix probe error path ordering Greg Kroah-Hartman
` (982 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Chris Lu,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <chris.lu@mediatek.com>
[ Upstream commit f0c83a23fcbb424fdff5b38fbcdda3c04003a210 ]
MediaTek moved some usb interface related function to btmtk.c which
may cause build failed if BT USB Kconfig wasn't enabled.
Fix undefined reference by adding config check.
btmtk.c:(.text+0x89c): undefined reference to `usb_alloc_urb'
btmtk.c:(.text+0x8e3): undefined reference to `usb_free_urb'
btmtk.c:(.text+0x956): undefined reference to `usb_free_urb'
btmtk.c:(.text+0xa0e): undefined reference to `usb_anchor_urb'
btmtk.c:(.text+0xb43): undefined reference to `usb_autopm_get_interface'
btmtk.c:(.text+0xb7e): undefined reference to `usb_autopm_put_interface'
btmtk.c:(.text+0xf70): undefined reference to `usb_disable_autosuspend'
btmtk.c:(.text+0x133a): undefined reference to `usb_control_msg'
Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202407091928.AH0aGZnx-lkp@intel.com/
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtk.c | 2 ++
drivers/bluetooth/btmtk.h | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index bd28a2d52af169..ab68c2cbd79e5e 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -438,6 +438,7 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
}
EXPORT_SYMBOL_GPL(btmtk_process_coredump);
+#if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK)
static void btmtk_usb_wmt_recv(struct urb *urb)
{
struct hci_dev *hdev = urb->context;
@@ -1162,6 +1163,7 @@ int btmtk_usb_shutdown(struct hci_dev *hdev)
return 0;
}
EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
+#endif
MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
MODULE_AUTHOR("Mark Chen <mark-yw.chen@mediatek.com>");
diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h
index fe41528ae509bf..0acf8bd57c56e5 100644
--- a/drivers/bluetooth/btmtk.h
+++ b/drivers/bluetooth/btmtk.h
@@ -189,11 +189,13 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb);
void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
u32 fw_flavor);
+#if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK)
int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id);
int btmtk_usb_setup(struct hci_dev *hdev);
int btmtk_usb_shutdown(struct hci_dev *hdev);
+#endif
#else
static inline int btmtk_set_bdaddr(struct hci_dev *hdev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0017/1266] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0016/1266] Bluetooth: btmtk: Fix btmtk.c undefined reference build error Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0018/1266] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Greg Kroah-Hartman
` (981 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Mukesh Ojha,
Bjorn Andersson, Srinivas Kandagatla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]
qcom_slim_ngd_ctrl_probe() first registers the SSR callback then
allocates the PDR context, as such the error path needs to come in
opposite order to allow us to unroll each step.
Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index de1834d52cb831..6a3c1cf06b81a3 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1663,22 +1663,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
if (IS_ERR(ctrl->pdr)) {
ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
"Failed to init PDR handle\n");
- goto err_pdr_alloc;
+ goto err_unregister_ssr;
}
pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
- goto err_pdr_lookup;
+ goto err_pdr_release;
}
return of_qcom_slim_ngd_register(dev, ctrl);
-err_pdr_alloc:
- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
-
-err_pdr_lookup:
+err_pdr_release:
pdr_handle_release(ctrl->pdr);
+err_unregister_ssr:
+ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0018/1266] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0017/1266] slimbus: qcom-ngd-ctrl: Fix probe error path ordering Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0019/1266] slimbus: Convert to platform remove callback returning void Greg Kroah-Hartman
` (980 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Mukesh Ojha,
Bjorn Andersson, Srinivas Kandagatla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]
PDR and SSR callbacks are registred from the controller probe function,
but currently released from the child device's remove function.
The remove() function should only be unwinding what was done in the
same device's probe() function.
Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 6a3c1cf06b81a3..12643aaf164268 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1686,6 +1686,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
{
struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+ pdr_handle_release(ctrl->pdr);
+ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
qcom_slim_ngd_unregister(ctrl);
return 0;
@@ -1697,8 +1700,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- pdr_handle_release(ctrl->pdr);
- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
qcom_slim_ngd_enable(ctrl, false);
qcom_slim_ngd_exit_dma(ctrl);
qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0019/1266] slimbus: Convert to platform remove callback returning void
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0018/1266] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0020/1266] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Greg Kroah-Hartman
` (979 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Srinivas Kandagatla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().
Trivially convert the slimbus drivers from always returning zero in the
remove callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/qcom-ctrl.c | 5 ++---
drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++-------
2 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
index 400b7b385a443e..7d632fad13005f 100644
--- a/drivers/slimbus/qcom-ctrl.c
+++ b/drivers/slimbus/qcom-ctrl.c
@@ -626,7 +626,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
return ret;
}
-static int qcom_slim_remove(struct platform_device *pdev)
+static void qcom_slim_remove(struct platform_device *pdev)
{
struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
@@ -635,7 +635,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
clk_disable_unprepare(ctrl->rclk);
clk_disable_unprepare(ctrl->hclk);
destroy_workqueue(ctrl->rxwq);
- return 0;
}
/*
@@ -721,7 +720,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
static struct platform_driver qcom_slim_driver = {
.probe = qcom_slim_probe,
- .remove = qcom_slim_remove,
+ .remove_new = qcom_slim_remove,
.driver = {
.name = "qcom_slim_ctrl",
.of_match_table = qcom_slim_dt_match,
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 12643aaf164268..43bb5107259b71 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1682,7 +1682,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
return ret;
}
-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
{
struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
@@ -1690,11 +1690,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
qcom_slim_ngd_unregister(ctrl);
-
- return 0;
}
-static int qcom_slim_ngd_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_remove(struct platform_device *pdev)
{
struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
@@ -1708,7 +1706,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
kfree(ctrl->ngd);
ctrl->ngd = NULL;
- return 0;
}
static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
@@ -1751,7 +1748,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
static struct platform_driver qcom_slim_ngd_ctrl_driver = {
.probe = qcom_slim_ngd_ctrl_probe,
- .remove = qcom_slim_ngd_ctrl_remove,
+ .remove_new = qcom_slim_ngd_ctrl_remove,
.driver = {
.name = "qcom,slim-ngd-ctrl",
.of_match_table = qcom_slim_ngd_dt_match,
@@ -1760,7 +1757,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
static struct platform_driver qcom_slim_ngd_driver = {
.probe = qcom_slim_ngd_probe,
- .remove = qcom_slim_ngd_remove,
+ .remove_new = qcom_slim_ngd_remove,
.driver = {
.name = QCOM_SLIM_NGD_DRV_NAME,
.pm = &qcom_slim_ngd_dev_pm_ops,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0020/1266] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0019/1266] slimbus: Convert to platform remove callback returning void Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0021/1266] drm/amd: Fix set but not used warnings Greg Kroah-Hartman
` (978 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Bjorn Andersson,
Srinivas Kandagatla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]
When the remoteproc starts in parallel with the NGD driver being probed,
or the remoteproc is already up when the PDR lookup is being registered,
or in the theoretical event that we get an interrupt from the hardware,
these callbacks will operate on uninitialized data. This result in
issues to boot the affected boards.
One such example can be seen in the following fault, where
qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
[ 21.858578] ------------[ cut here ]------------
[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
...
[ 21.859251] Call trace:
[ 21.859255] __queue_work+0x5e0/0x790 (P)
[ 21.859265] queue_work_on+0x6c/0xf0
[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
[ 21.859318] notifier_call_chain+0xa4/0x230
[ 21.859329] srcu_notifier_call_chain+0x64/0xb8
[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common]
[ 21.859355] rproc_start+0x130/0x230
[ 21.859367] rproc_boot+0x3d4/0x518
...
Move the enablement of interrupts, and the registration of SSR and PDR
until after the NGD device has been registered.
This could be further refined by moving initialization to the control
driver probe and by removing the platform driver model from the picture.
Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Cc: stable@vger.kernel.org
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++--------------
1 file changed, 26 insertions(+), 19 deletions(-)
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 43bb5107259b71..3a09f244ee8b5a 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1612,6 +1612,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct qcom_slim_ngd_ctrl *ctrl;
+ int irq;
int ret;
struct pdr_service *pds;
@@ -1625,20 +1626,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
if (IS_ERR(ctrl->base))
return PTR_ERR(ctrl->base);
- ret = platform_get_irq(pdev, 0);
- if (ret < 0)
- return ret;
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0)
+ return irq;
- ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt,
- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
+ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
+ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
+ "slim-ngd", ctrl);
if (ret)
return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
- if (IS_ERR(ctrl->notifier))
- return PTR_ERR(ctrl->notifier);
-
ctrl->dev = dev;
ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;
ctrl->framer.superfreq =
@@ -1660,24 +1657,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
init_completion(&ctrl->qmi_up);
ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
- if (IS_ERR(ctrl->pdr)) {
- ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
- "Failed to init PDR handle\n");
- goto err_unregister_ssr;
- }
+ if (IS_ERR(ctrl->pdr))
+ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
+
+ ret = of_qcom_slim_ngd_register(dev, ctrl);
+ if (ret)
+ goto err_pdr_release;
pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
- goto err_pdr_release;
+ goto err_unregister_ngd;
+ }
+
+ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+ if (IS_ERR(ctrl->notifier)) {
+ ret = PTR_ERR(ctrl->notifier);
+ goto err_unregister_ngd;
}
- return of_qcom_slim_ngd_register(dev, ctrl);
+ enable_irq(irq);
+ return 0;
+
+err_unregister_ngd:
+ qcom_slim_ngd_unregister(ctrl);
err_pdr_release:
pdr_handle_release(ctrl->pdr);
-err_unregister_ssr:
- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0021/1266] drm/amd: Fix set but not used warnings
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0020/1266] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0022/1266] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
` (977 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Alex Deucher,
Ron Economos, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 46791d147d3ab3262298478106ef2a52fc7192e2 ]
There are many set but not used warnings under drivers/gpu/drm/amd when
compiling with the latest upstream mainline GCC:
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c:305:18: warning: variable ‘p’ set but not used [-Wunused-but-set-variable=]
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h:103:26: warning: variable ‘internal_reg_offset’ set but not used [-Wunused-but-set-variable=]
...
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h:164:26: warning: variable ‘internal_reg_offset’ set but not used [-Wunused-but-set-variable=]
...
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:445:13: warning: variable ‘pipe_idx’ set but not used [-Wunused-but-set-variable=]
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:875:21: warning: variable ‘pipe_idx’ set but not used [-Wunused-but-set-variable=]
Remove the variables actually not used or add __maybe_unused attribute for
the variables actually used to fix them, compile tested only.
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ron Economos <re@w6rz.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +---
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 3 ++-
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 11 ++++-------
3 files changed, 7 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index ea75c2b2bbb148..055aa0418a737e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -299,7 +299,6 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
int pages)
{
unsigned t;
- unsigned p;
int i, j;
u64 page_base;
/* Starting from VEGA10, system bit must be 0 to mean invalid. */
@@ -313,8 +312,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
return;
t = offset / AMDGPU_GPU_PAGE_SIZE;
- p = t / AMDGPU_GPU_PAGES_IN_CPU_PAGE;
- for (i = 0; i < pages; i++, p++) {
+ for (i = 0; i < pages; i++) {
page_base = adev->dummy_page_addr;
if (!adev->gart.ptr)
continue;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
index 3dc2cffdae4fca..ba45e85b23f1b7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
@@ -101,7 +101,8 @@
#define SOC15_DPG_MODE_OFFSET(ip, inst_idx, reg) \
({ \
- uint32_t internal_reg_offset, addr; \
+ /* To avoid a -Wunused-but-set-variable warning. */ \
+ uint32_t internal_reg_offset __maybe_unused, addr; \
bool video_range, video1_range, aon_range, aon1_range; \
\
addr = (adev->reg_offset[ip##_HWIP][inst_idx][reg##_BASE_IDX] + reg); \
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
index 4c5ef3ef8dbdd7..30a79dffbd37ab 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
@@ -322,7 +322,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru
int i = 0, k = 0;
int ramp_up_num_steps = 1; // TODO: Ramp is currently disabled. Reenable it.
uint8_t visual_confirm_enabled;
- int pipe_idx = 0;
if (dc == NULL)
return false;
@@ -336,7 +335,7 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru
cmd.fw_assisted_mclk_switch.config_data.visual_confirm_enabled = visual_confirm_enabled;
if (should_manage_pstate) {
- for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
+ for (i = 0; i < dc->res_pool->pipe_count; i++) {
struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
if (!pipe->stream)
@@ -350,7 +349,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru
cmd.fw_assisted_mclk_switch.config_data.vactive_stretch_margin_us = dc->debug.fpo_vactive_margin_us;
break;
}
- pipe_idx++;
}
}
@@ -714,7 +712,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,
bool enable)
{
uint8_t cmd_pipe_index = 0;
- uint32_t i, pipe_idx;
+ uint32_t i;
uint8_t subvp_count = 0;
union dmub_rb_cmd cmd;
struct pipe_ctx *subvp_pipes[2];
@@ -740,7 +738,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,
if (enable) {
// For each pipe that is a "main" SUBVP pipe, fill in pipe data for DMUB SUBVP cmd
- for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
+ for (i = 0; i < dc->res_pool->pipe_count; i++) {
struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
if (!pipe->stream)
@@ -763,7 +761,6 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,
populate_subvp_cmd_vblank_pipe_info(dc, context, &cmd, pipe, cmd_pipe_index++);
}
- pipe_idx++;
}
if (subvp_count == 2) {
update_subvp_prefetch_end_to_mall_start(dc, context, &cmd, subvp_pipes);
@@ -1054,4 +1051,4 @@ void dc_dmub_srv_enable_dpia_trace(const struct dc *dc)
}
DC_LOG_DEBUG("Enabled DPIA trace\n");
-}
\ No newline at end of file
+}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0022/1266] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0021/1266] drm/amd: Fix set but not used warnings Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0023/1266] device property: initialize the remaining fields of fwnode_handle in fwnode_init() Greg Kroah-Hartman
` (976 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]
A tunnel changelink() operates on at most two netns, dev_net(dev) and
the tunnel link netns t->net. They differ once the device is created in
or moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in
net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is
skipped when the link netns is dev_net(dev), where the rtnl path already
checked it. The other patches in this series use the same helper.
Gate ipgre_changelink() and erspan_changelink() with it, at the top of
the op before any attribute is parsed, because the parsers update live
tunnel fields first. ipgre_netlink_parms() sets t->collect_md before
ip_tunnel_changelink() runs.
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in
vti6_siocdevprivate().") added the same check on the ioctl path. This
adds it on RTM_NEWLINK.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: b57708add314 ("gre: add x-netns support")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/rtnetlink.h | 2 ++
net/core/rtnetlink.c | 8 ++++++++
net/ipv4/ip_gre.c | 6 ++++++
3 files changed, 16 insertions(+)
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -211,6 +211,8 @@ int rtnl_configure_link(struct net_devic
int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
struct netlink_ext_ack *exterr);
struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+ const struct net *link_net);
#define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2157,6 +2157,14 @@ struct net *rtnl_get_net_ns_capable(stru
}
EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+ const struct net *link_net)
+{
+ return net_eq(link_net, dev_net(dev)) ||
+ ns_capable(link_net->user_ns, CAP_NET_ADMIN);
+}
+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
+
static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
bool strict_check, struct nlattr **tb,
struct netlink_ext_ack *extack)
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1412,6 +1412,9 @@ static int ipgre_changelink(struct net_d
struct ip_tunnel_parm p;
int err;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;
@@ -1441,6 +1444,9 @@ static int erspan_changelink(struct net_
struct ip_tunnel_parm p;
int err;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0023/1266] device property: initialize the remaining fields of fwnode_handle in fwnode_init()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0022/1266] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0024/1266] f2fs: validate orphan inode entry count Greg Kroah-Hartman
` (975 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus,
Rafael J. Wysocki (Intel), Andy Shevchenko, Bartosz Golaszewski,
Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit 7eba000621fff223dd7bab484d48918c7c77a307 ]
If a firmware node is allocated on the stack (for instance: temporary
software node whose life-time we control) or on the heap - but using a
non-zeroing allocation function - and initialized using fwnode_init(),
its secondary pointer will contain uninitialized memory which likely
will be neither NULL nor IS_ERR() and so may end up being dereferenced
(for example: in dev_to_swnode()). Set fwnode->secondary to NULL on
initialization. While at it: initialize the remaining fields of struct
fwnode_handle too just to be sure.
Cc: stable@vger.kernel.org
Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()")
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260511074927.9473-1-bartosz.golaszewski@oss.qualcomm.com
[ Fix typo in commit message. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/fwnode.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -195,8 +195,10 @@ static inline void fwnode_init(struct fw
{
fwnode->secondary = NULL;
fwnode->ops = ops;
+ fwnode->dev = NULL;
INIT_LIST_HEAD(&fwnode->consumers);
INIT_LIST_HEAD(&fwnode->suppliers);
+ fwnode->flags = 0;
}
static inline void fwnode_set_flag(struct fwnode_handle *fwnode,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0024/1266] f2fs: validate orphan inode entry count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0023/1266] device property: initialize the remaining fields of fwnode_handle in fwnode_init() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0025/1266] f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Greg Kroah-Hartman
` (974 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when
replaying orphan inodes from the checkpoint pack. A corrupted entry_count
larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the
ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery
into f2fs_bug_on() and panic the kernel. Validate entry_count before
consuming entries so corrupted checkpoint data fails the mount with
-EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be
recorded in the superblock s_errors[] field. This gives fsck a persistent
hint even though mount-time orphan recovery failure may leave no chance to
persist SBI_NEED_FSCK through a checkpoint.
Cc: stable@kernel.org
Fixes: 127e670abfa7 ("f2fs: add checkpoint operations")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/checkpoint.c | 14 +++++++++++++-
include/linux/f2fs_fs.h | 1 +
2 files changed, 14 insertions(+), 1 deletion(-)
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -742,6 +742,7 @@ int f2fs_recover_orphan_inodes(struct f2
for (i = 0; i < orphan_blocks; i++) {
struct page *page;
struct f2fs_orphan_block *orphan_blk;
+ unsigned int entry_count;
page = f2fs_get_meta_page(sbi, start_blk + i);
if (IS_ERR(page)) {
@@ -750,7 +751,18 @@ int f2fs_recover_orphan_inodes(struct f2
}
orphan_blk = (struct f2fs_orphan_block *)page_address(page);
- for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
+ entry_count = le32_to_cpu(orphan_blk->entry_count);
+ if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+ f2fs_err(sbi, "invalid orphan inode entry count %u",
+ entry_count);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ f2fs_handle_error(sbi, ERROR_INCONSISTENT_ORPHAN);
+ err = -EFSCORRUPTED;
+ f2fs_put_page(page, 1);
+ goto out;
+ }
+
+ for (j = 0; j < entry_count; j++) {
nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
err = recover_orphan_inode(sbi, ino);
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -102,6 +102,7 @@ enum f2fs_error {
ERROR_CORRUPTED_XATTR,
ERROR_INVALID_NODE_REFERENCE,
ERROR_INCONSISTENT_NAT,
+ ERROR_INCONSISTENT_ORPHAN,
ERROR_MAX,
};
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0025/1266] f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0024/1266] f2fs: validate orphan inode entry count Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0026/1266] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
` (973 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Sunmin Jeong,
Chao Yu, Jaegeuk Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit e0288584baa5dc41df4a829a023c4c1b33fe53d7 ]
- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
- f2fs_gc
- gc_data_segment
- ra_data_block(cow_inode)
- mapping = F2FS_I(inode)->atomic_inode->i_mapping
: f2fs_is_cow_file(cow_inode) is true
- f2fs_evict_inode(atomic_inode)
- clear_inode_flag(fi->cow_inode, FI_COW_FILE)
- F2FS_I(fi->cow_inode)->atomic_inode = NULL
...
- truncate_inode_pages_final(atomic_inode)
- f2fs_grab_cache_folio(mapping)
: create folio in atomic_inode->mapping
- clear_inode(atomic_inode)
- BUG_ON(atomic_inode->i_data.nrpages)
We need to add a reference on fi->atomic_inode before using its mapping
field during garbage collection, otherwise, it will cause UAF issue.
Cc: stable@kernel.org
Cc: Daeho Jeong <daehojeong@google.com>
Cc: Sunmin Jeong <s_min.jeong@samsung.com>
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Fixes: f18d00769336 ("f2fs: use meta inode for GC of COW file")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 50 ++++++++++++++++++++++++++++++++++++++++++--------
fs/f2fs/inode.c | 11 ++++++++---
2 files changed, 50 insertions(+), 11 deletions(-)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1173,8 +1173,8 @@ static bool is_alive(struct f2fs_sb_info
static int ra_data_block(struct inode *inode, pgoff_t index)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
- struct address_space *mapping = f2fs_is_cow_file(inode) ?
- F2FS_I(inode)->atomic_inode->i_mapping : inode->i_mapping;
+ struct address_space *mapping = inode->i_mapping;
+ struct inode *atomic_inode = NULL;
struct dnode_of_data dn;
struct page *page;
struct f2fs_io_info fio = {
@@ -1189,9 +1189,22 @@ static int ra_data_block(struct inode *i
};
int err;
+ f2fs_down_read(&F2FS_I(inode)->i_sem);
+ if (f2fs_is_cow_file(inode)) {
+ atomic_inode = igrab(F2FS_I(inode)->atomic_inode);
+ if (!atomic_inode) {
+ f2fs_up_read(&F2FS_I(inode)->i_sem);
+ return -EBUSY;
+ }
+ mapping = atomic_inode->i_mapping;
+ }
+ f2fs_up_read(&F2FS_I(inode)->i_sem);
+
page = f2fs_grab_cache_page(mapping, index, true);
- if (!page)
- return -ENOMEM;
+ if (!page) {
+ err = -ENOMEM;
+ goto out_iput;
+ }
if (f2fs_lookup_read_extent_cache_block(inode, index,
&dn.data_blkaddr)) {
@@ -1250,11 +1263,16 @@ got_it:
f2fs_update_iostat(sbi, inode, FS_DATA_READ_IO, F2FS_BLKSIZE);
f2fs_update_iostat(sbi, NULL, FS_GDATA_READ_IO, F2FS_BLKSIZE);
+ if (atomic_inode)
+ iput(atomic_inode);
return 0;
put_encrypted_page:
f2fs_put_page(fio.encrypted_page, 1);
put_page:
f2fs_put_page(page, 1);
+out_iput:
+ if (atomic_inode)
+ iput(atomic_inode);
return err;
}
@@ -1265,8 +1283,8 @@ put_page:
static int move_data_block(struct inode *inode, block_t bidx,
int gc_type, unsigned int segno, int off)
{
- struct address_space *mapping = f2fs_is_cow_file(inode) ?
- F2FS_I(inode)->atomic_inode->i_mapping : inode->i_mapping;
+ struct address_space *mapping = inode->i_mapping;
+ struct inode *atomic_inode = NULL;
struct f2fs_io_info fio = {
.sbi = F2FS_I_SB(inode),
.ino = inode->i_ino,
@@ -1288,10 +1306,23 @@ static int move_data_block(struct inode
(fio.sbi->gc_mode != GC_URGENT_HIGH) ?
CURSEG_ALL_DATA_ATGC : CURSEG_COLD_DATA;
+ f2fs_down_read(&F2FS_I(inode)->i_sem);
+ if (f2fs_is_cow_file(inode)) {
+ atomic_inode = igrab(F2FS_I(inode)->atomic_inode);
+ if (!atomic_inode) {
+ f2fs_up_read(&F2FS_I(inode)->i_sem);
+ return -EBUSY;
+ }
+ mapping = atomic_inode->i_mapping;
+ }
+ f2fs_up_read(&F2FS_I(inode)->i_sem);
+
/* do not read out */
page = f2fs_grab_cache_page(mapping, bidx, false);
- if (!page)
- return -ENOMEM;
+ if (!page) {
+ err = -ENOMEM;
+ goto out_iput;
+ }
if (!check_valid_map(F2FS_I_SB(inode), segno, off)) {
err = -ENOENT;
@@ -1413,6 +1444,9 @@ put_out:
f2fs_put_dnode(&dn);
out:
f2fs_put_page(page, 1);
+out_iput:
+ if (atomic_inode)
+ iput(atomic_inode);
return err;
}
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -842,10 +842,15 @@ void f2fs_evict_inode(struct inode *inod
f2fs_abort_atomic_write(inode, true);
if (fi->cow_inode && f2fs_is_cow_file(fi->cow_inode)) {
- clear_inode_flag(fi->cow_inode, FI_COW_FILE);
- F2FS_I(fi->cow_inode)->atomic_inode = NULL;
- iput(fi->cow_inode);
+ struct inode *cow_inode = fi->cow_inode;
+
+ f2fs_down_write(&F2FS_I(cow_inode)->i_sem);
+ clear_inode_flag(cow_inode, FI_COW_FILE);
+ F2FS_I(cow_inode)->atomic_inode = NULL;
fi->cow_inode = NULL;
+ f2fs_up_write(&F2FS_I(cow_inode)->i_sem);
+
+ iput(cow_inode);
}
trace_f2fs_evict_inode(inode);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0026/1266] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0025/1266] f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0027/1266] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
` (972 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]
When the flexible_inline_xattr feature is enabled, do_read_inode() loads
the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi))
fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the
FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
data but not FI_INLINE_XATTR -- the normal layout for an inline
directory -- therefore keeps a fully attacker-controlled
i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it
feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)
NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
negative, so make_dentry_ptr_inline() sets d->max (int) to a negative
value. The inline directory walk then compares an unsigned long bit_pos
against that negative d->max, which is promoted to a huge unsigned bound,
and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */
... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an
out-of-bounds read in f2fs_fill_dentries(); the same underflow also
corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
flexible_inline_xattr feature is enabled -- i.e. whenever the value is
loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE
bound gated on inodes that actually carry an inline xattr, so legitimate
inodes with i_inline_xattr_size == 0 are still accepted.
Cc: stable@vger.kernel.org
Fixes: 6afc662e68b5 ("f2fs: support flexible inline xattr size")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/inode.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -307,15 +307,6 @@ static bool sanity_check_inode(struct in
F2FS_TOTAL_EXTRA_ATTR_SIZE);
return false;
}
- if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
- f2fs_has_inline_xattr(inode) &&
- (!fi->i_inline_xattr_size ||
- fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
- f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %zu",
- __func__, inode->i_ino, fi->i_inline_xattr_size,
- MAX_INLINE_XATTR_SIZE);
- return false;
- }
if (f2fs_sb_has_compression(sbi) &&
fi->i_flags & F2FS_COMPR_FL &&
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
@@ -329,6 +320,16 @@ static bool sanity_check_inode(struct in
return false;
}
+ if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
+ (fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE ||
+ (f2fs_has_inline_xattr(inode) &&
+ fi->i_inline_xattr_size < MIN_INLINE_XATTR_SIZE))) {
+ f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %zu",
+ __func__, inode->i_ino, fi->i_inline_xattr_size,
+ MIN_INLINE_XATTR_SIZE, MAX_INLINE_XATTR_SIZE);
+ return false;
+ }
+
if (!f2fs_sb_has_extra_attr(sbi)) {
if (f2fs_sb_has_project_quota(sbi)) {
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0027/1266] f2fs: fix potential deadlock in f2fs_balance_fs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0026/1266] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0028/1266] f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Greg Kroah-Hartman
` (971 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Yu, Ruipeng Qi, Jaegeuk Kim,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruipeng Qi <ruipengqi3@gmail.com>
[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]
When the f2fs filesystem space is nearly exhausted, we encounter deadlock
issues as below:
INFO: task A:1890 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:A state:D stack:0 pid:1890 tgid:1626 ppid:1153 flags:0x00000204
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
folio_wait_bit+0x20/0x38
folio_wait_writeback+0x54/0xc8
truncate_inode_partial_folio+0x70/0x1e0
truncate_inode_pages_range+0x1b0/0x450
truncate_pagecache+0x54/0x88
f2fs_file_write_iter+0x3e8/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11 state:D stack:0 pid:2680853 tgid:2680853 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
__filemap_get_folio+0x214/0x348
pagecache_get_page+0x20/0x70
f2fs_get_read_data_page+0x150/0x3e8
f2fs_get_lock_data_page+0x2c/0x160
move_data_page+0x50/0x478
do_garbage_collect+0xd38/0x1528
f2fs_gc+0x240/0x7e0
f2fs_balance_fs+0x1a0/0x208
f2fs_write_single_data_page+0x6e4/0x730
f2fs_write_cache_pages+0x378/0x9b0
f2fs_write_data_pages+0x2e4/0x388
do_writepages+0x8c/0x2c8
__writeback_single_inode+0x4c/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x200
INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8 state:D stack:0 pid:2641297 tgid:2641297 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_write_inode+0xf4/0x328
__writeback_single_inode+0x370/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x20
INFO: task B:1902 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:B state:D stack:0 pid:1902 tgid:1626 ppid:1153 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_map_blocks+0x94c/0x1110
f2fs_file_write_iter+0x228/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task sync:2769849 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:sync state:D stack:0 pid:2769849 tgid:2769849 ppid:736 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
wb_wait_for_completion+0xb0/0xe8
sync_inodes_sb+0xc8/0x2b0
sync_inodes_one_sb+0x24/0x38
iterate_supers+0xa8/0x138
ksys_sync+0x54/0xc8
__arm64_sys_sync+0x18/0x30
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
The root cause is a potential deadlock between the following tasks:
kworker/u8:11 Thread A
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback(X)
- f2fs_outplace_write_data
- bio_add_folio(X)
- folio_unlock(X)
- truncate_inode_pages_range
- __filemap_get_folio(X, FGP_LOCK)
- truncate_inode_partial_folio(X)
- folio_wait_writeback(X)
- f2fs_balance_fs
- f2fs_gc
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_page
- __filemap_get_folio(X, FGP_LOCK)
Both threads try to access folio X. Thread A holds the lock but waits
for writeback, while kworker waits for the lock. This causes a deadlock.
Other threads also enter D state, waiting for locks such as gc_lock and
writepages.
OPU/IPU DATA folio are all affected by this issue. To avoid such
potential deadlocks, always commit these cached folios before
triggering f2fs_gc() in f2fs_balance_fs().
Suggested-by: Chao Yu <chao@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 29 +++++++++++++++++++++++++++++
fs/f2fs/f2fs.h | 1 +
fs/f2fs/segment.c | 8 ++++++++
3 files changed, 38 insertions(+)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -887,6 +887,35 @@ void f2fs_submit_merged_ipu_write(struct
}
}
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi)
+{
+ struct bio_entry *be, *tmp;
+ struct f2fs_bio_info *io;
+ enum temp_type temp;
+
+ for (temp = HOT; temp < NR_TEMP_TYPE; temp++) {
+ LIST_HEAD(list);
+
+ io = sbi->write_io[DATA] + temp;
+
+ /* A lockless list_empty() check is safe here: any bios from
+ * other kworkers that we miss will be submitted by those
+ * kworkers accordingly.
+ */
+ if (list_empty(&io->bio_list))
+ continue;
+
+ f2fs_down_write(&io->bio_list_lock);
+ list_splice_init(&io->bio_list, &list);
+ f2fs_up_write(&io->bio_list_lock);
+
+ list_for_each_entry_safe(be, tmp, &list, list) {
+ f2fs_submit_write_bio(sbi, be->bio, DATA);
+ del_bio_entry(be);
+ }
+ }
+}
+
int f2fs_merge_page_bio(struct f2fs_io_info *fio)
{
struct bio *bio = *fio->bio;
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3866,6 +3866,7 @@ void f2fs_submit_merged_write_cond(struc
nid_t ino, enum page_type type);
void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
struct bio **bio, struct page *page);
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi);
void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
int f2fs_submit_page_bio(struct f2fs_io_info *fio);
int f2fs_merge_page_bio(struct f2fs_io_info *fio);
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -450,6 +450,14 @@ void f2fs_balance_fs(struct f2fs_sb_info
.should_migrate_blocks = false,
.err_gc_skipped = false,
.nr_free_secs = 1 };
+
+ /*
+ * Submit all cached OPU/IPU DATA bios before triggering
+ * foreground GC to avoid potential deadlocks.
+ */
+ f2fs_submit_merged_write(sbi, DATA);
+ f2fs_submit_all_merged_ipu_writes(sbi);
+
f2fs_down_write(&sbi->gc_lock);
stat_inc_gc_call_count(sbi, FOREGROUND);
f2fs_gc(sbi, &gc_control);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0028/1266] f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0027/1266] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0029/1266] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
` (970 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ruipeng Qi, Chao Yu, Chao Yu,
Jaegeuk Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 8b4468ec023d0d1b4669dfb867588997cc03a06b ]
When we mount device w/ gc_merge mount option, we may suffer below
potential deadlock:
Kworker GC trehad Truncator
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback --- set writeback flag on folio
- f2fs_outplace_write_data
: cached folio in internal bio cache
- f2fs_balance_fs
- wake_up(gc_thread)
: wake up gc thread to run foreground GC
- finish_wait(fggc_wq)
: wait on the waitqueue --- wait on GC thread to finish the work
- truncate_inode_pages_range
- __filemap_get_folio(, FGP_LOCK) --- lock folio
- truncate_inode_partial_folio
- folio_wait_writeback --- wait on writeback being cleared
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_folio
- lock on folio --- blocked on folio's lock
In order to avoid such deadlock, let's call below functions to commit
cached bios in GC_MERGE path of f2fs_balance_fs() as the same as we did
in NOGC_MERGE path.
- f2fs_submit_merged_write(sbi, DATA);
- f2fs_submit_all_merged_ipu_writes(sbi);
Cc: stable@kernel.org
Fixes: 351df4b20115 ("f2fs: add segment operations")
Cc: Ruipeng Qi <ruipengqi3@gmail.com>
Reported: Sandeep Dhavale <dhavale@google.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Chao Yu <chaseyu@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/segment.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -433,6 +433,13 @@ void f2fs_balance_fs(struct f2fs_sb_info
if (has_enough_free_secs(sbi, 0, 0))
return;
+ /*
+ * Submit all cached OPU/IPU DATA bios before triggering
+ * foreground GC to avoid potential deadlocks.
+ */
+ f2fs_submit_merged_write(sbi, DATA);
+ f2fs_submit_all_merged_ipu_writes(sbi);
+
if (test_opt(sbi, GC_MERGE) && sbi->gc_thread &&
sbi->gc_thread->f2fs_gc_task) {
DEFINE_WAIT(wait);
@@ -451,13 +458,6 @@ void f2fs_balance_fs(struct f2fs_sb_info
.err_gc_skipped = false,
.nr_free_secs = 1 };
- /*
- * Submit all cached OPU/IPU DATA bios before triggering
- * foreground GC to avoid potential deadlocks.
- */
- f2fs_submit_merged_write(sbi, DATA);
- f2fs_submit_all_merged_ipu_writes(sbi);
-
f2fs_down_write(&sbi->gc_lock);
stat_inc_gc_call_count(sbi, FOREGROUND);
f2fs_gc(sbi, &gc_control);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0029/1266] f2fs: fix listxattr handling of corrupted xattr entries
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0028/1266] f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0030/1266] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
` (969 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Keshav Verma,
Jaegeuk Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keshav Verma <iganschel@gmail.com>
[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]
Validate the xattr entry before reading its fields in f2fs_listxattr().
Return -EFSCORRUPTED when the entry is outside the valid xattr storage
area instead of returning a successful partial result.
Fixes: 688078e7f36c ("f2fs: fix to avoid memory leakage in f2fs_listxattr")
Cc: stable@kernel.org
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Keshav Verma <iganschel@gmail.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/xattr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -581,8 +581,6 @@ ssize_t f2fs_listxattr(struct dentry *de
size_t prefix_len;
size_t size;
- prefix = f2fs_xattr_prefix(entry->e_name_index, dentry);
-
if ((void *)(entry) + sizeof(__u32) > last_base_addr ||
(void *)XATTR_NEXT_ENTRY(entry) > last_base_addr) {
f2fs_err(F2FS_I_SB(inode), "list inode (%lu) has corrupted xattr",
@@ -590,9 +588,11 @@ ssize_t f2fs_listxattr(struct dentry *de
set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
f2fs_handle_error(F2FS_I_SB(inode),
ERROR_CORRUPTED_XATTR);
- break;
+ error = -EFSCORRUPTED;
+ goto cleanup;
}
+ prefix = f2fs_xattr_prefix(entry->e_name_index, dentry);
if (!prefix)
continue;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0030/1266] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0029/1266] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0031/1266] block: Avoid mounting the bdev pseudo-filesystem in userspace Greg Kroah-Hartman
` (968 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Paolo Bonzini,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit f1edbed787ba67988ed34e0132ca128b052b6ce8 ]
Drop a BUG_ON() that has been reachable since it was first added, way back
in 2009, and instead use get_unaligned() to perform potentially-unaligned
accesses.
For a given store, KVM x86's emulator tracks the entire value in the
destination operand, x86_emulate_ctxt.dst. If the destination is memory,
and the target splits multiple pages and/or is emulated MMIO, then KVM
handles each fragment independently. E.g. on a page split starting at page
offset 0xffc, KVM writes 4 bytes to the first page, then the remaining
bytes to the second page, using ctxt->dst as the source for both (with
appropriate offsets).
If the destination splits a page *and* hits emulated MMIO on the second
page, then KVM will complete the write to the first page, then emulate the
MMIO access to the second page. If there is a datamatch-enabled ioeventfd
at offset 0 of the second page, then KVM will process the remainder of the
store as a potential ioeventfd signal.
Putting it all together, if the guest emits a store that splits a page
starting at page offset N, and the second page has a datamatch-enabled
ioeventfd at offset 0, then KVM will check for datamatch using
&dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being
32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.
E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,
all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()
fires due to @val being 4-byte aligned, but not 8-byte aligned.
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
Call Trace:
<TASK>
__kvm_io_bus_write+0x85/0xb0 [kvm]
kvm_io_bus_write+0x53/0x80 [kvm]
vcpu_mmio_write+0x66/0xf0 [kvm]
emulator_read_write_onepage+0x12a/0x540 [kvm]
emulator_read_write+0x109/0x2b0 [kvm]
x86_emulate_insn+0x4f8/0xfb0 [kvm]
x86_emulate_instruction+0x181/0x790 [kvm]
kvm_mmu_page_fault+0x313/0x630 [kvm]
vmx_handle_exit+0x18a/0x590 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb7/0x890
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f19c931a9bf
</TASK>
Modules linked in: kvm_intel kvm irqbypass
---[ end trace 0000000000000000 ]---
In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM
x86 doesn't perform alignment checks on "normal" memory accesses at CPL0.
Sadly, C99 ruins all the fun; while the x86 architecture plays nice,
dereferencing an unaligned pointer directly is undefined behavior in C,
e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.
Fixes: d34e6b175e61 ("KVM: add ioeventfd support")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260612225241.678509-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ Adjusted context to use `#include <asm/unaligned.h>` since `linux/unaligned.h` doesn't exist in 6.6. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/eventfd.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -24,6 +24,7 @@
#include <linux/slab.h>
#include <linux/seqlock.h>
#include <linux/irqbypass.h>
+#include <asm/unaligned.h>
#include <trace/events/kvm.h>
#include <kvm/iodev.h>
@@ -757,21 +758,18 @@ ioeventfd_in_range(struct _ioeventfd *p,
return true;
/* otherwise, we have to actually compare the data */
-
- BUG_ON(!IS_ALIGNED((unsigned long)val, len));
-
switch (len) {
case 1:
- _val = *(u8 *)val;
+ _val = get_unaligned((u8 *)val);
break;
case 2:
- _val = *(u16 *)val;
+ _val = get_unaligned((u16 *)val);
break;
case 4:
- _val = *(u32 *)val;
+ _val = get_unaligned((u32 *)val);
break;
case 8:
- _val = *(u64 *)val;
+ _val = get_unaligned((u64 *)val);
break;
default:
return false;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0031/1266] block: Avoid mounting the bdev pseudo-filesystem in userspace
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0030/1266] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0032/1266] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
` (967 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Denis Arefev, Christoph Hellwig,
Jens Axboe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <arefev@swemel.ru>
[ Upstream commit f73aa66dffcb8e61e78f01b56163ec16a15d06d2 ]
The bdev pseudo-filesystem is an internal kernel filesystem with which
userspace should not interfere. Unregister it so that userspace cannot
even attempt to mount it.
This fixes a bug [1] that occurs when attempting to access files,
because the system call move_mount() uses pointers declared in the
inode_operations structure, which for the bdev pseudo-filesystem
are always equal to 0. `inode->i_op = &empty_iops;`
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 23380067 P4D 23380067 PUD 23381067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:0x0
Call Trace:
<TASK>
lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460
open_last_lookups fs/namei.c:3550 [inline]
path_openat+0x953/0x2700 fs/namei.c:3780
do_filp_open+0x1c5/0x410 fs/namei.c:3810
do_sys_openat2+0x171/0x4d0 fs/open.c:1318
do_sys_open fs/open.c:1334 [inline]
__do_sys_openat fs/open.c:1350 [inline]
__se_sys_openat fs/open.c:1345 [inline]
__x64_sys_openat+0x13c/0x1f0 fs/open.c:1345
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/all/20131010004732.GJ13318@ZenIV.linux.org.uk/T/#
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260521072857.5078-1-arefev@swemel.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/bdev.c | 4 ----
1 file changed, 4 deletions(-)
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -383,16 +383,12 @@ EXPORT_SYMBOL_GPL(blockdev_superblock);
void __init bdev_cache_init(void)
{
- int err;
static struct vfsmount *bd_mnt;
bdev_cachep = kmem_cache_create("bdev_cache", sizeof(struct bdev_inode),
0, (SLAB_HWCACHE_ALIGN|SLAB_RECLAIM_ACCOUNT|
SLAB_MEM_SPREAD|SLAB_ACCOUNT|SLAB_PANIC),
init_once);
- err = register_filesystem(&bd_type);
- if (err)
- panic("Cannot register bdev pseudo-fs");
bd_mnt = kern_mount(&bd_type);
if (IS_ERR(bd_mnt))
panic("Cannot create bdev pseudo-fs");
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0032/1266] i2c: core: fix irq domain leak on adapter registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0031/1266] block: Avoid mounting the bdev pseudo-filesystem in userspace Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0033/1266] i2c: core: fix hang " Greg Kroah-Hartman
` (966 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Johan Hovold,
Wolfram Sang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 8ce19524e4cc2462685f596a6402fbd8fb984ab2 ]
Make sure to tear down the host notify irq domain on adapter
registration failure to avoid leaking it.
This issue was flagged by Sashiko when reviewing another adapter
registration fix.
Fixes: 4d5538f5882a ("i2c: use an IRQ to report Host Notify events, not alert")
Cc: stable@vger.kernel.org # 4.10
Cc: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1551,7 +1551,7 @@ static int i2c_register_adapter(struct i
res = device_register(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto out_list;
+ goto err_remove_irq_domain;
}
adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
@@ -1599,6 +1599,8 @@ out_reg:
init_completion(&adap->dev_released);
device_unregister(&adap->dev);
wait_for_completion(&adap->dev_released);
+err_remove_irq_domain:
+ i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
idr_remove(&i2c_adapter_idr, adap->nr);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0033/1266] i2c: core: fix hang on adapter registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0032/1266] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0034/1266] i2c: core: fix NULL-deref " Greg Kroah-Hartman
` (965 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phil Reid, Johan Hovold,
Wolfram Sang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 3c7e164344e5bcf6f274bbf59a3274f5caad9bc1 ]
Clients may be registered from bus notifier callbacks when the adapter
is registered. On a subsequent error during registration, the adapter
references taken by such clients prevent the wait for the references to
be released from ever completing.
Fix this by refactoring client deregistration and deregistering also on
late adapter registration failures.
Fixes: f8756c67b3de ("i2c: core: call of_i2c_setup_smbus_alert in i2c_register_adapter")
Cc: stable@vger.kernel.org # 4.15
Cc: Phil Reid <preid@electromag.com.au>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 49 ++++++++++++++++++++++++++------------------
1 file changed, 29 insertions(+), 20 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -63,6 +63,7 @@
static DEFINE_MUTEX(core_lock);
static DEFINE_IDR(i2c_adapter_idr);
+static void i2c_deregister_clients(struct i2c_adapter *adap);
static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver);
static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key);
@@ -1595,6 +1596,7 @@ static int i2c_register_adapter(struct i
return 0;
out_reg:
+ i2c_deregister_clients(adap);
debugfs_remove_recursive(adap->debugfs);
init_completion(&adap->dev_released);
device_unregister(&adap->dev);
@@ -1738,29 +1740,10 @@ static int __process_removed_adapter(str
return 0;
}
-/**
- * i2c_del_adapter - unregister I2C adapter
- * @adap: the adapter being unregistered
- * Context: can sleep
- *
- * This unregisters an I2C adapter which was previously registered
- * by @i2c_add_adapter or @i2c_add_numbered_adapter.
- */
-void i2c_del_adapter(struct i2c_adapter *adap)
+static void i2c_deregister_clients(struct i2c_adapter *adap)
{
- struct i2c_adapter *found;
struct i2c_client *client, *next;
- /* First make sure that this adapter was ever added */
- mutex_lock(&core_lock);
- found = idr_find(&i2c_adapter_idr, adap->nr);
- mutex_unlock(&core_lock);
- if (found != adap) {
- pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
- return;
- }
-
- i2c_acpi_remove_space_handler(adap);
/* Tell drivers about this removal */
mutex_lock(&core_lock);
bus_for_each_drv(&i2c_bus_type, NULL, adap,
@@ -1786,6 +1769,32 @@ void i2c_del_adapter(struct i2c_adapter
* them up properly, so we give them a chance to do that first. */
device_for_each_child(&adap->dev, NULL, __unregister_client);
device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+}
+
+/**
+ * i2c_del_adapter - unregister I2C adapter
+ * @adap: the adapter being unregistered
+ * Context: can sleep
+ *
+ * This unregisters an I2C adapter which was previously registered
+ * by @i2c_add_adapter or @i2c_add_numbered_adapter.
+ */
+void i2c_del_adapter(struct i2c_adapter *adap)
+{
+ struct i2c_adapter *found;
+
+ /* First make sure that this adapter was ever added */
+ mutex_lock(&core_lock);
+ found = idr_find(&i2c_adapter_idr, adap->nr);
+ mutex_unlock(&core_lock);
+ if (found != adap) {
+ pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
+ return;
+ }
+
+ i2c_acpi_remove_space_handler(adap);
+
+ i2c_deregister_clients(adap);
#ifdef CONFIG_I2C_COMPAT
class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0034/1266] i2c: core: fix NULL-deref on adapter registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0033/1266] i2c: core: fix hang " Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0035/1266] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
` (964 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Hattori, Johan Hovold,
Wolfram Sang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 2295d2bb101faa663fbc45fadbb3fec45f107441 ]
If adapter registration ever fails the release callback would trigger a
NULL-pointer dereference as the completion struct has not been
initialised.
Note that before the offending commit this would instead have resulted
in a minor memory leak of the adapter name.
Fixes: 3f8c4f5e9a57 ("i2c: core: fix reference leak in i2c_register_adapter()")
Cc: stable@vger.kernel.org
Cc: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1552,7 +1552,7 @@ static int i2c_register_adapter(struct i
res = device_register(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto err_remove_irq_domain;
+ goto err_put_adap;
}
adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
@@ -1598,10 +1598,12 @@ static int i2c_register_adapter(struct i
out_reg:
i2c_deregister_clients(adap);
debugfs_remove_recursive(adap->debugfs);
+ device_del(&adap->dev);
+err_put_adap:
init_completion(&adap->dev_released);
- device_unregister(&adap->dev);
+ put_device(&adap->dev);
wait_for_completion(&adap->dev_released);
-err_remove_irq_domain:
+
i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0035/1266] i2c: core: fix adapter debugfs creation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0034/1266] i2c: core: fix NULL-deref " Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0036/1266] i2c: core: fix adapter registration race Greg Kroah-Hartman
` (963 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Johan Hovold,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 07d5fb537928aad4369aaff0cbae73ba38a719af ]
Clients can be registered from bus notifier callbacks so the debugfs
directory needs to be created before registering the adapter as clients
use that directory as their debugfs parent.
Move debugfs creation before adapter registration to avoid having
clients create their debugfs directories in the debugfs root (which is
also more likely to fail due to name collisions).
Note that failure to allocate the adapter name must now be handled
explicitly as debugfs_create_dir() cannot handle a NULL name (unlike
device_add() which returns an error).
Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
Cc: stable@vger.kernel.org # 6.8
Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1546,17 +1546,22 @@ static int i2c_register_adapter(struct i
goto out_list;
}
- dev_set_name(&adap->dev, "i2c-%d", adap->nr);
+ res = dev_set_name(&adap->dev, "i2c-%d", adap->nr);
+ if (res)
+ goto err_remove_irq_domain;
+
adap->dev.bus = &i2c_bus_type;
adap->dev.type = &i2c_adapter_type;
- res = device_register(&adap->dev);
+ device_initialize(&adap->dev);
+
+ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+
+ res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto err_put_adap;
+ goto err_remove_debugfs;
}
- adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
-
res = i2c_setup_smbus_alert(adap);
if (res)
goto out_reg;
@@ -1597,13 +1602,13 @@ static int i2c_register_adapter(struct i
out_reg:
i2c_deregister_clients(adap);
- debugfs_remove_recursive(adap->debugfs);
device_del(&adap->dev);
-err_put_adap:
+err_remove_debugfs:
+ debugfs_remove_recursive(adap->debugfs);
init_completion(&adap->dev_released);
put_device(&adap->dev);
wait_for_completion(&adap->dev_released);
-
+err_remove_irq_domain:
i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0036/1266] i2c: core: fix adapter registration race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0035/1266] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0037/1266] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
` (962 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Wolfram Sang,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit ba14d7cf2fe7284610a29854bdff22b2537d3ce6 ]
Adapters can be looked up based on their id using i2c_get_adapter()
which takes a reference to the embedded struct device.
Make sure that the adapter (including its struct device) has been
initialised before adding it to the IDR to avoid accessing uninitialised
data which could, for example, lead to NULL-pointer dereferences or
use-after-free.
Note that the i2c-dev chardev, which is registered from a bus notifier,
currently uses i2c_get_adapter() so the adapter needs to be added to the
IDR before registration.
Fixes: 6e13e6418418 ("i2c: Add i2c_add_numbered_adapter()")
Cc: stable@vger.kernel.org # 2.6.22
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1556,6 +1556,10 @@ static int i2c_register_adapter(struct i
adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
+ mutex_lock(&core_lock);
+ idr_replace(&i2c_adapter_idr, adap, adap->nr);
+ mutex_unlock(&core_lock);
+
res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
@@ -1629,7 +1633,7 @@ static int __i2c_add_numbered_adapter(st
int id;
mutex_lock(&core_lock);
- id = idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1, GFP_KERNEL);
+ id = idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERNEL);
mutex_unlock(&core_lock);
if (WARN(id < 0, "couldn't get idr"))
return id == -ENOSPC ? -EBUSY : id;
@@ -1665,7 +1669,7 @@ int i2c_add_adapter(struct i2c_adapter *
}
mutex_lock(&core_lock);
- id = idr_alloc(&i2c_adapter_idr, adapter,
+ id = idr_alloc(&i2c_adapter_idr, NULL,
__i2c_first_dynamic_bus_num, 0, GFP_KERNEL);
mutex_unlock(&core_lock);
if (WARN(id < 0, "couldn't get idr"))
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0037/1266] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0036/1266] i2c: core: fix adapter registration race Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0038/1266] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
` (961 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mingyu Wang, Thomas Zimmermann,
Helge Deller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
[ Upstream commit 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 ]
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.
Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2418,6 +2418,7 @@ static int fbcon_do_set_font(struct vc_d
struct fbcon_display *p = &fb_display[vc->vc_num];
int resize, ret, old_userfont, old_width, old_height, old_charcount;
u8 *old_data = vc->vc_font.data;
+ unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
vc->vc_font.data = (void *)(p->fontdata = data);
@@ -2471,6 +2472,12 @@ err_out:
vc->vc_font.height = old_height;
vc->vc_font.charcount = old_charcount;
+ /* Restore the hi_font state and screen buffer */
+ if (old_hi_font_mask && !vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, true);
+ else if (!old_hi_font_mask && vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, false);
+
return ret;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0038/1266] NFSv4/flexfiles: reject zero filehandle version count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0037/1266] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0039/1266] nfsd: Dont reset the write verifier on a commit EAGAIN Greg Kroah-Hartman
` (960 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 ]
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
ff_layout_encode_layoutreturn+0x683/0x970
nfs4_xdr_enc_layoutreturn+0x278/0x3a0
Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic,
and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
Cc: stable@vger.kernel.org
Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -460,6 +460,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_
if (!p)
goto out_err_free;
fh_count = be32_to_cpup(p);
+ if (fh_count == 0) {
+ rc = -EINVAL;
+ goto out_err_free;
+ }
fls->mirror_array[i]->fh_versions =
kcalloc(fh_count, sizeof(struct nfs_fh),
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0039/1266] nfsd: Dont reset the write verifier on a commit EAGAIN
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0038/1266] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0040/1266] apparmor: advertise the tcp fast open fix is applied Greg Kroah-Hartman
` (959 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Jeff Layton,
Chuck Lever, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 1b2021bdeeca12364ad0fa7aac9ddba5cae964f3 ]
If fsync() is returning EAGAIN, then we can assume that the filesystem
being exported is something like NFS with the 'softerr' mount option
enabled, and that it is just asking us to replay the fsync() operation
at a later date.
If we see an ESTALE, then ditto: the file is gone, so there is no danger
of losing the error.
For those cases, do not reset the write verifier. A write verifier
change has a global effect, causing retransmission by all clients of
all uncommitted unstable writes for all files, so it is worth
mitigating where possible.
Link: https://lore.kernel.org/linux-nfs/20230911184357.11739-1-trond.myklebust@hammerspace.com/
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: 2090b05803fa ("nfsd: reset write verifier on deferred writeback errors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -338,6 +338,24 @@ out:
return err;
}
+static void
+commit_reset_write_verifier(struct nfsd_net *nn, struct svc_rqst *rqstp,
+ int err)
+{
+ switch (err) {
+ case -EAGAIN:
+ case -ESTALE:
+ /*
+ * Neither of these are the result of a problem with
+ * durable storage, so avoid a write verifier reset.
+ */
+ break;
+ default:
+ nfsd_reset_write_verifier(nn);
+ trace_nfsd_writeverf_reset(nn, rqstp, err);
+ }
+}
+
/*
* Commit metadata changes to stable storage.
*/
@@ -659,8 +677,7 @@ __be32 nfsd4_clone_file_range(struct svc
&nfsd4_get_cstate(rqstp)->current_fh,
dst_pos,
count, status);
- nfsd_reset_write_verifier(nn);
- trace_nfsd_writeverf_reset(nn, rqstp, status);
+ commit_reset_write_verifier(nn, rqstp, status);
ret = nfserrno(status);
}
}
@@ -1177,8 +1194,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
host_err = vfs_iter_write(file, &iter, &pos, flags);
file_end_write(file);
if (host_err < 0) {
- nfsd_reset_write_verifier(nn);
- trace_nfsd_writeverf_reset(nn, rqstp, host_err);
+ commit_reset_write_verifier(nn, rqstp, host_err);
goto out_nfserr;
}
*cnt = host_err;
@@ -1193,10 +1209,8 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
if (stable && use_wgather) {
host_err = wait_for_concurrent_writes(file);
- if (host_err < 0) {
- nfsd_reset_write_verifier(nn);
- trace_nfsd_writeverf_reset(nn, rqstp, host_err);
- }
+ if (host_err < 0)
+ commit_reset_write_verifier(nn, rqstp, host_err);
}
out_nfserr:
@@ -1343,8 +1357,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru
err = nfserr_notsupp;
break;
default:
- nfsd_reset_write_verifier(nn);
- trace_nfsd_writeverf_reset(nn, rqstp, err2);
+ commit_reset_write_verifier(nn, rqstp, err2);
err = nfserrno(err2);
}
} else
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0040/1266] apparmor: advertise the tcp fast open fix is applied
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0039/1266] nfsd: Dont reset the write verifier on a commit EAGAIN Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0041/1266] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
` (958 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Johansen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 ]
The fix for tcp-fast-open ensures that the connect permission is being
mediated correctly but it didn't add an artifact to the feature set to
advertise the fix is available. Add an artifact so that the test suite
can identify if the fix has not been properly applied or a new
unexpected regression has occurred.
Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/net.c | 1 +
1 file changed, 1 insertion(+)
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -21,6 +21,7 @@
struct aa_sfs_entry aa_sfs_entry_network[] = {
AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK),
+ AA_SFS_FILE_BOOLEAN("tcp-fast-open", 1),
{ }
};
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0041/1266] nfsd: move name lookup out of nfsd4_list_rec_dir()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0040/1266] apparmor: advertise the tcp fast open fix is applied Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0042/1266] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
` (957 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@ownmail.net>
[ Upstream commit 89bd77cf436bf25e448817a662ebf76515f22863 ]
nfsd4_list_rec_dir() is called with two different callbacks.
One of the callbacks uses vfs_rmdir() to remove the directory.
The other doesn't use the dentry at all, just the name.
As only one callback needs the dentry, this patch moves the lookup into
that callback. This prepares of changes to how directory operations
are locked.
Signed-off-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4recover.c | 55 ++++++++++++++++++++++---------------------
1 file changed, 28 insertions(+), 27 deletions(-)
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 017044c27d381d..8b8d7e0131fd1f 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -254,7 +254,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
nfs4_reset_creds(original_cred);
}
-typedef int (recdir_func)(struct dentry *, struct dentry *, struct nfsd_net *);
+typedef int (recdir_func)(struct dentry *, char *, struct nfsd_net *);
struct name_list {
char name[HEXDIR_LEN];
@@ -308,23 +308,14 @@ nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
}
status = iterate_dir(nn->rec_file, &ctx.ctx);
- inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
- if (!status) {
- struct dentry *dentry;
- dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
- if (IS_ERR(dentry)) {
- status = PTR_ERR(dentry);
- break;
- }
- status = f(dir, dentry, nn);
- dput(dentry);
- }
+ if (!status)
+ status = f(dir, entry->name, nn);
+
list_del(&entry->list);
kfree(entry);
}
- inode_unlock(d_inode(dir));
nfs4_reset_creds(original_cred);
list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
@@ -422,18 +413,19 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
}
static int
-purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+purge_old(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
int status;
+ struct dentry *child;
struct xdr_netobj name;
- if (child->d_name.len != HEXDIR_LEN - 1) {
- printk("%s: illegal name %pd in recovery directory\n",
- __func__, child);
+ if (strlen(cname) != HEXDIR_LEN - 1) {
+ printk("%s: illegal name %s in recovery directory\n",
+ __func__, cname);
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+ name.data = kstrdup(cname, GFP_KERNEL);
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
@@ -443,10 +435,17 @@ purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
if (nfs4_has_reclaimed_state(name, nn))
goto out_free;
- status = vfs_rmdir(&nop_mnt_idmap, d_inode(parent), child);
- if (status)
- printk("failed to remove client recovery directory %pd\n",
- child);
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ child = lookup_one_len(cname, parent, HEXDIR_LEN-1);
+ if (!IS_ERR(child)) {
+ status = vfs_rmdir(&nop_mnt_idmap, d_inode(parent), child);
+ if (status)
+ printk("failed to remove client recovery directory %pd\n",
+ child);
+ dput(child);
+ }
+ inode_unlock(d_inode(parent));
+
out_free:
kfree(name.data);
out:
@@ -477,18 +476,18 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
}
static int
-load_recdir(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
struct xdr_netobj name;
struct xdr_netobj princhash = { .len = 0, .data = NULL };
- if (child->d_name.len != HEXDIR_LEN - 1) {
- printk("%s: illegal name %pd in recovery directory\n",
- __func__, child);
+ if (strlen(cname) != HEXDIR_LEN - 1) {
+ printk("%s: illegal name %s in recovery directory\n",
+ __func__, cname);
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+ name.data = kstrdup(cname, GFP_KERNEL);
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
@@ -843,11 +842,13 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
return PTR_ERR(name.data);
name.len = namelen;
}
+#ifdef CONFIG_NFSD_V4
if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
name.len = name.len - 5;
memmove(name.data, name.data + 5, name.len);
cn->cn_has_legacy = true;
}
+#endif
if (!nfs4_client_to_reclaim(name, princhash, nn)) {
kfree(name.data);
kfree(princhash.data);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0042/1266] nfsd: change nfs4_client_to_reclaim() to allocate data
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0041/1266] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
@ 2026-07-21 15:07 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0043/1266] net: team: rename team to team_core for linking Greg Kroah-Hartman
` (956 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
[ Upstream commit 4552f4e3f2c96597914f07b060d5c5db84420ddd ]
The calling convention for nfs4_client_to_reclaim() is clumsy in that
the caller needs to free memory if the function fails. It is much
cleaner if the function frees its own memory.
This patch changes nfs4_client_to_reclaim() to re-allocate the .data
fields to be stored in the newly allocated struct nfs4_client_reclaim,
and to free everything on failure.
__cld_pipe_inprogress_downcall() needs to allocate the data anyway to
copy it from user-space, so now that data is allocated twice. I think
that is a small price to pay for a cleaner interface.
Signed-off-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4recover.c | 67 +++++++++++++++----------------------------
fs/nfsd/nfs4state.c | 22 ++++++++++++--
2 files changed, 42 insertions(+), 47 deletions(-)
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 8b8d7e0131fd1f..f4060d0cec8a5e 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -167,24 +167,13 @@ legacy_recdir_name_error(struct nfs4_client *clp, int error)
static void
__nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
- const char *dname, int len, struct nfsd_net *nn)
+ char *dname, struct nfsd_net *nn)
{
- struct xdr_netobj name;
+ struct xdr_netobj name = { .len = strlen(dname), .data = dname };
struct xdr_netobj princhash = { .len = 0, .data = NULL };
struct nfs4_client_reclaim *crp;
- name.data = kmemdup(dname, len, GFP_KERNEL);
- if (!name.data) {
- dprintk("%s: failed to allocate memory for name.data!\n",
- __func__);
- return;
- }
- name.len = len;
crp = nfs4_client_to_reclaim(name, princhash, nn);
- if (!crp) {
- kfree(name.data);
- return;
- }
crp->cr_clp = clp;
}
@@ -240,8 +229,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
inode_unlock(d_inode(dir));
if (status == 0) {
if (nn->in_grace)
- __nfsd4_create_reclaim_record_grace(clp, dname,
- HEXDIR_LEN, nn);
+ __nfsd4_create_reclaim_record_grace(clp, dname, nn);
vfs_fsync(nn->rec_file, 0);
} else {
printk(KERN_ERR "NFSD: failed to write recovery record"
@@ -478,7 +466,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
static int
load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
- struct xdr_netobj name;
+ struct xdr_netobj name = { .len = HEXDIR_LEN, .data = cname };
struct xdr_netobj princhash = { .len = 0, .data = NULL };
if (strlen(cname) != HEXDIR_LEN - 1) {
@@ -487,16 +475,7 @@ load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kstrdup(cname, GFP_KERNEL);
- if (!name.data) {
- dprintk("%s: failed to allocate memory for name.data!\n",
- __func__);
- goto out;
- }
- name.len = HEXDIR_LEN;
- if (!nfs4_client_to_reclaim(name, princhash, nn))
- kfree(name.data);
-out:
+ nfs4_client_to_reclaim(name, princhash, nn);
return 0;
}
@@ -792,6 +771,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
{
uint8_t cmd, princhashlen;
struct xdr_netobj name, princhash = { .len = 0, .data = NULL };
+ char *namecopy __free(kfree) = NULL;
+ char *princhashcopy __free(kfree) = NULL;
uint16_t namelen;
struct cld_net *cn = nn->cld_net;
@@ -810,20 +791,20 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
dprintk("%s: namelen should not be zero", __func__);
return -EINVAL;
}
- name.data = memdup_user(&ci->cc_name.cn_id, namelen);
- if (IS_ERR(name.data))
- return PTR_ERR(name.data);
+ namecopy = memdup_user(&ci->cc_name.cn_id, namelen);
+ if (IS_ERR(namecopy))
+ return PTR_ERR(namecopy);
+ name.data = namecopy;
name.len = namelen;
if (get_user(princhashlen, &ci->cc_princhash.cp_len))
return -EFAULT;
if (princhashlen > 0) {
- princhash.data = memdup_user(
- &ci->cc_princhash.cp_data,
- princhashlen);
- if (IS_ERR(princhash.data)) {
- kfree(name.data);
- return PTR_ERR(princhash.data);
- }
+ princhashcopy = memdup_user(
+ &ci->cc_princhash.cp_data,
+ princhashlen);
+ if (IS_ERR(princhashcopy))
+ return PTR_ERR(princhashcopy);
+ princhash.data = princhashcopy;
princhash.len = princhashlen;
} else
princhash.len = 0;
@@ -837,23 +818,21 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
dprintk("%s: namelen should not be zero", __func__);
return -EINVAL;
}
- name.data = memdup_user(&cnm->cn_id, namelen);
- if (IS_ERR(name.data))
- return PTR_ERR(name.data);
+ namecopy = memdup_user(&cnm->cn_id, namelen);
+ if (IS_ERR(namecopy))
+ return PTR_ERR(namecopy);
+ name.data = namecopy;
name.len = namelen;
}
#ifdef CONFIG_NFSD_V4
if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
name.len = name.len - 5;
- memmove(name.data, name.data + 5, name.len);
+ name.data = name.data + 5;
cn->cn_has_legacy = true;
}
#endif
- if (!nfs4_client_to_reclaim(name, princhash, nn)) {
- kfree(name.data);
- kfree(princhash.data);
+ if (!nfs4_client_to_reclaim(name, princhash, nn))
return -EFAULT;
- }
return nn->client_tracking_ops->msglen;
}
return -EFAULT;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index c0dd50b59ad16c..f21878a7f39398 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -8093,9 +8093,6 @@ nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
/*
* failure => all reset bets are off, nfserr_no_grace...
- *
- * The caller is responsible for freeing name.data if NULL is returned (it
- * will be freed in nfs4_remove_reclaim_record in the normal case).
*/
struct nfs4_client_reclaim *
nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
@@ -8104,6 +8101,22 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
unsigned int strhashval;
struct nfs4_client_reclaim *crp;
+ name.data = kmemdup(name.data, name.len, GFP_KERNEL);
+ if (!name.data) {
+ dprintk("%s: failed to allocate memory for name.data!\n",
+ __func__);
+ return NULL;
+ }
+ if (princhash.len) {
+ princhash.data = kmemdup(princhash.data, princhash.len, GFP_KERNEL);
+ if (!princhash.data) {
+ dprintk("%s: failed to allocate memory for princhash.data!\n",
+ __func__);
+ kfree(name.data);
+ return NULL;
+ }
+ } else
+ princhash.data = NULL;
crp = alloc_reclaim();
if (crp) {
strhashval = clientstr_hashval(name);
@@ -8115,6 +8128,9 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
crp->cr_princhash.len = princhash.len;
crp->cr_clp = NULL;
nn->reclaim_str_hashtbl_size++;
+ } else {
+ kfree(name.data);
+ kfree(princhash.data);
}
return crp;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0043/1266] net: team: rename team to team_core for linking
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-07-21 15:07 ` [PATCH 6.6 0042/1266] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0044/1266] net, team, bonding: Add netdev_base_features helper Greg Kroah-Hartman
` (955 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Jiri Pirko,
Jakub Kicinski, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit a0393e3e3ddbb177b25f0a978c72f5efe942fe7d ]
Similar with commit 08d323234d10 ("net: fou: rename the source for linking"),
We'll need to link two objects together to form the team module.
This means the source can't be called team, the build system expects
team.o to be the combined object.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20240401031004.1159713-3-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Stable-dep-of: 425000dbf173 ("team: fix header_ops type confusion with non-Ethernet ports")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/team/Makefile | 1 +
drivers/net/team/{team.c => team_core.c} | 0
2 files changed, 1 insertion(+)
rename drivers/net/team/{team.c => team_core.c} (100%)
diff --git a/drivers/net/team/Makefile b/drivers/net/team/Makefile
index f582d81a509119..244db32c1060e1 100644
--- a/drivers/net/team/Makefile
+++ b/drivers/net/team/Makefile
@@ -3,6 +3,7 @@
# Makefile for the network team driver
#
+team-y:= team_core.o
obj-$(CONFIG_NET_TEAM) += team.o
obj-$(CONFIG_NET_TEAM_MODE_BROADCAST) += team_mode_broadcast.o
obj-$(CONFIG_NET_TEAM_MODE_ROUNDROBIN) += team_mode_roundrobin.o
diff --git a/drivers/net/team/team.c b/drivers/net/team/team_core.c
similarity index 100%
rename from drivers/net/team/team.c
rename to drivers/net/team/team_core.c
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0044/1266] net, team, bonding: Add netdev_base_features helper
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0043/1266] net: team: rename team to team_core for linking Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0045/1266] bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features Greg Kroah-Hartman
` (954 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Nikolay Aleksandrov,
Ido Schimmel, Jiri Pirko, Hangbin Liu, Paolo Abeni, Wentao Guan,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit d2516c3a53705f783bb6868df0f4a2b977898a71 ]
Both bonding and team driver have logic to derive the base feature
flags before iterating over their slave devices to refine the set
via netdev_increment_features().
Add a small helper netdev_base_features() so this can be reused
instead of having it open-coded multiple times.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Ido Schimmel <idosch@idosch.org>
Cc: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20241210141245.327886-1-daniel@iogearbox.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Stable-dep-of: d064ea7fe2a2 ("bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 4 +---
drivers/net/team/team_core.c | 3 +--
include/linux/netdev_features.h | 7 +++++++
3 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e57e1296da3740..36277bcefe2908 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1456,9 +1456,7 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
struct slave *slave;
mask = features;
-
- features &= ~NETIF_F_ONE_FOR_ALL;
- features |= NETIF_F_ALL_FOR_ALL;
+ features = netdev_base_features(features);
bond_for_each_slave(bond, slave, iter) {
features = netdev_increment_features(features,
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index deb6eb3a240a03..5cd1807e11f797 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -2026,8 +2026,7 @@ static netdev_features_t team_fix_features(struct net_device *dev,
netdev_features_t mask;
mask = features;
- features &= ~NETIF_F_ONE_FOR_ALL;
- features |= NETIF_F_ALL_FOR_ALL;
+ features = netdev_base_features(features);
rcu_read_lock();
list_for_each_entry_rcu(port, &team->port_list, list) {
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 7c2d77d75a888c..1b5ad57e7cbf5a 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -261,4 +261,11 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)
NETIF_F_GSO_UDP_TUNNEL | \
NETIF_F_GSO_UDP_TUNNEL_CSUM)
+static inline netdev_features_t netdev_base_features(netdev_features_t features)
+{
+ features &= ~NETIF_F_ONE_FOR_ALL;
+ features |= NETIF_F_ALL_FOR_ALL;
+ return features;
+}
+
#endif /* _LINUX_NETDEV_FEATURES_H */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0045/1266] bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0044/1266] net, team, bonding: Add netdev_base_features helper Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0046/1266] bonding: add ESP offload features when slaves support Greg Kroah-Hartman
` (953 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Nikolay Aleksandrov,
Ido Schimmel, Jiri Pirko, Hangbin Liu, Paolo Abeni, Wentao Guan,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit d064ea7fe2a24938997b5e88e6b61cbb0a4bb906 ]
If a bonding device has slave devices, then the current logic to derive
the feature set for the master bond device is limited in that flags which
are fully supported by the underlying slave devices cannot be propagated
up to vlan devices which sit on top of bond devices. Instead, these get
blindly masked out via current NETIF_F_ALL_FOR_ALL logic.
vlan_features and mpls_features should reuse netdev_base_features() in
order derive the set in the same way as ndo_fix_features before iterating
through the slave devices to refine the feature set.
Fixes: a9b3ace44c7d ("bonding: fix vlan_features computing")
Fixes: 2e770b507ccd ("net: bonding: Inherit MPLS features from slave devices")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Ido Schimmel <idosch@idosch.org>
Cc: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20241210141245.327886-2-daniel@iogearbox.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 36277bcefe2908..d200909a75cfe9 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1499,8 +1499,9 @@ static void bond_compute_features(struct bonding *bond)
if (!bond_has_slaves(bond))
goto done;
- vlan_features &= NETIF_F_ALL_FOR_ALL;
- mpls_features &= NETIF_F_ALL_FOR_ALL;
+
+ vlan_features = netdev_base_features(vlan_features);
+ mpls_features = netdev_base_features(mpls_features);
bond_for_each_slave(bond, slave, iter) {
vlan_features = netdev_increment_features(vlan_features,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0046/1266] bonding: add ESP offload features when slaves support
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0045/1266] bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0047/1266] bonding: Correctly support GSO ESP offload Greg Kroah-Hartman
` (952 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianbo Liu, Boris Pismenny,
Tariq Toukan, Jakub Kicinski, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit 4861333b42178fa3d8fd1bb4e2cfb2fedc968dba ]
Add NETIF_F_GSO_ESP bit to bond's gso_partial_features if all slaves
support it, such that ESP segmentation is handled by hardware if possible.
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20241105192721.584822-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index d200909a75cfe9..ec21958babe7d8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1484,6 +1484,7 @@ static void bond_compute_features(struct bonding *bond)
{
unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
IFF_XMIT_DST_RELEASE_PERM;
+ netdev_features_t gso_partial_features = NETIF_F_GSO_ESP;
netdev_features_t vlan_features = BOND_VLAN_FEATURES;
netdev_features_t enc_features = BOND_ENC_FEATURES;
#ifdef CONFIG_XFRM_OFFLOAD
@@ -1517,6 +1518,9 @@ static void bond_compute_features(struct bonding *bond)
BOND_XFRM_FEATURES);
#endif /* CONFIG_XFRM_OFFLOAD */
+ if (slave->dev->hw_enc_features & NETIF_F_GSO_PARTIAL)
+ gso_partial_features &= slave->dev->gso_partial_features;
+
mpls_features = netdev_increment_features(mpls_features,
slave->dev->mpls_features,
BOND_MPLS_FEATURES);
@@ -1530,6 +1534,11 @@ static void bond_compute_features(struct bonding *bond)
}
bond_dev->hard_header_len = max_hard_header_len;
+ if (gso_partial_features & NETIF_F_GSO_ESP)
+ bond_dev->gso_partial_features |= NETIF_F_GSO_ESP;
+ else
+ bond_dev->gso_partial_features &= ~NETIF_F_GSO_ESP;
+
done:
bond_dev->vlan_features = vlan_features;
bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0047/1266] bonding: Correctly support GSO ESP offload
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0046/1266] bonding: add ESP offload features when slaves support Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0048/1266] net: add a common function to compute features for upper devices Greg Kroah-Hartman
` (951 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Cosmin Ratiu,
Jay Vosburgh, Paolo Abeni, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <cratiu@nvidia.com>
[ Upstream commit 9e6c4e6b605c1fa3e24f74ee0b641e95f090188a ]
The referenced fix is incomplete. It correctly computes
bond_dev->gso_partial_features across slaves, but unfortunately
netdev_fix_features discards gso_partial_features from the feature set
if NETIF_F_GSO_PARTIAL isn't set in bond_dev->features.
This is visible with ethtool -k bond0 | grep esp:
tx-esp-segmentation: off [requested on]
esp-hw-offload: on
esp-tx-csum-hw-offload: on
This patch reworks the bonding GSO offload support by:
- making aggregating gso_partial_features across slaves similar to the
other feature sets (this part is a no-op).
- advertising the default partial gso features on empty bond devs, same
as with other feature sets (also a no-op).
- adding NETIF_F_GSO_PARTIAL to hw_enc_features filtered across slaves.
- adding NETIF_F_GSO_PARTIAL to features in bond_setup()
With all of these, 'ethtool -k bond0 | grep esp' now reports:
tx-esp-segmentation: on
esp-hw-offload: on
esp-tx-csum-hw-offload: on
Fixes: 4861333b4217 ("bonding: add ESP offload features when slaves support")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20250127104147.759658-1-cratiu@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index ec21958babe7d8..9ba63cf77cf086 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1474,17 +1474,20 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
NETIF_F_HIGHDMA | NETIF_F_LRO)
#define BOND_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
- NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE)
+ NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \
+ NETIF_F_GSO_PARTIAL)
#define BOND_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
NETIF_F_GSO_SOFTWARE)
+#define BOND_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP)
+
static void bond_compute_features(struct bonding *bond)
{
+ netdev_features_t gso_partial_features = BOND_GSO_PARTIAL_FEATURES;
unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
IFF_XMIT_DST_RELEASE_PERM;
- netdev_features_t gso_partial_features = NETIF_F_GSO_ESP;
netdev_features_t vlan_features = BOND_VLAN_FEATURES;
netdev_features_t enc_features = BOND_ENC_FEATURES;
#ifdef CONFIG_XFRM_OFFLOAD
@@ -1518,8 +1521,9 @@ static void bond_compute_features(struct bonding *bond)
BOND_XFRM_FEATURES);
#endif /* CONFIG_XFRM_OFFLOAD */
- if (slave->dev->hw_enc_features & NETIF_F_GSO_PARTIAL)
- gso_partial_features &= slave->dev->gso_partial_features;
+ gso_partial_features = netdev_increment_features(gso_partial_features,
+ slave->dev->gso_partial_features,
+ BOND_GSO_PARTIAL_FEATURES);
mpls_features = netdev_increment_features(mpls_features,
slave->dev->mpls_features,
@@ -1534,12 +1538,8 @@ static void bond_compute_features(struct bonding *bond)
}
bond_dev->hard_header_len = max_hard_header_len;
- if (gso_partial_features & NETIF_F_GSO_ESP)
- bond_dev->gso_partial_features |= NETIF_F_GSO_ESP;
- else
- bond_dev->gso_partial_features &= ~NETIF_F_GSO_ESP;
-
done:
+ bond_dev->gso_partial_features = gso_partial_features;
bond_dev->vlan_features = vlan_features;
bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
NETIF_F_HW_VLAN_CTAG_TX |
@@ -6090,6 +6090,7 @@ void bond_setup(struct net_device *bond_dev)
bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL;
bond_dev->features |= bond_dev->hw_features;
bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
+ bond_dev->features |= NETIF_F_GSO_PARTIAL;
#ifdef CONFIG_XFRM_OFFLOAD
bond_dev->hw_features |= BOND_XFRM_FEATURES;
/* Only enable XFRM features if this is an active-backup config */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0048/1266] net: add a common function to compute features for upper devices
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0047/1266] bonding: Correctly support GSO ESP offload Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0049/1266] bonding: use common function to compute the features Greg Kroah-Hartman
` (950 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Hangbin Liu,
Sabrina Dubroca, Jiri Pirko, Jakub Kicinski, Wentao Guan,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 28098defc79fe7d29e6bfe4eb6312991f6bdc3d3 ]
Some high level software drivers need to compute features from lower
devices. But each has their own implementations and may lost some
feature compute. Let's use one common function to compute features
for kinds of these devices.
The new helper uses the current bond implementation as the reference
one, as the latter already handles all the relevant aspects: netdev
features, TSO limits and dst retention.
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20251017034155.61990-2-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netdev_features.h | 18 +++++++
include/linux/netdevice.h | 1 +
net/core/dev.c | 88 +++++++++++++++++++++++++++++++++
3 files changed, 107 insertions(+)
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 1b5ad57e7cbf5a..988e62cafd316a 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -261,6 +261,24 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)
NETIF_F_GSO_UDP_TUNNEL | \
NETIF_F_GSO_UDP_TUNNEL_CSUM)
+/* virtual device features */
+#define MASTER_UPPER_DEV_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
+ NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \
+ NETIF_F_GSO_ENCAP_ALL | \
+ NETIF_F_HIGHDMA | NETIF_F_LRO)
+
+#define MASTER_UPPER_DEV_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
+ NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \
+ NETIF_F_GSO_PARTIAL)
+
+#define MASTER_UPPER_DEV_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
+ NETIF_F_GSO_SOFTWARE)
+
+#define MASTER_UPPER_DEV_XFRM_FEATURES (NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM | \
+ NETIF_F_GSO_ESP)
+
+#define MASTER_UPPER_DEV_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP)
+
static inline netdev_features_t netdev_base_features(netdev_features_t features)
{
features &= ~NETIF_F_ONE_FOR_ALL;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 202e557496fb41..a81dab6c2f5f24 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -5005,6 +5005,7 @@ static inline netdev_features_t netdev_add_tso_features(netdev_features_t featur
int __netdev_update_features(struct net_device *dev);
void netdev_update_features(struct net_device *dev);
void netdev_change_features(struct net_device *dev);
+void netdev_compute_master_upper_features(struct net_device *dev, bool update_header);
void netif_stacked_transfer_operstate(const struct net_device *rootdev,
struct net_device *dev);
diff --git a/net/core/dev.c b/net/core/dev.c
index 405b448bd91fef..0cc03e6c6fb144 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -11450,6 +11450,94 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
}
EXPORT_SYMBOL(netdev_increment_features);
+/**
+ * netdev_compute_master_upper_features - compute feature from lowers
+ * @dev: the upper device
+ * @update_header: whether to update upper device's header_len/headroom/tailroom
+ *
+ * Recompute the upper device's feature based on all lower devices.
+ */
+void netdev_compute_master_upper_features(struct net_device *dev, bool update_header)
+{
+ unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM;
+ netdev_features_t gso_partial_features = MASTER_UPPER_DEV_GSO_PARTIAL_FEATURES;
+ netdev_features_t xfrm_features = MASTER_UPPER_DEV_XFRM_FEATURES;
+ netdev_features_t mpls_features = MASTER_UPPER_DEV_MPLS_FEATURES;
+ netdev_features_t vlan_features = MASTER_UPPER_DEV_VLAN_FEATURES;
+ netdev_features_t enc_features = MASTER_UPPER_DEV_ENC_FEATURES;
+ unsigned short max_header_len = ETH_HLEN;
+ unsigned int tso_max_size = TSO_MAX_SIZE;
+ unsigned short max_headroom = 0;
+ unsigned short max_tailroom = 0;
+ u16 tso_max_segs = TSO_MAX_SEGS;
+ struct net_device *lower_dev;
+ struct list_head *iter;
+
+ mpls_features = netdev_base_features(mpls_features);
+ vlan_features = netdev_base_features(vlan_features);
+ enc_features = netdev_base_features(enc_features);
+
+ netdev_for_each_lower_dev(dev, lower_dev, iter) {
+ gso_partial_features = netdev_increment_features(gso_partial_features,
+ lower_dev->gso_partial_features,
+ MASTER_UPPER_DEV_GSO_PARTIAL_FEATURES);
+
+ vlan_features = netdev_increment_features(vlan_features,
+ lower_dev->vlan_features,
+ MASTER_UPPER_DEV_VLAN_FEATURES);
+
+ enc_features = netdev_increment_features(enc_features,
+ lower_dev->hw_enc_features,
+ MASTER_UPPER_DEV_ENC_FEATURES);
+
+ if (IS_ENABLED(CONFIG_XFRM_OFFLOAD))
+ xfrm_features = netdev_increment_features(xfrm_features,
+ lower_dev->hw_enc_features,
+ MASTER_UPPER_DEV_XFRM_FEATURES);
+
+ mpls_features = netdev_increment_features(mpls_features,
+ lower_dev->mpls_features,
+ MASTER_UPPER_DEV_MPLS_FEATURES);
+
+ dst_release_flag &= lower_dev->priv_flags;
+
+ if (update_header) {
+ max_header_len = max(max_header_len, lower_dev->hard_header_len);
+ max_headroom = max(max_headroom, lower_dev->needed_headroom);
+ max_tailroom = max(max_tailroom, lower_dev->needed_tailroom);
+ }
+
+ tso_max_size = min(tso_max_size, lower_dev->tso_max_size);
+ tso_max_segs = min(tso_max_segs, lower_dev->tso_max_segs);
+ }
+
+ dev->gso_partial_features = gso_partial_features;
+ dev->vlan_features = vlan_features;
+ dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+ NETIF_F_HW_VLAN_CTAG_TX |
+ NETIF_F_HW_VLAN_STAG_TX;
+ if (IS_ENABLED(CONFIG_XFRM_OFFLOAD))
+ dev->hw_enc_features |= xfrm_features;
+ dev->mpls_features = mpls_features;
+
+ dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
+ if ((dev->priv_flags & IFF_XMIT_DST_RELEASE_PERM) &&
+ dst_release_flag == (IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM))
+ dev->priv_flags |= IFF_XMIT_DST_RELEASE;
+
+ if (update_header) {
+ dev->hard_header_len = max_header_len;
+ dev->needed_headroom = max_headroom;
+ dev->needed_tailroom = max_tailroom;
+ }
+
+ netif_set_tso_max_segs(dev, tso_max_segs);
+ netif_set_tso_max_size(dev, tso_max_size);
+
+ netdev_change_features(dev);
+}
+EXPORT_SYMBOL(netdev_compute_master_upper_features);
+
static struct hlist_head * __net_init netdev_create_hash(void)
{
int i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0049/1266] bonding: use common function to compute the features
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0048/1266] net: add a common function to compute features for upper devices Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0050/1266] bonding: fix xfrm offload feature setup on active-backup mode Greg Kroah-Hartman
` (949 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Sabrina Dubroca,
Jiri Pirko, Jakub Kicinski, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit d4fde269a970666a30dd3abd0413273a06dd972d ]
Use the new functon netdev_compute_master_upper_features() to compute the bonding
features.
Note that bond_compute_features() currently uses bond_for_each_slave()
to traverse the lower devices list, and that is just a macro wrapper of
netdev_for_each_lower_private(). We use similar helper
netdev_for_each_lower_dev() in netdev_compute_master_upper_features() to
iterate the slave device, as there is not need to get the private data.
No functional change intended.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20251017034155.61990-3-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 99 ++-------------------------------
1 file changed, 4 insertions(+), 95 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9ba63cf77cf086..4f2c03f52a310b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1468,97 +1468,6 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
return features;
}
-#define BOND_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
- NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \
- NETIF_F_GSO_ENCAP_ALL | \
- NETIF_F_HIGHDMA | NETIF_F_LRO)
-
-#define BOND_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
- NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \
- NETIF_F_GSO_PARTIAL)
-
-#define BOND_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \
- NETIF_F_GSO_SOFTWARE)
-
-#define BOND_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP)
-
-
-static void bond_compute_features(struct bonding *bond)
-{
- netdev_features_t gso_partial_features = BOND_GSO_PARTIAL_FEATURES;
- unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
- IFF_XMIT_DST_RELEASE_PERM;
- netdev_features_t vlan_features = BOND_VLAN_FEATURES;
- netdev_features_t enc_features = BOND_ENC_FEATURES;
-#ifdef CONFIG_XFRM_OFFLOAD
- netdev_features_t xfrm_features = BOND_XFRM_FEATURES;
-#endif /* CONFIG_XFRM_OFFLOAD */
- netdev_features_t mpls_features = BOND_MPLS_FEATURES;
- struct net_device *bond_dev = bond->dev;
- struct list_head *iter;
- struct slave *slave;
- unsigned short max_hard_header_len = ETH_HLEN;
- unsigned int tso_max_size = TSO_MAX_SIZE;
- u16 tso_max_segs = TSO_MAX_SEGS;
-
- if (!bond_has_slaves(bond))
- goto done;
-
- vlan_features = netdev_base_features(vlan_features);
- mpls_features = netdev_base_features(mpls_features);
-
- bond_for_each_slave(bond, slave, iter) {
- vlan_features = netdev_increment_features(vlan_features,
- slave->dev->vlan_features, BOND_VLAN_FEATURES);
-
- enc_features = netdev_increment_features(enc_features,
- slave->dev->hw_enc_features,
- BOND_ENC_FEATURES);
-
-#ifdef CONFIG_XFRM_OFFLOAD
- xfrm_features = netdev_increment_features(xfrm_features,
- slave->dev->hw_enc_features,
- BOND_XFRM_FEATURES);
-#endif /* CONFIG_XFRM_OFFLOAD */
-
- gso_partial_features = netdev_increment_features(gso_partial_features,
- slave->dev->gso_partial_features,
- BOND_GSO_PARTIAL_FEATURES);
-
- mpls_features = netdev_increment_features(mpls_features,
- slave->dev->mpls_features,
- BOND_MPLS_FEATURES);
-
- dst_release_flag &= slave->dev->priv_flags;
- if (slave->dev->hard_header_len > max_hard_header_len)
- max_hard_header_len = slave->dev->hard_header_len;
-
- tso_max_size = min(tso_max_size, slave->dev->tso_max_size);
- tso_max_segs = min(tso_max_segs, slave->dev->tso_max_segs);
- }
- bond_dev->hard_header_len = max_hard_header_len;
-
-done:
- bond_dev->gso_partial_features = gso_partial_features;
- bond_dev->vlan_features = vlan_features;
- bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
- NETIF_F_HW_VLAN_CTAG_TX |
- NETIF_F_HW_VLAN_STAG_TX;
-#ifdef CONFIG_XFRM_OFFLOAD
- bond_dev->hw_enc_features |= xfrm_features;
-#endif /* CONFIG_XFRM_OFFLOAD */
- bond_dev->mpls_features = mpls_features;
- netif_set_tso_max_segs(bond_dev, tso_max_segs);
- netif_set_tso_max_size(bond_dev, tso_max_size);
-
- bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
- if ((bond_dev->priv_flags & IFF_XMIT_DST_RELEASE_PERM) &&
- dst_release_flag == (IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM))
- bond_dev->priv_flags |= IFF_XMIT_DST_RELEASE;
-
- netdev_change_features(bond_dev);
-}
-
static void bond_setup_by_slave(struct net_device *bond_dev,
struct net_device *slave_dev)
{
@@ -2311,7 +2220,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
}
bond->slave_cnt++;
- bond_compute_features(bond);
+ netdev_compute_master_upper_features(bond->dev, true);
bond_set_carrier(bond);
/* Needs to be called before bond_select_active_slave(), which will
@@ -2563,7 +2472,7 @@ static int __bond_release_one(struct net_device *bond_dev,
call_netdevice_notifiers(NETDEV_RELEASE, bond->dev);
}
- bond_compute_features(bond);
+ netdev_compute_master_upper_features(bond->dev, true);
if (!(bond_dev->features & NETIF_F_VLAN_CHALLENGED) &&
(old_features & NETIF_F_VLAN_CHALLENGED))
slave_info(bond_dev, slave_dev, "last VLAN challenged slave left bond - VLAN blocking is removed\n");
@@ -4065,7 +3974,7 @@ static int bond_slave_netdev_event(unsigned long event,
case NETDEV_FEAT_CHANGE:
if (!bond->notifier_ctx) {
bond->notifier_ctx = true;
- bond_compute_features(bond);
+ netdev_compute_master_upper_features(bond->dev, true);
bond->notifier_ctx = false;
}
break;
@@ -6081,7 +5990,7 @@ void bond_setup(struct net_device *bond_dev)
/* Don't allow bond devices to change network namespaces. */
bond_dev->features |= NETIF_F_NETNS_LOCAL;
- bond_dev->hw_features = BOND_VLAN_FEATURES |
+ bond_dev->hw_features = MASTER_UPPER_DEV_VLAN_FEATURES |
NETIF_F_HW_VLAN_CTAG_RX |
NETIF_F_HW_VLAN_CTAG_FILTER |
NETIF_F_HW_VLAN_STAG_RX |
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0050/1266] bonding: fix xfrm offload feature setup on active-backup mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0049/1266] bonding: use common function to compute the features Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0051/1266] bonding: fix type confusion in bond_setup_by_slave() Greg Kroah-Hartman
` (948 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Paolo Abeni,
Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
The active-backup bonding mode supports XFRM ESP offload. However, when
a bond is added using command like `ip link add bond0 type bond mode 1
miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is
disabled. This occurs because, in bond_newlink(), we change bond link
first and register bond device later. So the XFRM feature update in
bond_option_mode_set() is not called as the bond device is not yet
registered, leading to the offload feature not being set successfully.
To resolve this issue, we can modify the code order in bond_newlink() to
ensure that the bond device is registered first before changing the bond
link parameters. This change will allow the XFRM ESP offload feature to be
correctly enabled.
Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/bonding/bond_netlink.c | 16 +++++++++-------
include/net/bonding.h | 1 +
3 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4f2c03f52a310b..8c156f71c70667 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4260,7 +4260,7 @@ void bond_work_init_all(struct bonding *bond)
INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
}
-static void bond_work_cancel_all(struct bonding *bond)
+void bond_work_cancel_all(struct bonding *bond)
{
cancel_delayed_work_sync(&bond->mii_work);
cancel_delayed_work_sync(&bond->arp_work);
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 0eaf4b0e06ffb2..f771d569524f3e 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -596,18 +596,20 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
struct nlattr *tb[], struct nlattr *data[],
struct netlink_ext_ack *extack)
{
+ struct bonding *bond = netdev_priv(bond_dev);
int err;
- err = bond_changelink(bond_dev, tb, data, extack);
- if (err < 0)
+ err = register_netdevice(bond_dev);
+ if (err)
return err;
- err = register_netdevice(bond_dev);
- if (!err) {
- struct bonding *bond = netdev_priv(bond_dev);
+ netif_carrier_off(bond_dev);
+ bond_work_init_all(bond);
- netif_carrier_off(bond_dev);
- bond_work_init_all(bond);
+ err = bond_changelink(bond_dev, tb, data, extack);
+ if (err) {
+ bond_work_cancel_all(bond);
+ unregister_netdevice(bond_dev);
}
return err;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 0d9c1eb40d12b6..8f5507ef5c0dac 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -713,6 +713,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
void bond_work_init_all(struct bonding *bond);
+void bond_work_cancel_all(struct bonding *bond);
#ifdef CONFIG_PROC_FS
void bond_create_proc_entry(struct bonding *bond);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0051/1266] bonding: fix type confusion in bond_setup_by_slave()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0050/1266] bonding: fix xfrm offload feature setup on active-backup mode Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0052/1266] bonding: prevent potential infinite loop in bond_header_parse() Greg Kroah-Hartman
` (947 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Vosburgh, Eric Dumazet,
Jiayuan Chen, Paolo Abeni, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 950803f7254721c1c15858fbbfae3deaaeeecb11 ]
kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306
RSP: 0018:ffffc90004aff760 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e
RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900
RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780
R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0
Call Trace:
<TASK>
ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900
dev_hard_header include/linux/netdevice.h:3439 [inline]
packet_snd net/packet/af_packet.c:3028 [inline]
packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
__sys_sendmsg+0x170/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe1a0e6c1a9
When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,
bond_setup_by_slave() directly copies the slave's header_ops to the
bond device:
bond_dev->header_ops = slave_dev->header_ops;
This causes a type confusion when dev_hard_header() is later called
on the bond device. Functions like ipgre_header(), ip6gre_header(),all use
netdev_priv(dev) to access their device-specific private data. When
called with the bond device, netdev_priv() returns the bond's private
data (struct bonding) instead of the expected type (e.g. struct
ip_tunnel), leading to garbage values being read and kernel crashes.
Fix this by introducing bond_header_ops with wrapper functions that
delegate to the active slave's header_ops using the slave's own
device. This ensures netdev_priv() in the slave's header functions
always receives the correct device.
The fix is placed in the bonding driver rather than individual device
drivers, as the root cause is bond blindly inheriting header_ops from
the slave without considering that these callbacks expect a specific
netdev_priv() layout.
The type confusion can be observed by adding a printk in
ipgre_header() and running the following commands:
ip link add dummy0 type dummy
ip addr add 10.0.0.1/24 dev dummy0
ip link set dummy0 up
ip link add gre1 type gre local 10.0.0.1
ip link add bond1 type bond mode active-backup
ip link set gre1 master bond1
ip link set gre1 up
ip link set bond1 up
ip addr add fe80::1/64 dev bond1
Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
Suggested-by: Jay Vosburgh <jv@jvosburgh.net>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260306021508.222062-1-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 47 ++++++++++++++++++++++++++++++++-
1 file changed, 46 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 8c156f71c70667..af8cdc8d26c91d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1468,6 +1468,50 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
return features;
}
+static int bond_header_create(struct sk_buff *skb, struct net_device *bond_dev,
+ unsigned short type, const void *daddr,
+ const void *saddr, unsigned int len)
+{
+ struct bonding *bond = netdev_priv(bond_dev);
+ const struct header_ops *slave_ops;
+ struct slave *slave;
+ int ret = 0;
+
+ rcu_read_lock();
+ slave = rcu_dereference(bond->curr_active_slave);
+ if (slave) {
+ slave_ops = READ_ONCE(slave->dev->header_ops);
+ if (slave_ops && slave_ops->create)
+ ret = slave_ops->create(skb, slave->dev,
+ type, daddr, saddr, len);
+ }
+ rcu_read_unlock();
+ return ret;
+}
+
+static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+ struct bonding *bond = netdev_priv(skb->dev);
+ const struct header_ops *slave_ops;
+ struct slave *slave;
+ int ret = 0;
+
+ rcu_read_lock();
+ slave = rcu_dereference(bond->curr_active_slave);
+ if (slave) {
+ slave_ops = READ_ONCE(slave->dev->header_ops);
+ if (slave_ops && slave_ops->parse)
+ ret = slave_ops->parse(skb, haddr);
+ }
+ rcu_read_unlock();
+ return ret;
+}
+
+static const struct header_ops bond_header_ops = {
+ .create = bond_header_create,
+ .parse = bond_header_parse,
+};
+
static void bond_setup_by_slave(struct net_device *bond_dev,
struct net_device *slave_dev)
{
@@ -1475,7 +1519,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
dev_close(bond_dev);
- bond_dev->header_ops = slave_dev->header_ops;
+ bond_dev->header_ops = slave_dev->header_ops ?
+ &bond_header_ops : NULL;
bond_dev->type = slave_dev->type;
bond_dev->hard_header_len = slave_dev->hard_header_len;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0052/1266] bonding: prevent potential infinite loop in bond_header_parse()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0051/1266] bonding: fix type confusion in bond_setup_by_slave() Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0053/1266] team: fix header_ops type confusion with non-Ethernet ports Greg Kroah-Hartman
` (946 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jiayuan Chen,
Jay Vosburgh, Andrew Lunn, Jakub Kicinski, Wentao Guan,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit b7405dcf7385445e10821777143f18c3ce20fa04 ]
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[backport to 6.6, also fix function for wireless/{cisco/hostap}]
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/net.c | 5 +++--
drivers/net/bonding/bond_main.c | 8 +++++---
drivers/net/wireless/cisco/airo.c | 4 +++-
drivers/net/wireless/intersil/hostap/hostap_main.c | 1 +
include/linux/etherdevice.h | 3 ++-
include/linux/if_ether.h | 3 ++-
include/linux/netdevice.h | 6 ++++--
net/ethernet/eth.c | 9 +++------
net/ipv4/ip_gre.c | 3 ++-
net/mac802154/iface.c | 4 +++-
net/phonet/af_phonet.c | 5 ++++-
11 files changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 7a4d1a478e33e2..21f3a9dae072a9 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -257,9 +257,10 @@ static void fwnet_header_cache_update(struct hh_cache *hh,
memcpy((u8 *)hh->hh_data + HH_DATA_OFF(FWNET_HLEN), haddr, net->addr_len);
}
-static int fwnet_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int fwnet_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+ unsigned char *haddr)
{
- memcpy(haddr, skb->dev->dev_addr, FWNET_ALEN);
+ memcpy(haddr, dev->dev_addr, FWNET_ALEN);
return FWNET_ALEN;
}
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index af8cdc8d26c91d..6b558aa98c6d2f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1489,9 +1489,11 @@ static int bond_header_create(struct sk_buff *skb, struct net_device *bond_dev,
return ret;
}
-static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int bond_header_parse(const struct sk_buff *skb,
+ const struct net_device *dev,
+ unsigned char *haddr)
{
- struct bonding *bond = netdev_priv(skb->dev);
+ struct bonding *bond = netdev_priv(dev);
const struct header_ops *slave_ops;
struct slave *slave;
int ret = 0;
@@ -1501,7 +1503,7 @@ static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
if (slave) {
slave_ops = READ_ONCE(slave->dev->header_ops);
if (slave_ops && slave_ops->parse)
- ret = slave_ops->parse(skb, haddr);
+ ret = slave_ops->parse(skb, slave->dev, haddr);
}
rcu_read_unlock();
return ret;
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index dbd13f7aa3e6ea..bd269fdaa1d014 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -2437,7 +2437,9 @@ void stop_airo_card(struct net_device *dev, int freeres)
EXPORT_SYMBOL(stop_airo_card);
-static int wll_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int wll_header_parse(const struct sk_buff *skb,
+ const struct net_device *dev,
+ unsigned char *haddr)
{
memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN);
return ETH_ALEN;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c
index 787f685e70b492..8ba1a709fe47de 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_main.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_main.c
@@ -575,6 +575,7 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
static int hostap_80211_header_parse(const struct sk_buff *skb,
+ const struct net_device *dev,
unsigned char *haddr)
{
memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 297231854ada51..6f96d1c6d10fd1 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -42,7 +42,8 @@ extern const struct header_ops eth_header_ops;
int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
const void *daddr, const void *saddr, unsigned len);
-int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr);
+int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+ unsigned char *haddr);
int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh,
__be16 type);
void eth_header_cache_update(struct hh_cache *hh, const struct net_device *dev,
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 8a9792a6427ad9..47a0feffc12155 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -37,7 +37,8 @@ static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb)
return (struct ethhdr *)skb_inner_mac_header(skb);
}
-int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr);
+int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+ unsigned char *haddr);
extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a81dab6c2f5f24..74474139fb9ac8 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -312,7 +312,9 @@ struct header_ops {
int (*create) (struct sk_buff *skb, struct net_device *dev,
unsigned short type, const void *daddr,
const void *saddr, unsigned int len);
- int (*parse)(const struct sk_buff *skb, unsigned char *haddr);
+ int (*parse)(const struct sk_buff *skb,
+ const struct net_device *dev,
+ unsigned char *haddr);
int (*cache)(const struct neighbour *neigh, struct hh_cache *hh, __be16 type);
void (*cache_update)(struct hh_cache *hh,
const struct net_device *dev,
@@ -3174,7 +3176,7 @@ static inline int dev_parse_header(const struct sk_buff *skb,
if (!dev->header_ops || !dev->header_ops->parse)
return 0;
- return dev->header_ops->parse(skb, haddr);
+ return dev->header_ops->parse(skb, dev, haddr);
}
static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb)
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index b4a6e26ec2871b..a90d2470e090bb 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -195,14 +195,11 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
}
EXPORT_SYMBOL(eth_type_trans);
-/**
- * eth_header_parse - extract hardware address from packet
- * @skb: packet to extract header from
- * @haddr: destination buffer
- */
-int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+ unsigned char *haddr)
{
const struct ethhdr *eth = eth_hdr(skb);
+
memcpy(haddr, eth->h_source, ETH_ALEN);
return ETH_ALEN;
}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index e58965ce8263d2..b5ebfee9a8faf6 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -888,7 +888,8 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
return -(t->hlen + sizeof(*iph));
}
-static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int ipgre_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+ unsigned char *haddr)
{
const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
memcpy(haddr, &iph->saddr, 4);
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 9e4631fade90c9..000be60d958034 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -469,7 +469,9 @@ static int mac802154_header_create(struct sk_buff *skb,
}
static int
-mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+mac802154_header_parse(const struct sk_buff *skb,
+ const struct net_device *dev,
+ unsigned char *haddr)
{
struct ieee802154_hdr hdr;
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 2b582da1e88c05..e38fad4144e489 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -129,9 +129,12 @@ static int pn_header_create(struct sk_buff *skb, struct net_device *dev,
return 1;
}
-static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int pn_header_parse(const struct sk_buff *skb,
+ const struct net_device *dev,
+ unsigned char *haddr)
{
const u8 *media = skb_mac_header(skb);
+
*haddr = *media;
return 1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0053/1266] team: fix header_ops type confusion with non-Ethernet ports
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0052/1266] bonding: prevent potential infinite loop in bond_header_parse() Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0054/1266] mm/vmscan: flush deferred TLB before freeing large folios Greg Kroah-Hartman
` (945 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3d8bc31c45e11450f24c,
Jiayuan Chen, Jiayuan Chen, Paolo Abeni, Wentao Guan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 425000dbf17373a4ab8be9428f5dc055ef870a56 ]
Similar to commit 950803f72547 ("bonding: fix type confusion in
bond_setup_by_slave()") team has the same class of header_ops type
confusion.
For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops
directly. When the team device later calls dev_hard_header() or
dev_parse_header(), these callbacks can run with the team net_device
instead of the real lower device, so netdev_priv(dev) is interpreted as
the wrong private type and can crash.
The syzbot report shows a crash in bond_header_create(), but the root
cause is in team: the topology is gre -> bond -> team, and team calls
the inherited header_ops with its own net_device instead of the lower
device, so bond_header_create() receives a team device and interprets
netdev_priv() as bonding private data, causing a type confusion crash.
Fix this by introducing team header_ops wrappers for create/parse,
selecting a team port under RCU, and calling the lower device callbacks
with port->dev, so each callback always sees the correct net_device
context.
Also pass the selected lower device to the lower parse callback, so
recursion is bounded in stacked non-Ethernet topologies and parse
callbacks always run with the correct device context.
Fixes: 1d76efe1577b ("team: add support for non-ethernet devices")
Reported-by: syzbot+3d8bc31c45e11450f24c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260320072139.134249-2-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/team/team_core.c | 65 +++++++++++++++++++++++++++++++++++-
1 file changed, 64 insertions(+), 1 deletion(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 5cd1807e11f797..a4bf020cf8e7cb 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -2128,6 +2128,68 @@ static const struct ethtool_ops team_ethtool_ops = {
* rt netlink interface
***********************/
+/* For tx path we need a linkup && enabled port and for parse any port
+ * suffices.
+ */
+static struct team_port *team_header_port_get_rcu(struct team *team,
+ bool txable)
+{
+ struct team_port *port;
+
+ list_for_each_entry_rcu(port, &team->port_list, list) {
+ if (!txable || team_port_txable(port))
+ return port;
+ }
+
+ return NULL;
+}
+
+static int team_header_create(struct sk_buff *skb, struct net_device *team_dev,
+ unsigned short type, const void *daddr,
+ const void *saddr, unsigned int len)
+{
+ struct team *team = netdev_priv(team_dev);
+ const struct header_ops *port_ops;
+ struct team_port *port;
+ int ret = 0;
+
+ rcu_read_lock();
+ port = team_header_port_get_rcu(team, true);
+ if (port) {
+ port_ops = READ_ONCE(port->dev->header_ops);
+ if (port_ops && port_ops->create)
+ ret = port_ops->create(skb, port->dev,
+ type, daddr, saddr, len);
+ }
+ rcu_read_unlock();
+ return ret;
+}
+
+static int team_header_parse(const struct sk_buff *skb,
+ const struct net_device *team_dev,
+ unsigned char *haddr)
+{
+ struct team *team = netdev_priv(team_dev);
+ const struct header_ops *port_ops;
+ struct team_port *port;
+ int ret = 0;
+
+ rcu_read_lock();
+ port = team_header_port_get_rcu(team, false);
+ if (port) {
+ port_ops = READ_ONCE(port->dev->header_ops);
+ if (port_ops && port_ops->parse)
+ ret = port_ops->parse(skb, port->dev, haddr);
+ }
+ rcu_read_unlock();
+ return ret;
+}
+
+static const struct header_ops team_header_ops = {
+ .create = team_header_create,
+ .parse = team_header_parse,
+};
+
static void team_setup_by_port(struct net_device *dev,
struct net_device *port_dev)
{
@@ -2136,7 +2198,8 @@ static void team_setup_by_port(struct net_device *dev,
if (port_dev->type == ARPHRD_ETHER)
dev->header_ops = team->header_ops_cache;
else
- dev->header_ops = port_dev->header_ops;
+ dev->header_ops = port_dev->header_ops ?
+ &team_header_ops : NULL;
dev->type = port_dev->type;
dev->hard_header_len = port_dev->hard_header_len;
dev->needed_headroom = port_dev->needed_headroom;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0054/1266] mm/vmscan: flush deferred TLB before freeing large folios
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0053/1266] team: fix header_ops type confusion with non-Ethernet ports Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0055/1266] xfs: recreate work items when recovering intent items Greg Kroah-Hartman
` (944 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingfu Zhou, Jiayuan Chen,
Jiayuan Chen, Matthew Wilcox, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@shopee.com>
In reclaim, shrink_folio_list() unmaps PTEs with a deferred, batched TLB
flush. The batch is only flushed by try_to_unmap_flush() near the end of
the function, just before the order-0 folios collected in @free_folios are
handed back to the allocator.
Large folios don't go through @free_folios -- they're freed inline at the
free_it label via destroy_large_folio(), which runs before that flush. So
a large folio's pages can be returned to the buddy allocator and reused
while another CPU still holds a stale TLB entry for them, and that CPU then
reads or executes through the stale translation into the reused page. For
file-backed large folios (e.g. executable text) this shows up as random
SIGSEGV/SIGILL in user space, with fault addresses that don't match the
code being run.
Flush the deferred batch before freeing a large folio inline, the same way
the order-0 path already waits for the flush.
Upstream this is fixed as a side effect of commit bc2ff4cbc329 ("mm: free
folios in a batch in shrink_folio_list()"), which is a larger change; this
is the minimal fix for -stable.
Reported-by: Yingfu Zhou <yingfu.zhou@shopee.com>
Fixes: bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out")
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Reviewed-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmscan.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index aba757e5c59784..8eb498351d9b30 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2123,10 +2123,12 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
* Is there need to periodically free_folio_list? It would
* appear not as the counts should be low
*/
- if (unlikely(folio_test_large(folio)))
+ if (unlikely(folio_test_large(folio))) {
+ try_to_unmap_flush();
destroy_large_folio(folio);
- else
+ } else {
list_add(&folio->lru, &free_folios);
+ }
continue;
activate_locked_split:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0055/1266] xfs: recreate work items when recovering intent items
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0054/1266] mm/vmscan: flush deferred TLB before freeing large folios Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0056/1266] xfs: dump the recovered xattri log item if corruption happens Greg Kroah-Hartman
` (943 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Fedor Pchelkin, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e70fb328d5277297ea2d9169a3a046de6412d777 upstream.
Recreate work items for each xfs_defer_pending object when we are
recovering intent items.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ fp: fix conflict in calling xfs_attr_namecheck() with 2 args instead
of 3 due to backported ea0b3e814741 ("xfs: enforce one namespace per
attribute") ]
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_defer.c | 3 +-
fs/xfs/libxfs/xfs_defer.h | 9 +++
fs/xfs/xfs_attr_item.c | 92 +++++++++++++++++-------------
fs/xfs/xfs_bmap_item.c | 55 +++++++++++-------
fs/xfs/xfs_extfree_item.c | 49 +++++++++-------
fs/xfs/xfs_refcount_item.c | 60 ++++++++++----------
fs/xfs/xfs_rmap_item.c | 112 ++++++++++++++++++++-----------------
7 files changed, 216 insertions(+), 164 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 363da37a8e7fbe..8fb523e4f66931 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -676,9 +676,8 @@ xfs_defer_add(
list_add_tail(&dfp->dfp_list, &tp->t_dfops);
}
- list_add_tail(li, &dfp->dfp_work);
+ xfs_defer_add_item(dfp, li);
trace_xfs_defer_add_item(tp->t_mountp, dfp, li);
- dfp->dfp_count++;
}
/*
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index 5dce938ba3d594..bef5823f61fb82 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -130,6 +130,15 @@ void xfs_defer_start_recovery(struct xfs_log_item *lip,
void xfs_defer_cancel_recovery(struct xfs_mount *mp,
struct xfs_defer_pending *dfp);
+static inline void
+xfs_defer_add_item(
+ struct xfs_defer_pending *dfp,
+ struct list_head *work)
+{
+ list_add_tail(work, &dfp->dfp_work);
+ dfp->dfp_count++;
+}
+
int __init xfs_defer_init_item_caches(void);
void xfs_defer_destroy_item_caches(void);
diff --git a/fs/xfs/xfs_attr_item.c b/fs/xfs/xfs_attr_item.c
index 889fca3f8de1ce..929a53db22462f 100644
--- a/fs/xfs/xfs_attr_item.c
+++ b/fs/xfs/xfs_attr_item.c
@@ -546,43 +546,17 @@ xfs_attri_validate(
return xfs_verify_ino(mp, attrp->alfi_ino);
}
-/*
- * Process an attr intent item that was recovered from the log. We need to
- * delete the attr that it describes.
- */
-STATIC int
-xfs_attri_item_recover(
+static inline struct xfs_attr_intent *
+xfs_attri_recover_work(
+ struct xfs_mount *mp,
struct xfs_defer_pending *dfp,
- struct list_head *capture_list)
+ struct xfs_attri_log_format *attrp,
+ struct xfs_inode *ip,
+ struct xfs_attri_log_nameval *nv)
{
- struct xfs_log_item *lip = dfp->dfp_intent;
- struct xfs_attri_log_item *attrip = ATTRI_ITEM(lip);
struct xfs_attr_intent *attr;
- struct xfs_mount *mp = lip->li_log->l_mp;
- struct xfs_inode *ip;
struct xfs_da_args *args;
- struct xfs_trans *tp;
- struct xfs_trans_res resv;
- struct xfs_attri_log_format *attrp;
- struct xfs_attri_log_nameval *nv = attrip->attri_nameval;
- int error;
- int total;
int local;
- struct xfs_attrd_log_item *done_item = NULL;
-
- /*
- * First check the validity of the attr described by the ATTRI. If any
- * are bad, then assume that all are bad and just toss the ATTRI.
- */
- attrp = &attrip->attri_format;
- if (!xfs_attri_validate(mp, attrp) ||
- !xfs_attr_namecheck(attrp->alfi_attr_filter, nv->name.i_addr,
- nv->name.i_len))
- return -EFSCORRUPTED;
-
- error = xlog_recover_iget(mp, attrp->alfi_ino, &ip);
- if (error)
- return error;
attr = kmem_zalloc(sizeof(struct xfs_attr_intent) +
sizeof(struct xfs_da_args), KM_NOFS);
@@ -624,19 +598,59 @@ xfs_attri_item_recover(
case XFS_ATTRI_OP_FLAGS_REMOVE:
attr->xattri_dela_state = xfs_attr_init_remove_state(args);
break;
- default:
- ASSERT(0);
- error = -EFSCORRUPTED;
- goto out;
}
+ xfs_defer_add_item(dfp, &attr->xattri_list);
+ return attr;
+}
+
+/*
+ * Process an attr intent item that was recovered from the log. We need to
+ * delete the attr that it describes.
+ */
+STATIC int
+xfs_attri_item_recover(
+ struct xfs_defer_pending *dfp,
+ struct list_head *capture_list)
+{
+ struct xfs_log_item *lip = dfp->dfp_intent;
+ struct xfs_attri_log_item *attrip = ATTRI_ITEM(lip);
+ struct xfs_attr_intent *attr;
+ struct xfs_mount *mp = lip->li_log->l_mp;
+ struct xfs_inode *ip;
+ struct xfs_da_args *args;
+ struct xfs_trans *tp;
+ struct xfs_trans_res resv;
+ struct xfs_attri_log_format *attrp;
+ struct xfs_attri_log_nameval *nv = attrip->attri_nameval;
+ int error;
+ int total;
+ struct xfs_attrd_log_item *done_item = NULL;
+
+ /*
+ * First check the validity of the attr described by the ATTRI. If any
+ * are bad, then assume that all are bad and just toss the ATTRI.
+ */
+ attrp = &attrip->attri_format;
+ if (!xfs_attri_validate(mp, attrp) ||
+ !xfs_attr_namecheck(attrp->alfi_attr_filter, nv->name.i_addr,
+ nv->name.i_len))
+ return -EFSCORRUPTED;
+
+ error = xlog_recover_iget(mp, attrp->alfi_ino, &ip);
+ if (error)
+ return error;
+
+ attr = xfs_attri_recover_work(mp, dfp, attrp, ip, nv);
+ args = attr->xattri_da_args;
+
xfs_init_attr_trans(args, &resv, &total);
resv = xlog_recover_resv(&resv);
error = xfs_trans_alloc(mp, &resv, total, 0, XFS_TRANS_RESERVE, &tp);
if (error)
- goto out;
-
+ return error;
args->trans = tp;
+
done_item = xfs_trans_get_attrd(tp, attrip);
xlog_recover_transfer_intent(tp, dfp);
@@ -667,8 +681,6 @@ xfs_attri_item_recover(
out_unlock:
xfs_iunlock(ip, XFS_ILOCK_EXCL);
xfs_irele(ip);
-out:
- xfs_attr_free_item(attr);
return error;
}
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 969cad575c3029..1be29b3db3e710 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -481,6 +481,28 @@ xfs_bui_validate(
return xfs_verify_fsbext(mp, map->me_startblock, map->me_len);
}
+static inline struct xfs_bmap_intent *
+xfs_bui_recover_work(
+ struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp,
+ struct xfs_map_extent *map)
+{
+ struct xfs_bmap_intent *bi;
+
+ bi = kmem_cache_zalloc(xfs_bmap_intent_cache, GFP_NOFS | __GFP_NOFAIL);
+ bi->bi_whichfork = (map->me_flags & XFS_BMAP_EXTENT_ATTR_FORK) ?
+ XFS_ATTR_FORK : XFS_DATA_FORK;
+ bi->bi_type = map->me_flags & XFS_BMAP_EXTENT_TYPE_MASK;
+ bi->bi_bmap.br_startblock = map->me_startblock;
+ bi->bi_bmap.br_startoff = map->me_startoff;
+ bi->bi_bmap.br_blockcount = map->me_len;
+ bi->bi_bmap.br_state = (map->me_flags & XFS_BMAP_EXTENT_UNWRITTEN) ?
+ XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+
+ xfs_defer_add_item(dfp, &bi->bi_list);
+ return bi;
+}
+
/*
* Process a bmap update intent item that was recovered from the log.
* We need to update some inode's bmbt.
@@ -490,7 +512,6 @@ xfs_bui_item_recover(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
- struct xfs_bmap_intent fake = { };
struct xfs_trans_res resv;
struct xfs_log_item *lip = dfp->dfp_intent;
struct xfs_bui_log_item *buip = BUI_ITEM(lip);
@@ -499,6 +520,7 @@ xfs_bui_item_recover(
struct xfs_mount *mp = lip->li_log->l_mp;
struct xfs_map_extent *map;
struct xfs_bud_log_item *budp;
+ struct xfs_bmap_intent *fake;
int iext_delta;
int error = 0;
@@ -509,9 +531,7 @@ xfs_bui_item_recover(
}
map = &buip->bui_format.bui_extents[0];
- fake.bi_whichfork = (map->me_flags & XFS_BMAP_EXTENT_ATTR_FORK) ?
- XFS_ATTR_FORK : XFS_DATA_FORK;
- fake.bi_type = map->me_flags & XFS_BMAP_EXTENT_TYPE_MASK;
+ fake = xfs_bui_recover_work(mp, dfp, map);
error = xlog_recover_iget(mp, map->me_owner, &ip);
if (error)
@@ -530,36 +550,31 @@ xfs_bui_item_recover(
xfs_ilock(ip, XFS_ILOCK_EXCL);
xfs_trans_ijoin(tp, ip, 0);
- if (fake.bi_type == XFS_BMAP_MAP)
+ if (fake->bi_type == XFS_BMAP_MAP)
iext_delta = XFS_IEXT_ADD_NOSPLIT_CNT;
else
iext_delta = XFS_IEXT_PUNCH_HOLE_CNT;
- error = xfs_iext_count_may_overflow(ip, fake.bi_whichfork, iext_delta);
+ error = xfs_iext_count_may_overflow(ip, fake->bi_whichfork, iext_delta);
if (error == -EFBIG)
error = xfs_iext_count_upgrade(tp, ip, iext_delta);
if (error)
goto err_cancel;
- fake.bi_owner = ip;
- fake.bi_bmap.br_startblock = map->me_startblock;
- fake.bi_bmap.br_startoff = map->me_startoff;
- fake.bi_bmap.br_blockcount = map->me_len;
- fake.bi_bmap.br_state = (map->me_flags & XFS_BMAP_EXTENT_UNWRITTEN) ?
- XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+ fake->bi_owner = ip;
- xfs_bmap_update_get_group(mp, &fake);
- error = xfs_trans_log_finish_bmap_update(tp, budp, &fake);
+ xfs_bmap_update_get_group(mp, fake);
+ error = xfs_trans_log_finish_bmap_update(tp, budp, fake);
if (error == -EFSCORRUPTED)
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, map,
- sizeof(*map));
- xfs_bmap_update_put_group(&fake);
+ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+ &buip->bui_format, sizeof(buip->bui_format));
+ xfs_bmap_update_put_group(fake);
if (error)
goto err_cancel;
- if (fake.bi_bmap.br_blockcount > 0) {
- ASSERT(fake.bi_type == XFS_BMAP_UNMAP);
- xfs_bmap_unmap_extent(tp, ip, &fake.bi_bmap);
+ if (fake->bi_bmap.br_blockcount > 0) {
+ ASSERT(fake->bi_type == XFS_BMAP_UNMAP);
+ xfs_bmap_unmap_extent(tp, ip, &fake->bi_bmap);
}
/*
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index c9908fb337657a..41108a0b60c91a 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -651,6 +651,24 @@ xfs_efi_validate_ext(
return xfs_verify_fsbext(mp, extp->ext_start, extp->ext_len);
}
+static inline void
+xfs_efi_recover_work(
+ struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp,
+ struct xfs_extent *extp)
+{
+ struct xfs_extent_free_item *xefi;
+
+ xefi = kmem_cache_zalloc(xfs_extfree_item_cache,
+ GFP_KERNEL | __GFP_NOFAIL);
+ xefi->xefi_startblock = extp->ext_start;
+ xefi->xefi_blockcount = extp->ext_len;
+ xefi->xefi_agresv = XFS_AG_RESV_NONE;
+ xefi->xefi_owner = XFS_RMAP_OWN_UNKNOWN;
+
+ xfs_defer_add_item(dfp, &xefi->xefi_list);
+}
+
/*
* Process an extent free intent item that was recovered from
* the log. We need to free the extents that it describes.
@@ -666,6 +684,7 @@ xfs_efi_item_recover(
struct xfs_mount *mp = lip->li_log->l_mp;
struct xfs_efd_log_item *efdp;
struct xfs_trans *tp;
+ struct xfs_extent_free_item *fake;
int i;
int error = 0;
bool requeue_only = false;
@@ -683,6 +702,8 @@ xfs_efi_item_recover(
sizeof(efip->efi_format));
return -EFSCORRUPTED;
}
+
+ xfs_efi_recover_work(mp, dfp, &efip->efi_format.efi_extents[i]);
}
resv = xlog_recover_resv(&M_RES(mp)->tr_itruncate);
@@ -693,22 +714,11 @@ xfs_efi_item_recover(
efdp = xfs_trans_get_efd(tp, efip, efip->efi_format.efi_nextents);
xlog_recover_transfer_intent(tp, dfp);
- for (i = 0; i < efip->efi_format.efi_nextents; i++) {
- struct xfs_extent_free_item fake = {
- .xefi_owner = XFS_RMAP_OWN_UNKNOWN,
- .xefi_agresv = XFS_AG_RESV_NONE,
- };
- struct xfs_extent *extp;
-
- extp = &efip->efi_format.efi_extents[i];
-
- fake.xefi_startblock = extp->ext_start;
- fake.xefi_blockcount = extp->ext_len;
-
+ list_for_each_entry(fake, &dfp->dfp_work, xefi_list) {
if (!requeue_only) {
- xfs_extent_free_get_group(mp, &fake);
- error = xfs_trans_free_extent(tp, efdp, &fake);
- xfs_extent_free_put_group(&fake);
+ xfs_extent_free_get_group(mp, fake);
+ error = xfs_trans_free_extent(tp, efdp, fake);
+ xfs_extent_free_put_group(fake);
}
/*
@@ -717,10 +727,10 @@ xfs_efi_item_recover(
* run again later with a new transaction context.
*/
if (error == -EAGAIN || requeue_only) {
- error = xfs_free_extent_later(tp, fake.xefi_startblock,
- fake.xefi_blockcount,
+ error = xfs_free_extent_later(tp, fake->xefi_startblock,
+ fake->xefi_blockcount,
&XFS_RMAP_OINFO_ANY_OWNER,
- fake.xefi_agresv);
+ fake->xefi_agresv);
if (!error) {
requeue_only = true;
continue;
@@ -729,7 +739,8 @@ xfs_efi_item_recover(
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- extp, sizeof(*extp));
+ &efip->efi_format,
+ sizeof(efip->efi_format));
if (error)
goto abort_error;
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index f1b2592238022e..4ffc34e6f0a079 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -468,6 +468,23 @@ xfs_cui_validate_phys(
return xfs_verify_fsbext(mp, pmap->pe_startblock, pmap->pe_len);
}
+static inline void
+xfs_cui_recover_work(
+ struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp,
+ struct xfs_phys_extent *pmap)
+{
+ struct xfs_refcount_intent *ri;
+
+ ri = kmem_cache_alloc(xfs_refcount_intent_cache,
+ GFP_NOFS | __GFP_NOFAIL);
+ ri->ri_type = pmap->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK;
+ ri->ri_startblock = pmap->pe_startblock;
+ ri->ri_blockcount = pmap->pe_len;
+
+ xfs_defer_add_item(dfp, &ri->ri_list);
+}
+
/*
* Process a refcount update intent item that was recovered from the log.
* We need to update the refcountbt.
@@ -484,7 +501,7 @@ xfs_cui_item_recover(
struct xfs_trans *tp;
struct xfs_btree_cur *rcur = NULL;
struct xfs_mount *mp = lip->li_log->l_mp;
- unsigned int refc_type;
+ struct xfs_refcount_intent *fake;
bool requeue_only = false;
int i;
int error = 0;
@@ -502,6 +519,8 @@ xfs_cui_item_recover(
sizeof(cuip->cui_format));
return -EFSCORRUPTED;
}
+
+ xfs_cui_recover_work(mp, dfp, &cuip->cui_format.cui_extents[i]);
}
/*
@@ -525,35 +544,12 @@ xfs_cui_item_recover(
cudp = xfs_trans_get_cud(tp, cuip);
xlog_recover_transfer_intent(tp, dfp);
- for (i = 0; i < cuip->cui_format.cui_nextents; i++) {
- struct xfs_refcount_intent fake = { };
- struct xfs_phys_extent *pmap;
-
- pmap = &cuip->cui_format.cui_extents[i];
- refc_type = pmap->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK;
- switch (refc_type) {
- case XFS_REFCOUNT_INCREASE:
- case XFS_REFCOUNT_DECREASE:
- case XFS_REFCOUNT_ALLOC_COW:
- case XFS_REFCOUNT_FREE_COW:
- fake.ri_type = refc_type;
- break;
- default:
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- &cuip->cui_format,
- sizeof(cuip->cui_format));
- error = -EFSCORRUPTED;
- goto abort_error;
- }
-
- fake.ri_startblock = pmap->pe_startblock;
- fake.ri_blockcount = pmap->pe_len;
-
+ list_for_each_entry(fake, &dfp->dfp_work, ri_list) {
if (!requeue_only) {
- xfs_refcount_update_get_group(mp, &fake);
+ xfs_refcount_update_get_group(mp, fake);
error = xfs_trans_log_finish_refcount_update(tp, cudp,
- &fake, &rcur);
- xfs_refcount_update_put_group(&fake);
+ fake, &rcur);
+ xfs_refcount_update_put_group(fake);
}
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
@@ -563,13 +559,13 @@ xfs_cui_item_recover(
goto abort_error;
/* Requeue what we didn't finish. */
- if (fake.ri_blockcount > 0) {
+ if (fake->ri_blockcount > 0) {
struct xfs_bmbt_irec irec = {
- .br_startblock = fake.ri_startblock,
- .br_blockcount = fake.ri_blockcount,
+ .br_startblock = fake->ri_startblock,
+ .br_blockcount = fake->ri_blockcount,
};
- switch (fake.ri_type) {
+ switch (fake->ri_type) {
case XFS_REFCOUNT_INCREASE:
xfs_refcount_increase_extent(tp, &irec);
break;
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 5e8a02d2b045de..9fb3ae4bfd5915 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -498,6 +498,58 @@ xfs_rui_validate_map(
return xfs_verify_fsbext(mp, map->me_startblock, map->me_len);
}
+static inline void
+xfs_rui_recover_work(
+ struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp,
+ const struct xfs_map_extent *map)
+{
+ struct xfs_rmap_intent *ri;
+
+ ri = kmem_cache_alloc(xfs_rmap_intent_cache, GFP_NOFS | __GFP_NOFAIL);
+
+ switch (map->me_flags & XFS_RMAP_EXTENT_TYPE_MASK) {
+ case XFS_RMAP_EXTENT_MAP:
+ ri->ri_type = XFS_RMAP_MAP;
+ break;
+ case XFS_RMAP_EXTENT_MAP_SHARED:
+ ri->ri_type = XFS_RMAP_MAP_SHARED;
+ break;
+ case XFS_RMAP_EXTENT_UNMAP:
+ ri->ri_type = XFS_RMAP_UNMAP;
+ break;
+ case XFS_RMAP_EXTENT_UNMAP_SHARED:
+ ri->ri_type = XFS_RMAP_UNMAP_SHARED;
+ break;
+ case XFS_RMAP_EXTENT_CONVERT:
+ ri->ri_type = XFS_RMAP_CONVERT;
+ break;
+ case XFS_RMAP_EXTENT_CONVERT_SHARED:
+ ri->ri_type = XFS_RMAP_CONVERT_SHARED;
+ break;
+ case XFS_RMAP_EXTENT_ALLOC:
+ ri->ri_type = XFS_RMAP_ALLOC;
+ break;
+ case XFS_RMAP_EXTENT_FREE:
+ ri->ri_type = XFS_RMAP_FREE;
+ break;
+ default:
+ ASSERT(0);
+ return;
+ }
+
+ ri->ri_owner = map->me_owner;
+ ri->ri_whichfork = (map->me_flags & XFS_RMAP_EXTENT_ATTR_FORK) ?
+ XFS_ATTR_FORK : XFS_DATA_FORK;
+ ri->ri_bmap.br_startblock = map->me_startblock;
+ ri->ri_bmap.br_startoff = map->me_startoff;
+ ri->ri_bmap.br_blockcount = map->me_len;
+ ri->ri_bmap.br_state = (map->me_flags & XFS_RMAP_EXTENT_UNWRITTEN) ?
+ XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+
+ xfs_defer_add_item(dfp, &ri->ri_list);
+}
+
/*
* Process an rmap update intent item that was recovered from the log.
* We need to update the rmapbt.
@@ -514,6 +566,7 @@ xfs_rui_item_recover(
struct xfs_trans *tp;
struct xfs_btree_cur *rcur = NULL;
struct xfs_mount *mp = lip->li_log->l_mp;
+ struct xfs_rmap_intent *fake;
int i;
int error = 0;
@@ -530,6 +583,8 @@ xfs_rui_item_recover(
sizeof(ruip->rui_format));
return -EFSCORRUPTED;
}
+
+ xfs_rui_recover_work(mp, dfp, &ruip->rui_format.rui_extents[i]);
}
resv = xlog_recover_resv(&M_RES(mp)->tr_itruncate);
@@ -541,60 +596,15 @@ xfs_rui_item_recover(
rudp = xfs_trans_get_rud(tp, ruip);
xlog_recover_transfer_intent(tp, dfp);
- for (i = 0; i < ruip->rui_format.rui_nextents; i++) {
- struct xfs_rmap_intent fake = { };
- struct xfs_map_extent *map;
-
- map = &ruip->rui_format.rui_extents[i];
- switch (map->me_flags & XFS_RMAP_EXTENT_TYPE_MASK) {
- case XFS_RMAP_EXTENT_MAP:
- fake.ri_type = XFS_RMAP_MAP;
- break;
- case XFS_RMAP_EXTENT_MAP_SHARED:
- fake.ri_type = XFS_RMAP_MAP_SHARED;
- break;
- case XFS_RMAP_EXTENT_UNMAP:
- fake.ri_type = XFS_RMAP_UNMAP;
- break;
- case XFS_RMAP_EXTENT_UNMAP_SHARED:
- fake.ri_type = XFS_RMAP_UNMAP_SHARED;
- break;
- case XFS_RMAP_EXTENT_CONVERT:
- fake.ri_type = XFS_RMAP_CONVERT;
- break;
- case XFS_RMAP_EXTENT_CONVERT_SHARED:
- fake.ri_type = XFS_RMAP_CONVERT_SHARED;
- break;
- case XFS_RMAP_EXTENT_ALLOC:
- fake.ri_type = XFS_RMAP_ALLOC;
- break;
- case XFS_RMAP_EXTENT_FREE:
- fake.ri_type = XFS_RMAP_FREE;
- break;
- default:
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- &ruip->rui_format,
- sizeof(ruip->rui_format));
- error = -EFSCORRUPTED;
- goto abort_error;
- }
-
- fake.ri_owner = map->me_owner;
- fake.ri_whichfork = (map->me_flags & XFS_RMAP_EXTENT_ATTR_FORK) ?
- XFS_ATTR_FORK : XFS_DATA_FORK;
- fake.ri_bmap.br_startblock = map->me_startblock;
- fake.ri_bmap.br_startoff = map->me_startoff;
- fake.ri_bmap.br_blockcount = map->me_len;
- fake.ri_bmap.br_state = (map->me_flags & XFS_RMAP_EXTENT_UNWRITTEN) ?
- XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
-
- xfs_rmap_update_get_group(mp, &fake);
- error = xfs_trans_log_finish_rmap_update(tp, rudp, &fake,
+ list_for_each_entry(fake, &dfp->dfp_work, ri_list) {
+ xfs_rmap_update_get_group(mp, fake);
+ error = xfs_trans_log_finish_rmap_update(tp, rudp, fake,
&rcur);
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- map, sizeof(*map));
- xfs_rmap_update_put_group(&fake);
+ &ruip->rui_format,
+ sizeof(ruip->rui_format));
+ xfs_rmap_update_put_group(fake);
if (error)
goto abort_error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0056/1266] xfs: dump the recovered xattri log item if corruption happens
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0055/1266] xfs: recreate work items when recovering intent items Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0057/1266] xfs: use xfs_defer_finish_one to finish recovered work items Greg Kroah-Hartman
` (942 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Fedor Pchelkin, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit a51489e140d302c7afae763eacf882a23513f7e4 upstream.
If xfs_attri_item_recover receives a corruption error when it tries to
finish a recovered log intent item, it should dump the log item for
debugging, just like all the other log intent items.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/xfs_attr_item.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/xfs/xfs_attr_item.c b/fs/xfs/xfs_attr_item.c
index 929a53db22462f..94e16f51a5ac52 100644
--- a/fs/xfs/xfs_attr_item.c
+++ b/fs/xfs/xfs_attr_item.c
@@ -672,6 +672,10 @@ xfs_attri_item_recover(
xfs_irele(ip);
return 0;
}
+ if (error == -EFSCORRUPTED)
+ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+ &attrip->attri_format,
+ sizeof(attrip->attri_format));
if (error) {
xfs_trans_cancel(tp);
goto out_unlock;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0057/1266] xfs: use xfs_defer_finish_one to finish recovered work items
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0056/1266] xfs: dump the recovered xattri log item if corruption happens Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0058/1266] xfs: move ->iop_recover to xfs_defer_op_type Greg Kroah-Hartman
` (941 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Fedor Pchelkin, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit e5f1a5146ec35f3ed5d7f5ac7807a10c0062b6b8 upstream.
Get rid of the open-coded calls to xfs_defer_finish_one. This also
means that the recovery transaction takes care of cleaning up the dfp,
and we have solved (I hope) all the ownership issues in recovery.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_defer.c | 2 +-
fs/xfs/libxfs/xfs_defer.h | 1 +
fs/xfs/libxfs/xfs_log_recover.h | 2 +-
fs/xfs/xfs_attr_item.c | 20 +----------
fs/xfs/xfs_bmap_item.c | 24 ++++---------
fs/xfs/xfs_extfree_item.c | 45 +++++-------------------
fs/xfs/xfs_log_recover.c | 22 +++++++-----
fs/xfs/xfs_refcount_item.c | 61 +++++----------------------------
fs/xfs/xfs_rmap_item.c | 29 +++++-----------
9 files changed, 49 insertions(+), 157 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 8fb523e4f66931..eb262ea061226b 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -484,7 +484,7 @@ xfs_defer_relog(
* Log an intent-done item for the first pending intent, and finish the work
* items.
*/
-static int
+int
xfs_defer_finish_one(
struct xfs_trans *tp,
struct xfs_defer_pending *dfp)
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index bef5823f61fb82..c1a648e9917489 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -41,6 +41,7 @@ void xfs_defer_add(struct xfs_trans *tp, enum xfs_defer_ops_type type,
struct list_head *h);
int xfs_defer_finish_noroll(struct xfs_trans **tp);
int xfs_defer_finish(struct xfs_trans **tp);
+int xfs_defer_finish_one(struct xfs_trans *tp, struct xfs_defer_pending *dfp);
void xfs_defer_cancel(struct xfs_trans *);
void xfs_defer_move(struct xfs_trans *dtp, struct xfs_trans *stp);
diff --git a/fs/xfs/libxfs/xfs_log_recover.h b/fs/xfs/libxfs/xfs_log_recover.h
index 13583df9f2397f..52162a17fc5e3a 100644
--- a/fs/xfs/libxfs/xfs_log_recover.h
+++ b/fs/xfs/libxfs/xfs_log_recover.h
@@ -155,7 +155,7 @@ xlog_recover_resv(const struct xfs_trans_res *r)
void xlog_recover_intent_item(struct xlog *log, struct xfs_log_item *lip,
xfs_lsn_t lsn, unsigned int dfp_type);
-void xlog_recover_transfer_intent(struct xfs_trans *tp,
+int xlog_recover_finish_intent(struct xfs_trans *tp,
struct xfs_defer_pending *dfp);
#endif /* __XFS_LOG_RECOVER_H__ */
diff --git a/fs/xfs/xfs_attr_item.c b/fs/xfs/xfs_attr_item.c
index 94e16f51a5ac52..b7bf99d8c4739e 100644
--- a/fs/xfs/xfs_attr_item.c
+++ b/fs/xfs/xfs_attr_item.c
@@ -625,7 +625,6 @@ xfs_attri_item_recover(
struct xfs_attri_log_nameval *nv = attrip->attri_nameval;
int error;
int total;
- struct xfs_attrd_log_item *done_item = NULL;
/*
* First check the validity of the attr described by the ATTRI. If any
@@ -651,27 +650,10 @@ xfs_attri_item_recover(
return error;
args->trans = tp;
- done_item = xfs_trans_get_attrd(tp, attrip);
- xlog_recover_transfer_intent(tp, dfp);
-
xfs_ilock(ip, XFS_ILOCK_EXCL);
xfs_trans_ijoin(tp, ip, 0);
- error = xfs_xattri_finish_update(attr, done_item);
- if (error == -EAGAIN) {
- /*
- * There's more work to do, so add the intent item to this
- * transaction so that we can continue it later.
- */
- xfs_defer_add(tp, XFS_DEFER_OPS_TYPE_ATTR, &attr->xattri_list);
- error = xfs_defer_ops_capture_and_commit(tp, capture_list);
- if (error)
- goto out_unlock;
-
- xfs_iunlock(ip, XFS_ILOCK_EXCL);
- xfs_irele(ip);
- return 0;
- }
+ error = xlog_recover_finish_intent(tp, dfp);
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
&attrip->attri_format,
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 1be29b3db3e710..2d91ade24b689a 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -498,6 +498,7 @@ xfs_bui_recover_work(
bi->bi_bmap.br_blockcount = map->me_len;
bi->bi_bmap.br_state = (map->me_flags & XFS_BMAP_EXTENT_UNWRITTEN) ?
XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+ xfs_bmap_update_get_group(mp, bi);
xfs_defer_add_item(dfp, &bi->bi_list);
return bi;
@@ -519,8 +520,7 @@ xfs_bui_item_recover(
struct xfs_inode *ip = NULL;
struct xfs_mount *mp = lip->li_log->l_mp;
struct xfs_map_extent *map;
- struct xfs_bud_log_item *budp;
- struct xfs_bmap_intent *fake;
+ struct xfs_bmap_intent *work;
int iext_delta;
int error = 0;
@@ -531,7 +531,7 @@ xfs_bui_item_recover(
}
map = &buip->bui_format.bui_extents[0];
- fake = xfs_bui_recover_work(mp, dfp, map);
+ work = xfs_bui_recover_work(mp, dfp, map);
error = xlog_recover_iget(mp, map->me_owner, &ip);
if (error)
@@ -544,39 +544,29 @@ xfs_bui_item_recover(
if (error)
goto err_rele;
- budp = xfs_trans_get_bud(tp, buip);
- xlog_recover_transfer_intent(tp, dfp);
-
xfs_ilock(ip, XFS_ILOCK_EXCL);
xfs_trans_ijoin(tp, ip, 0);
- if (fake->bi_type == XFS_BMAP_MAP)
+ if (work->bi_type == XFS_BMAP_MAP)
iext_delta = XFS_IEXT_ADD_NOSPLIT_CNT;
else
iext_delta = XFS_IEXT_PUNCH_HOLE_CNT;
- error = xfs_iext_count_may_overflow(ip, fake->bi_whichfork, iext_delta);
+ error = xfs_iext_count_may_overflow(ip, work->bi_whichfork, iext_delta);
if (error == -EFBIG)
error = xfs_iext_count_upgrade(tp, ip, iext_delta);
if (error)
goto err_cancel;
- fake->bi_owner = ip;
+ work->bi_owner = ip;
- xfs_bmap_update_get_group(mp, fake);
- error = xfs_trans_log_finish_bmap_update(tp, budp, fake);
+ error = xlog_recover_finish_intent(tp, dfp);
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
&buip->bui_format, sizeof(buip->bui_format));
- xfs_bmap_update_put_group(fake);
if (error)
goto err_cancel;
- if (fake->bi_bmap.br_blockcount > 0) {
- ASSERT(fake->bi_type == XFS_BMAP_UNMAP);
- xfs_bmap_unmap_extent(tp, ip, &fake->bi_bmap);
- }
-
/*
* Commit transaction, which frees the transaction and saves the inode
* for later replay activities.
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 41108a0b60c91a..6a434ade486c93 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -665,6 +665,7 @@ xfs_efi_recover_work(
xefi->xefi_blockcount = extp->ext_len;
xefi->xefi_agresv = XFS_AG_RESV_NONE;
xefi->xefi_owner = XFS_RMAP_OWN_UNKNOWN;
+ xfs_extent_free_get_group(mp, xefi);
xfs_defer_add_item(dfp, &xefi->xefi_list);
}
@@ -682,12 +683,9 @@ xfs_efi_item_recover(
struct xfs_log_item *lip = dfp->dfp_intent;
struct xfs_efi_log_item *efip = EFI_ITEM(lip);
struct xfs_mount *mp = lip->li_log->l_mp;
- struct xfs_efd_log_item *efdp;
struct xfs_trans *tp;
- struct xfs_extent_free_item *fake;
int i;
int error = 0;
- bool requeue_only = false;
/*
* First check the validity of the extents described by the
@@ -711,40 +709,13 @@ xfs_efi_item_recover(
if (error)
return error;
- efdp = xfs_trans_get_efd(tp, efip, efip->efi_format.efi_nextents);
- xlog_recover_transfer_intent(tp, dfp);
-
- list_for_each_entry(fake, &dfp->dfp_work, xefi_list) {
- if (!requeue_only) {
- xfs_extent_free_get_group(mp, fake);
- error = xfs_trans_free_extent(tp, efdp, fake);
- xfs_extent_free_put_group(fake);
- }
-
- /*
- * If we can't free the extent without potentially deadlocking,
- * requeue the rest of the extents to a new so that they get
- * run again later with a new transaction context.
- */
- if (error == -EAGAIN || requeue_only) {
- error = xfs_free_extent_later(tp, fake->xefi_startblock,
- fake->xefi_blockcount,
- &XFS_RMAP_OINFO_ANY_OWNER,
- fake->xefi_agresv);
- if (!error) {
- requeue_only = true;
- continue;
- }
- }
-
- if (error == -EFSCORRUPTED)
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- &efip->efi_format,
- sizeof(efip->efi_format));
- if (error)
- goto abort_error;
-
- }
+ error = xlog_recover_finish_intent(tp, dfp);
+ if (error == -EFSCORRUPTED)
+ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+ &efip->efi_format,
+ sizeof(efip->efi_format));
+ if (error)
+ goto abort_error;
return xfs_defer_ops_capture_and_commit(tp, capture_list);
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index f708bf4104b1a3..c668164defdc13 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2584,7 +2584,8 @@ xlog_recover_process_intents(
* replayed in the wrong order!
*
* The recovery function can free the log item, so we must not
- * access lip after it returns.
+ * access lip after it returns. It must dispose of @dfp if it
+ * returns 0.
*/
error = ops->iop_recover(dfp, &capture_list);
if (error) {
@@ -2592,8 +2593,6 @@ xlog_recover_process_intents(
ops->iop_recover);
break;
}
-
- xfs_defer_cancel_recovery(log->l_mp, dfp);
}
if (error)
goto err;
@@ -2627,15 +2626,22 @@ xlog_recover_cancel_intents(
}
/*
- * Transfer ownership of the recovered log intent item to the recovery
- * transaction.
+ * Transfer ownership of the recovered pending work to the recovery transaction
+ * and try to finish the work. If there is more work to be done, the dfp will
+ * remain attached to the transaction. If not, the dfp is freed.
*/
-void
-xlog_recover_transfer_intent(
+int
+xlog_recover_finish_intent(
struct xfs_trans *tp,
struct xfs_defer_pending *dfp)
{
- dfp->dfp_intent = NULL;
+ int error;
+
+ list_move(&dfp->dfp_list, &tp->t_dfops);
+ error = xfs_defer_finish_one(tp, dfp);
+ if (error == -EAGAIN)
+ return 0;
+ return error;
}
/*
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index 4ffc34e6f0a079..f561ca73c784ff 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -481,6 +481,7 @@ xfs_cui_recover_work(
ri->ri_type = pmap->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK;
ri->ri_startblock = pmap->pe_startblock;
ri->ri_blockcount = pmap->pe_len;
+ xfs_refcount_update_get_group(mp, ri);
xfs_defer_add_item(dfp, &ri->ri_list);
}
@@ -497,12 +498,8 @@ xfs_cui_item_recover(
struct xfs_trans_res resv;
struct xfs_log_item *lip = dfp->dfp_intent;
struct xfs_cui_log_item *cuip = CUI_ITEM(lip);
- struct xfs_cud_log_item *cudp;
struct xfs_trans *tp;
- struct xfs_btree_cur *rcur = NULL;
struct xfs_mount *mp = lip->li_log->l_mp;
- struct xfs_refcount_intent *fake;
- bool requeue_only = false;
int i;
int error = 0;
@@ -541,59 +538,17 @@ xfs_cui_item_recover(
if (error)
return error;
- cudp = xfs_trans_get_cud(tp, cuip);
- xlog_recover_transfer_intent(tp, dfp);
-
- list_for_each_entry(fake, &dfp->dfp_work, ri_list) {
- if (!requeue_only) {
- xfs_refcount_update_get_group(mp, fake);
- error = xfs_trans_log_finish_refcount_update(tp, cudp,
- fake, &rcur);
- xfs_refcount_update_put_group(fake);
- }
- if (error == -EFSCORRUPTED)
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- &cuip->cui_format,
- sizeof(cuip->cui_format));
- if (error)
- goto abort_error;
-
- /* Requeue what we didn't finish. */
- if (fake->ri_blockcount > 0) {
- struct xfs_bmbt_irec irec = {
- .br_startblock = fake->ri_startblock,
- .br_blockcount = fake->ri_blockcount,
- };
-
- switch (fake->ri_type) {
- case XFS_REFCOUNT_INCREASE:
- xfs_refcount_increase_extent(tp, &irec);
- break;
- case XFS_REFCOUNT_DECREASE:
- xfs_refcount_decrease_extent(tp, &irec);
- break;
- case XFS_REFCOUNT_ALLOC_COW:
- xfs_refcount_alloc_cow_extent(tp,
- irec.br_startblock,
- irec.br_blockcount);
- break;
- case XFS_REFCOUNT_FREE_COW:
- xfs_refcount_free_cow_extent(tp,
- irec.br_startblock,
- irec.br_blockcount);
- break;
- default:
- ASSERT(0);
- }
- requeue_only = true;
- }
- }
+ error = xlog_recover_finish_intent(tp, dfp);
+ if (error == -EFSCORRUPTED)
+ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+ &cuip->cui_format,
+ sizeof(cuip->cui_format));
+ if (error)
+ goto abort_error;
- xfs_refcount_finish_one_cleanup(tp, rcur, error);
return xfs_defer_ops_capture_and_commit(tp, capture_list);
abort_error:
- xfs_refcount_finish_one_cleanup(tp, rcur, error);
xfs_trans_cancel(tp);
return error;
}
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 9fb3ae4bfd5915..23e736179894b3 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -546,6 +546,7 @@ xfs_rui_recover_work(
ri->ri_bmap.br_blockcount = map->me_len;
ri->ri_bmap.br_state = (map->me_flags & XFS_RMAP_EXTENT_UNWRITTEN) ?
XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+ xfs_rmap_update_get_group(mp, ri);
xfs_defer_add_item(dfp, &ri->ri_list);
}
@@ -562,11 +563,8 @@ xfs_rui_item_recover(
struct xfs_trans_res resv;
struct xfs_log_item *lip = dfp->dfp_intent;
struct xfs_rui_log_item *ruip = RUI_ITEM(lip);
- struct xfs_rud_log_item *rudp;
struct xfs_trans *tp;
- struct xfs_btree_cur *rcur = NULL;
struct xfs_mount *mp = lip->li_log->l_mp;
- struct xfs_rmap_intent *fake;
int i;
int error = 0;
@@ -593,28 +591,17 @@ xfs_rui_item_recover(
if (error)
return error;
- rudp = xfs_trans_get_rud(tp, ruip);
- xlog_recover_transfer_intent(tp, dfp);
-
- list_for_each_entry(fake, &dfp->dfp_work, ri_list) {
- xfs_rmap_update_get_group(mp, fake);
- error = xfs_trans_log_finish_rmap_update(tp, rudp, fake,
- &rcur);
- if (error == -EFSCORRUPTED)
- XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
- &ruip->rui_format,
- sizeof(ruip->rui_format));
- xfs_rmap_update_put_group(fake);
- if (error)
- goto abort_error;
-
- }
+ error = xlog_recover_finish_intent(tp, dfp);
+ if (error == -EFSCORRUPTED)
+ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+ &ruip->rui_format,
+ sizeof(ruip->rui_format));
+ if (error)
+ goto abort_error;
- xfs_rmap_finish_one_cleanup(tp, rcur, error);
return xfs_defer_ops_capture_and_commit(tp, capture_list);
abort_error:
- xfs_rmap_finish_one_cleanup(tp, rcur, error);
xfs_trans_cancel(tp);
return error;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0058/1266] xfs: move ->iop_recover to xfs_defer_op_type
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0057/1266] xfs: use xfs_defer_finish_one to finish recovered work items Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0059/1266] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Greg Kroah-Hartman
` (940 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Fedor Pchelkin, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit db7ccc0bac2add5a41b66578e376b49328fc99d0 upstream.
Finish off the series by moving the intent item recovery function
pointer to the xfs_defer_op_type struct, since this is really a deferred
work function now.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_defer.c | 17 +++++++++++++
fs/xfs/libxfs/xfs_defer.h | 4 +++
fs/xfs/libxfs/xfs_log_recover.h | 2 ++
fs/xfs/xfs_attr_item.c | 21 +++++++++-------
fs/xfs/xfs_bmap_item.c | 39 ++++++++++++++++--------------
fs/xfs/xfs_extfree_item.c | 43 +++++++++++++++++----------------
fs/xfs/xfs_log_recover.c | 19 ++++++---------
fs/xfs/xfs_refcount_item.c | 24 +++++++++---------
fs/xfs/xfs_rmap_item.c | 24 +++++++++---------
fs/xfs/xfs_trans.h | 4 ---
10 files changed, 109 insertions(+), 88 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index eb262ea061226b..dd565e4e3daf06 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -713,6 +713,23 @@ xfs_defer_cancel_recovery(
xfs_defer_pending_cancel_work(mp, dfp);
}
+/* Replay the deferred work item created from a recovered log intent item. */
+int
+xfs_defer_finish_recovery(
+ struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp,
+ struct list_head *capture_list)
+{
+ const struct xfs_defer_op_type *ops = defer_op_types[dfp->dfp_type];
+ int error;
+
+ error = ops->recover_work(dfp, capture_list);
+ if (error)
+ trace_xlog_intent_recovery_failed(mp, error,
+ ops->recover_work);
+ return error;
+}
+
/*
* Move deferred ops from one transaction to another and reset the source to
* initial state. This is primarily used to carry state forward across
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index c1a648e9917489..ef86a7f9b05950 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -57,6 +57,8 @@ struct xfs_defer_op_type {
void (*finish_cleanup)(struct xfs_trans *tp,
struct xfs_btree_cur *state, int error);
void (*cancel_item)(struct list_head *item);
+ int (*recover_work)(struct xfs_defer_pending *dfp,
+ struct list_head *capture_list);
unsigned int max_items;
};
@@ -130,6 +132,8 @@ void xfs_defer_start_recovery(struct xfs_log_item *lip,
enum xfs_defer_ops_type dfp_type, struct list_head *r_dfops);
void xfs_defer_cancel_recovery(struct xfs_mount *mp,
struct xfs_defer_pending *dfp);
+int xfs_defer_finish_recovery(struct xfs_mount *mp,
+ struct xfs_defer_pending *dfp, struct list_head *capture_list);
static inline void
xfs_defer_add_item(
diff --git a/fs/xfs/libxfs/xfs_log_recover.h b/fs/xfs/libxfs/xfs_log_recover.h
index 52162a17fc5e3a..c8e5d912895bcd 100644
--- a/fs/xfs/libxfs/xfs_log_recover.h
+++ b/fs/xfs/libxfs/xfs_log_recover.h
@@ -153,6 +153,8 @@ xlog_recover_resv(const struct xfs_trans_res *r)
return ret;
}
+struct xfs_defer_pending;
+
void xlog_recover_intent_item(struct xlog *log, struct xfs_log_item *lip,
xfs_lsn_t lsn, unsigned int dfp_type);
int xlog_recover_finish_intent(struct xfs_trans *tp,
diff --git a/fs/xfs/xfs_attr_item.c b/fs/xfs/xfs_attr_item.c
index b7bf99d8c4739e..1628e797a6f123 100644
--- a/fs/xfs/xfs_attr_item.c
+++ b/fs/xfs/xfs_attr_item.c
@@ -551,12 +551,17 @@ xfs_attri_recover_work(
struct xfs_mount *mp,
struct xfs_defer_pending *dfp,
struct xfs_attri_log_format *attrp,
- struct xfs_inode *ip,
+ struct xfs_inode **ipp,
struct xfs_attri_log_nameval *nv)
{
struct xfs_attr_intent *attr;
struct xfs_da_args *args;
int local;
+ int error;
+
+ error = xlog_recover_iget(mp, attrp->alfi_ino, ipp);
+ if (error)
+ return ERR_PTR(error);
attr = kmem_zalloc(sizeof(struct xfs_attr_intent) +
sizeof(struct xfs_da_args), KM_NOFS);
@@ -574,7 +579,7 @@ xfs_attri_recover_work(
attr->xattri_nameval = xfs_attri_log_nameval_get(nv);
ASSERT(attr->xattri_nameval);
- args->dp = ip;
+ args->dp = *ipp;
args->geo = mp->m_attr_geo;
args->whichfork = XFS_ATTR_FORK;
args->name = nv->name.i_addr;
@@ -609,7 +614,7 @@ xfs_attri_recover_work(
* delete the attr that it describes.
*/
STATIC int
-xfs_attri_item_recover(
+xfs_attr_recover_work(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
@@ -636,11 +641,9 @@ xfs_attri_item_recover(
nv->name.i_len))
return -EFSCORRUPTED;
- error = xlog_recover_iget(mp, attrp->alfi_ino, &ip);
- if (error)
- return error;
-
- attr = xfs_attri_recover_work(mp, dfp, attrp, ip, nv);
+ attr = xfs_attri_recover_work(mp, dfp, attrp, &ip, nv);
+ if (IS_ERR(attr))
+ return PTR_ERR(attr);
args = attr->xattri_da_args;
xfs_init_attr_trans(args, &resv, &total);
@@ -890,6 +893,7 @@ const struct xfs_defer_op_type xfs_attr_defer_type = {
.create_done = xfs_attr_create_done,
.finish_item = xfs_attr_finish_item,
.cancel_item = xfs_attr_cancel_item,
+ .recover_work = xfs_attr_recover_work,
};
/*
@@ -926,7 +930,6 @@ static const struct xfs_item_ops xfs_attri_item_ops = {
.iop_format = xfs_attri_item_format,
.iop_unpin = xfs_attri_item_unpin,
.iop_release = xfs_attri_item_release,
- .iop_recover = xfs_attri_item_recover,
.iop_match = xfs_attri_item_match,
.iop_relog = xfs_attri_item_relog,
};
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 2d91ade24b689a..59b438ac37a254 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -438,15 +438,6 @@ xfs_bmap_update_cancel_item(
kmem_cache_free(xfs_bmap_intent_cache, bi);
}
-const struct xfs_defer_op_type xfs_bmap_update_defer_type = {
- .max_items = XFS_BUI_MAX_FAST_EXTENTS,
- .create_intent = xfs_bmap_update_create_intent,
- .abort_intent = xfs_bmap_update_abort_intent,
- .create_done = xfs_bmap_update_create_done,
- .finish_item = xfs_bmap_update_finish_item,
- .cancel_item = xfs_bmap_update_cancel_item,
-};
-
/* Is this recovered BUI ok? */
static inline bool
xfs_bui_validate(
@@ -485,9 +476,15 @@ static inline struct xfs_bmap_intent *
xfs_bui_recover_work(
struct xfs_mount *mp,
struct xfs_defer_pending *dfp,
+ struct xfs_inode **ipp,
struct xfs_map_extent *map)
{
struct xfs_bmap_intent *bi;
+ int error;
+
+ error = xlog_recover_iget(mp, map->me_owner, ipp);
+ if (error)
+ return ERR_PTR(error);
bi = kmem_cache_zalloc(xfs_bmap_intent_cache, GFP_NOFS | __GFP_NOFAIL);
bi->bi_whichfork = (map->me_flags & XFS_BMAP_EXTENT_ATTR_FORK) ?
@@ -498,6 +495,7 @@ xfs_bui_recover_work(
bi->bi_bmap.br_blockcount = map->me_len;
bi->bi_bmap.br_state = (map->me_flags & XFS_BMAP_EXTENT_UNWRITTEN) ?
XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
+ bi->bi_owner = *ipp;
xfs_bmap_update_get_group(mp, bi);
xfs_defer_add_item(dfp, &bi->bi_list);
@@ -509,7 +507,7 @@ xfs_bui_recover_work(
* We need to update some inode's bmbt.
*/
STATIC int
-xfs_bui_item_recover(
+xfs_bmap_recover_work(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
@@ -531,11 +529,9 @@ xfs_bui_item_recover(
}
map = &buip->bui_format.bui_extents[0];
- work = xfs_bui_recover_work(mp, dfp, map);
-
- error = xlog_recover_iget(mp, map->me_owner, &ip);
- if (error)
- return error;
+ work = xfs_bui_recover_work(mp, dfp, &ip, map);
+ if (IS_ERR(work))
+ return PTR_ERR(work);
/* Allocate transaction and do the work. */
resv = xlog_recover_resv(&M_RES(mp)->tr_itruncate);
@@ -558,8 +554,6 @@ xfs_bui_item_recover(
if (error)
goto err_cancel;
- work->bi_owner = ip;
-
error = xlog_recover_finish_intent(tp, dfp);
if (error == -EFSCORRUPTED)
XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
@@ -588,6 +582,16 @@ xfs_bui_item_recover(
return error;
}
+const struct xfs_defer_op_type xfs_bmap_update_defer_type = {
+ .max_items = XFS_BUI_MAX_FAST_EXTENTS,
+ .create_intent = xfs_bmap_update_create_intent,
+ .abort_intent = xfs_bmap_update_abort_intent,
+ .create_done = xfs_bmap_update_create_done,
+ .finish_item = xfs_bmap_update_finish_item,
+ .cancel_item = xfs_bmap_update_cancel_item,
+ .recover_work = xfs_bmap_recover_work,
+};
+
STATIC bool
xfs_bui_item_match(
struct xfs_log_item *lip,
@@ -628,7 +632,6 @@ static const struct xfs_item_ops xfs_bui_item_ops = {
.iop_format = xfs_bui_item_format,
.iop_unpin = xfs_bui_item_unpin,
.iop_release = xfs_bui_item_release,
- .iop_recover = xfs_bui_item_recover,
.iop_match = xfs_bui_item_match,
.iop_relog = xfs_bui_item_relog,
};
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 6a434ade486c93..49e96ffd64e0c1 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -567,15 +567,6 @@ xfs_extent_free_cancel_item(
kmem_cache_free(xfs_extfree_item_cache, xefi);
}
-const struct xfs_defer_op_type xfs_extent_free_defer_type = {
- .max_items = XFS_EFI_MAX_FAST_EXTENTS,
- .create_intent = xfs_extent_free_create_intent,
- .abort_intent = xfs_extent_free_abort_intent,
- .create_done = xfs_extent_free_create_done,
- .finish_item = xfs_extent_free_finish_item,
- .cancel_item = xfs_extent_free_cancel_item,
-};
-
/*
* AGFL blocks are accounted differently in the reserve pools and are not
* inserted into the busy extent list.
@@ -632,16 +623,6 @@ xfs_agfl_free_finish_item(
return error;
}
-/* sub-type with special handling for AGFL deferred frees */
-const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
- .max_items = XFS_EFI_MAX_FAST_EXTENTS,
- .create_intent = xfs_extent_free_create_intent,
- .abort_intent = xfs_extent_free_abort_intent,
- .create_done = xfs_extent_free_create_done,
- .finish_item = xfs_agfl_free_finish_item,
- .cancel_item = xfs_extent_free_cancel_item,
-};
-
/* Is this recovered EFI ok? */
static inline bool
xfs_efi_validate_ext(
@@ -675,7 +656,7 @@ xfs_efi_recover_work(
* the log. We need to free the extents that it describes.
*/
STATIC int
-xfs_efi_item_recover(
+xfs_extent_free_recover_work(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
@@ -724,6 +705,27 @@ xfs_efi_item_recover(
return error;
}
+const struct xfs_defer_op_type xfs_extent_free_defer_type = {
+ .max_items = XFS_EFI_MAX_FAST_EXTENTS,
+ .create_intent = xfs_extent_free_create_intent,
+ .abort_intent = xfs_extent_free_abort_intent,
+ .create_done = xfs_extent_free_create_done,
+ .finish_item = xfs_extent_free_finish_item,
+ .cancel_item = xfs_extent_free_cancel_item,
+ .recover_work = xfs_extent_free_recover_work,
+};
+
+/* sub-type with special handling for AGFL deferred frees */
+const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
+ .max_items = XFS_EFI_MAX_FAST_EXTENTS,
+ .create_intent = xfs_extent_free_create_intent,
+ .abort_intent = xfs_extent_free_abort_intent,
+ .create_done = xfs_extent_free_create_done,
+ .finish_item = xfs_agfl_free_finish_item,
+ .cancel_item = xfs_extent_free_cancel_item,
+ .recover_work = xfs_extent_free_recover_work,
+};
+
STATIC bool
xfs_efi_item_match(
struct xfs_log_item *lip,
@@ -766,7 +768,6 @@ static const struct xfs_item_ops xfs_efi_item_ops = {
.iop_format = xfs_efi_item_format,
.iop_unpin = xfs_efi_item_unpin,
.iop_release = xfs_efi_item_release,
- .iop_recover = xfs_efi_item_recover,
.iop_match = xfs_efi_item_match,
.iop_relog = xfs_efi_item_relog,
};
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index c668164defdc13..4a372e54880c0b 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2565,17 +2565,14 @@ xlog_recover_process_intents(
#endif
list_for_each_entry_safe(dfp, n, &log->r_dfops, dfp_list) {
- struct xfs_log_item *lip = dfp->dfp_intent;
- const struct xfs_item_ops *ops = lip->li_ops;
-
- ASSERT(xlog_item_is_intent(lip));
+ ASSERT(xlog_item_is_intent(dfp->dfp_intent));
/*
* We should never see a redo item with a LSN higher than
* the last transaction we found in the log at the start
* of recovery.
*/
- ASSERT(XFS_LSN_CMP(last_lsn, lip->li_lsn) >= 0);
+ ASSERT(XFS_LSN_CMP(last_lsn, dfp->dfp_intent->li_lsn) >= 0);
/*
* NOTE: If your intent processing routine can create more
@@ -2584,15 +2581,13 @@ xlog_recover_process_intents(
* replayed in the wrong order!
*
* The recovery function can free the log item, so we must not
- * access lip after it returns. It must dispose of @dfp if it
- * returns 0.
+ * access dfp->dfp_intent after it returns. It must dispose of
+ * @dfp if it returns 0.
*/
- error = ops->iop_recover(dfp, &capture_list);
- if (error) {
- trace_xlog_intent_recovery_failed(log->l_mp, error,
- ops->iop_recover);
+ error = xfs_defer_finish_recovery(log->l_mp, dfp,
+ &capture_list);
+ if (error)
break;
- }
}
if (error)
goto err;
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index f561ca73c784ff..48f1a38b272e1d 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -433,16 +433,6 @@ xfs_refcount_update_cancel_item(
kmem_cache_free(xfs_refcount_intent_cache, ri);
}
-const struct xfs_defer_op_type xfs_refcount_update_defer_type = {
- .max_items = XFS_CUI_MAX_FAST_EXTENTS,
- .create_intent = xfs_refcount_update_create_intent,
- .abort_intent = xfs_refcount_update_abort_intent,
- .create_done = xfs_refcount_update_create_done,
- .finish_item = xfs_refcount_update_finish_item,
- .finish_cleanup = xfs_refcount_finish_one_cleanup,
- .cancel_item = xfs_refcount_update_cancel_item,
-};
-
/* Is this recovered CUI ok? */
static inline bool
xfs_cui_validate_phys(
@@ -491,7 +481,7 @@ xfs_cui_recover_work(
* We need to update the refcountbt.
*/
STATIC int
-xfs_cui_item_recover(
+xfs_refcount_recover_work(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
@@ -553,6 +543,17 @@ xfs_cui_item_recover(
return error;
}
+const struct xfs_defer_op_type xfs_refcount_update_defer_type = {
+ .max_items = XFS_CUI_MAX_FAST_EXTENTS,
+ .create_intent = xfs_refcount_update_create_intent,
+ .abort_intent = xfs_refcount_update_abort_intent,
+ .create_done = xfs_refcount_update_create_done,
+ .finish_item = xfs_refcount_update_finish_item,
+ .finish_cleanup = xfs_refcount_finish_one_cleanup,
+ .cancel_item = xfs_refcount_update_cancel_item,
+ .recover_work = xfs_refcount_recover_work,
+};
+
STATIC bool
xfs_cui_item_match(
struct xfs_log_item *lip,
@@ -593,7 +594,6 @@ static const struct xfs_item_ops xfs_cui_item_ops = {
.iop_format = xfs_cui_item_format,
.iop_unpin = xfs_cui_item_unpin,
.iop_release = xfs_cui_item_release,
- .iop_recover = xfs_cui_item_recover,
.iop_match = xfs_cui_item_match,
.iop_relog = xfs_cui_item_relog,
};
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 23e736179894b3..23684bc2ab85a2 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -452,16 +452,6 @@ xfs_rmap_update_cancel_item(
kmem_cache_free(xfs_rmap_intent_cache, ri);
}
-const struct xfs_defer_op_type xfs_rmap_update_defer_type = {
- .max_items = XFS_RUI_MAX_FAST_EXTENTS,
- .create_intent = xfs_rmap_update_create_intent,
- .abort_intent = xfs_rmap_update_abort_intent,
- .create_done = xfs_rmap_update_create_done,
- .finish_item = xfs_rmap_update_finish_item,
- .finish_cleanup = xfs_rmap_finish_one_cleanup,
- .cancel_item = xfs_rmap_update_cancel_item,
-};
-
/* Is this recovered RUI ok? */
static inline bool
xfs_rui_validate_map(
@@ -556,7 +546,7 @@ xfs_rui_recover_work(
* We need to update the rmapbt.
*/
STATIC int
-xfs_rui_item_recover(
+xfs_rmap_recover_work(
struct xfs_defer_pending *dfp,
struct list_head *capture_list)
{
@@ -606,6 +596,17 @@ xfs_rui_item_recover(
return error;
}
+const struct xfs_defer_op_type xfs_rmap_update_defer_type = {
+ .max_items = XFS_RUI_MAX_FAST_EXTENTS,
+ .create_intent = xfs_rmap_update_create_intent,
+ .abort_intent = xfs_rmap_update_abort_intent,
+ .create_done = xfs_rmap_update_create_done,
+ .finish_item = xfs_rmap_update_finish_item,
+ .finish_cleanup = xfs_rmap_finish_one_cleanup,
+ .cancel_item = xfs_rmap_update_cancel_item,
+ .recover_work = xfs_rmap_recover_work,
+};
+
STATIC bool
xfs_rui_item_match(
struct xfs_log_item *lip,
@@ -646,7 +647,6 @@ static const struct xfs_item_ops xfs_rui_item_ops = {
.iop_format = xfs_rui_item_format,
.iop_unpin = xfs_rui_item_unpin,
.iop_release = xfs_rui_item_release,
- .iop_recover = xfs_rui_item_recover,
.iop_match = xfs_rui_item_match,
.iop_relog = xfs_rui_item_relog,
};
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index ead65f5f8dc329..ae32ffe9a1b15c 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -66,8 +66,6 @@ struct xfs_log_item {
{ (1u << XFS_LI_DIRTY), "DIRTY" }, \
{ (1u << XFS_LI_WHITEOUT), "WHITEOUT" }
-struct xfs_defer_pending;
-
struct xfs_item_ops {
unsigned flags;
void (*iop_size)(struct xfs_log_item *, int *, int *);
@@ -80,8 +78,6 @@ struct xfs_item_ops {
xfs_lsn_t (*iop_committed)(struct xfs_log_item *, xfs_lsn_t);
uint (*iop_push)(struct xfs_log_item *, struct list_head *);
void (*iop_release)(struct xfs_log_item *);
- int (*iop_recover)(struct xfs_defer_pending *dfp,
- struct list_head *capture_list);
bool (*iop_match)(struct xfs_log_item *item, uint64_t id);
struct xfs_log_item *(*iop_relog)(struct xfs_log_item *intent,
struct xfs_trans *tp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0059/1266] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0058/1266] xfs: move ->iop_recover to xfs_defer_op_type Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0060/1266] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
` (939 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudia Draghicescu,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudia Draghicescu <claudia.rosu@nxp.com>
[ Upstream commit f4da3ee15de9944482382181329bb6d7335ca003 ]
Copy the content of a Periodic Advertisement Report to BASE only if
the service UUID is Basic Audio Announcement Service UUID.
Signed-off-by: Claudia Draghicescu <claudia.rosu@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/iso.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 011b2187bd8516..8843bd5c5812ba 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -14,6 +14,7 @@
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/iso.h>
+#include "eir.h"
static const struct proto_ops iso_sock_ops;
@@ -47,6 +48,7 @@ static void iso_sock_kill(struct sock *sk);
#define EIR_SERVICE_DATA_LENGTH 4
#define BASE_MAX_LENGTH (HCI_MAX_PER_AD_LENGTH - EIR_SERVICE_DATA_LENGTH)
+#define EIR_BAA_SERVICE_UUID 0x1851
/* iso_pinfo flags values */
enum {
@@ -1587,6 +1589,8 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
len = min_t(unsigned int, len, base_len);
if (copy_to_user(optval, base, len))
err = -EFAULT;
+ if (put_user(len, optlen))
+ err = -EFAULT;
break;
@@ -1928,12 +1932,16 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT);
if (ev3) {
+ size_t base_len = ev3->length;
+ u8 *base;
+
sk = iso_get_sock_listen(&hdev->bdaddr, bdaddr,
iso_match_sync_handle_pa_report, ev3);
-
- if (sk) {
- memcpy(iso_pi(sk)->base, ev3->data, ev3->length);
- iso_pi(sk)->base_len = ev3->length;
+ base = eir_get_service_data(ev3->data, ev3->length,
+ EIR_BAA_SERVICE_UUID, &base_len);
+ if (base && sk && base_len <= sizeof(iso_pi(sk)->base)) {
+ memcpy(iso_pi(sk)->base, base, base_len);
+ iso_pi(sk)->base_len = base_len;
}
} else {
sk = iso_get_sock_listen(&hdev->bdaddr, BDADDR_ANY, NULL, NULL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0060/1266] perf trace beauty fcntl: Fix build with older kernel headers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0059/1266] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0061/1266] ACPI: CPPC: Suppress UBSAN warning caused by field misuse Greg Kroah-Hartman
` (938 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Florian Fainelli,
Adrian Hunter, Alexander Shishkin, Ingo Molnar, James Clark,
Jiri Olsa, Mark Rutland, Markus Mayer, Namhyung Kim,
Peter Zijlstra, Arnaldo Carvalho de Melo
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream.
Toolchains with older kernel headers that do not include upstream commit
c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write
life time hints") will now fail to build perf due to missing definitions
for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT.
Provide a fallback definition for these when they are not already
defined.
Fixes: 9c47f66748381ecb ("perf trace beauty fcntl: Basic 'arg' beautifier")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Markus Mayer <mmayer@broadcom.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/trace/beauty/fcntl.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/tools/perf/trace/beauty/fcntl.c
+++ b/tools/perf/trace/beauty/fcntl.c
@@ -9,6 +9,22 @@
#include <linux/kernel.h>
#include <uapi/linux/fcntl.h>
+#ifndef F_GET_RW_HINT
+#define F_GET_RW_HINT (F_LINUX_SPECIFIC_BASE + 11)
+#endif
+
+#ifndef F_SET_RW_HINT
+#define F_SET_RW_HINT (F_LINUX_SPECIFIC_BASE + 12)
+#endif
+
+#ifndef F_GET_FILE_RW_HINT
+#define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13)
+#endif
+
+#ifndef F_SET_FILE_RW_HINT
+#define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14)
+#endif
+
static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix)
{
return val ? scnprintf(bf, size, "%s", "0") :
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0061/1266] ACPI: CPPC: Suppress UBSAN warning caused by field misuse
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0060/1266] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0062/1266] ACPI: NFIT: core: Fix possible NULL pointer dereference Greg Kroah-Hartman
` (937 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremy Linton, Jarred White,
Easwar Hariharan, Rafael J. Wysocki
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Linton <jeremy.linton@arm.com>
commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream.
The definition of reg->access_width changes depending on the
reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses
access_width to indicate the PCC region, which can result in a UBSAN
if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9
shift exponent 32 is too large for 32-bit type 'int'
CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)
Hardware name: To be filled by O.E.M.
Call trace:
...(trimming)
ubsan_epilogue+0x10/0x48
__ubsan_handle_shift_out_of_bounds+0xdc/0x1e0
cpc_write+0x4d0/0x670
cppc_set_perf+0x18c/0x490
cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]
... (trimming)
Lets fix this by validating the region type, as well as whether
access_width has a value. Then since we are returning bit_width
directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting
the size.
Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses")
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Tested-by: Jarred White <jarredwhite@linux.microsoft.com>
Reviewed-by: Jarred White <jarredwhite@linux.microsoft.com>
Reviewed-by: Easwar Hariharan <easwar.hariharan@linux.microsoft.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260601235808.1113137-1-jeremy.linton@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/cppc_acpi.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -171,8 +171,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_
show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);
show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
-/* Check for valid access_width, otherwise, fallback to using bit_width */
-#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
+/*
+ * PCC reuses the access_width field as the subspace id, so only decode access
+ * size for non-PCC registers. Otherwise, use the bit_width.
+ */
+#define GET_BIT_WIDTH(reg) (((reg)->access_width && \
+ (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \
+ (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
/* Shift and apply the mask for CPC reads/writes */
#define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) & \
@@ -1033,7 +1038,6 @@ static int cpc_read(int cpu, struct cpc_
* by the bit width field; the access size is used to indicate
* the PCC subspace id.
*/
- size = reg->bit_width;
vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
}
else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
@@ -1105,7 +1109,6 @@ static int cpc_write(int cpu, struct cpc
* by the bit width field; the access size is used to indicate
* the PCC subspace id.
*/
- size = reg->bit_width;
vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
}
else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0062/1266] ACPI: NFIT: core: Fix possible NULL pointer dereference
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0061/1266] ACPI: CPPC: Suppress UBSAN warning caused by field misuse Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0063/1266] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Greg Kroah-Hartman
` (936 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Dave Jiang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit 027e128abb82788189d6d45b68e3e8e7329b67be upstream.
After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before
getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler
for the NFIT device before checking the presence of the NFIT table. If
that table is not there, 0 is returned without allocating the acpi_desc
object and setting the driver data pointer of the NFIT device. If the
platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification
on the NFIT device at that point, acpi_nfit_uc_error_notify() will
dereference a NULL pointer.
Prevent that from occurring by adding an acpi_desc check against NULL
to acpi_nfit_uc_error_notify().
Fixes: 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/2418508.ElGaqSPkdT@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3453,6 +3453,9 @@ static void acpi_nfit_uc_error_notify(st
{
struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev);
+ if (!acpi_desc)
+ return;
+
if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON)
acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
else
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0063/1266] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0062/1266] ACPI: NFIT: core: Fix possible NULL pointer dereference Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0064/1266] perf/core: Detach event groups during remove_on_exec Greg Kroah-Hartman
` (935 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Miguel Ojeda
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <aliceryhl@google.com>
commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream.
Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the
frame-pointer annotation for functions, but not for the module. This
means that functions generated by the LLVM backend such as
'asan.module_ctor' do not receive the frame-pointer annotation.
This is likely to lead to broken backtraces and may also cause issues
with ftrace if these features are used with functions generated by the
LLVM backend.
Thus, use -Zllvm_module_flag to work around this rustc bug if using a
rustc without the fix.
[ The fix [1] has landed for Rust 1.98.0 (expected release on
2026-08-20). - Miguel ]
Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs).
Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support")
Link: https://github.com/rust-lang/rust/pull/156980 [1]
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260616-frame-ptr-fix-v1-1-dc6b29a631d9@google.com
[ - Adjusted Cc: stable@ as discussed.
- Added comment with link to the PR, similar to what we did in commit
ac35b5580ace ("rust: arm64: set uwtable llvm module flag for
CONFIG_UNWIND_TABLES").
- Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Makefile | 3 +++
1 file changed, 3 insertions(+)
--- a/Makefile
+++ b/Makefile
@@ -857,6 +857,9 @@ KBUILD_RUSTFLAGS += $(KBUILD_RUSTFLAGS-y
ifdef CONFIG_FRAME_POINTER
KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y
+# Work around rustc bug on compilers without
+# https://github.com/rust-lang/rust/pull/156980.
+KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max)
else
# Some targets (ARM with Thumb2, for example), can't be built with frame
# pointers. For those, we don't have FUNCTION_TRACER automatically
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0064/1266] perf/core: Detach event groups during remove_on_exec
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0063/1266] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0065/1266] Revert "crypto: talitos - rename first/last to first_desc/last_desc" Greg Kroah-Hartman
` (934 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taeyang Lee, Peter Zijlstra (Intel),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <0wn@theori.io>
[ Upstream commit 037a3c43edfb597665dd34457cd22b14692f2ba3 ]
perf_event_remove_on_exec() removes events by calling
perf_event_exit_event(). For top-level events, this removes the event from
the context with DETACH_EXIT only.
This can leave inconsistent group state when a removed event is a group
leader and the group contains siblings without remove_on_exec. If the group
was active, the surviving siblings can remain active and attached to the
removed leader's sibling list, but are no longer represented by a valid
group leader on the PMU context active lists.
A later close of the removed leader uses DETACH_GROUP and can promote the
still-active siblings from this stale group state. The next schedule-in can
then add an already-linked active_list entry again, corrupting the PMU
context active list.
With DEBUG_LIST enabled, this is caught as a list_add double-add in
merge_sched_in().
Fix this by detaching group relationships when remove_on_exec removes an
event. This preserves the existing task-exit and revoke behavior, while
ensuring surviving siblings are ungrouped before the removed event leaves
the context.
Fixes: 2e498d0a74e5 ("perf: Add support for event removal on exec")
Signed-off-by: Taeyang Lee <0wn@theori.io>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/ai65GgZcC0LAlWLG@Taeyangs-MacBook-Pro.local
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/core.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 73a86db06cc9b1..d45bce2acdbc75 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4449,7 +4449,8 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
static void perf_remove_from_owner(struct perf_event *event);
static void perf_event_exit_event(struct perf_event *event,
- struct perf_event_context *ctx);
+ struct perf_event_context *ctx,
+ unsigned long detach_flags);
/*
* Removes all events from the current task that have been marked
@@ -4476,7 +4477,7 @@ static void perf_event_remove_on_exec(struct perf_event_context *ctx)
modified = true;
- perf_event_exit_event(event, ctx);
+ perf_event_exit_event(event, ctx, DETACH_GROUP);
}
raw_spin_lock_irqsave(&ctx->lock, flags);
@@ -13230,10 +13231,11 @@ static void sync_child_event(struct perf_event *child_event)
}
static void
-perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx)
+perf_event_exit_event(struct perf_event *event,
+ struct perf_event_context *ctx,
+ unsigned long detach_flags)
{
struct perf_event *parent_event = event->parent;
- unsigned long detach_flags = 0;
if (parent_event) {
/*
@@ -13248,7 +13250,7 @@ perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx)
* Do destroy all inherited groups, we don't care about those
* and being thorough is better.
*/
- detach_flags = DETACH_GROUP | DETACH_CHILD;
+ detach_flags |= DETACH_GROUP | DETACH_CHILD;
mutex_lock(&parent_event->child_mutex);
}
@@ -13328,7 +13330,7 @@ static void perf_event_exit_task_context(struct task_struct *child)
perf_event_task(child, child_ctx, 0);
list_for_each_entry_safe(child_event, next, &child_ctx->event_list, event_entry)
- perf_event_exit_event(child_event, child_ctx);
+ perf_event_exit_event(child_event, child_ctx, 0);
mutex_unlock(&child_ctx->mutex);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0065/1266] Revert "crypto: talitos - rename first/last to first_desc/last_desc"
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0064/1266] perf/core: Detach event groups during remove_on_exec Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0066/1266] Revert "crypto: talitos - fix SEC1 32k ahash request limitation" Greg Kroah-Hartman
` (933 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Goetz Goerisch, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goetz Goerisch <ggoerisch@gmail.com>
This reverts commit a866e2b1c65edaee2e1bb1024ee2c761ced335f8.
Which was backported without applying upstream
commit 9826d1d6ed5f86cb3d61610b3b1fe31e96a40418 first.
Commit a1b80018b8cec27fc06a8b04a7f8b5f6cfe86eae
was backported to 6.6.y with a866e2b1c65edaee2e1bb1024ee2c761ced335f8
It renames last to last_desc but misses one occurrence which leads to compile errors on mpc85xx
drivers/crypto/talitos.c: In function 'ahash_digest':
drivers/crypto/talitos.c:2204:16: error: 'struct talitos_ahash_req_ctx' has no member named 'last'
2204 | req_ctx->last = 1;
| ^~~~
Instead of renaming req_ctx->last, commit 9826d1d6ed5f8 ("crypto: talitos - stop
using crypto_ahash::init") should be applied.
Ideally before commit 00463d5f864a ("crypto: talitos - fix SEC1 32k ahash
request limitation") to avoid any compilation breakage and ensure correctness of
the code.
Reverting and applying in correct order.
Link: https://lore.kernel.org/all/DIOA24QU02W5.2RSVK05RE7BJK@bootlin.com/
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 46 ++++++++++++++++++++--------------------
1 file changed, 23 insertions(+), 23 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 347483f6fc5dd6..f78a44f991013b 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -869,8 +869,8 @@ struct talitos_ahash_req_ctx {
u8 buf[2][HASH_MAX_BLOCK_SIZE];
int buf_idx;
unsigned int swinit;
- unsigned int first_desc;
- unsigned int last_desc;
+ unsigned int first;
+ unsigned int last;
unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
@@ -889,8 +889,8 @@ struct talitos_export_state {
u32 hw_context[TALITOS_MDEU_MAX_CONTEXT_SIZE / sizeof(u32)];
u8 buf[HASH_MAX_BLOCK_SIZE];
unsigned int swinit;
- unsigned int first_desc;
- unsigned int last_desc;
+ unsigned int first;
+ unsigned int last;
unsigned int to_hash_later;
unsigned int nbuf;
};
@@ -1722,7 +1722,7 @@ static void common_nonsnoop_hash_unmap(struct device *dev,
if (desc->next_desc &&
desc->ptr[5].ptr != desc2->ptr[5].ptr)
unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
- if (req_ctx->last_desc)
+ if (req_ctx->last)
memcpy(areq->result, req_ctx->hw_context,
crypto_ahash_digestsize(tfm));
@@ -1759,7 +1759,7 @@ static void ahash_done(struct device *dev,
container_of(desc, struct talitos_edesc, desc);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- if (!req_ctx->last_desc && req_ctx->to_hash_later) {
+ if (!req_ctx->last && req_ctx->to_hash_later) {
/* Position any partial block for next update/final/finup */
req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
req_ctx->nbuf = req_ctx->to_hash_later;
@@ -1825,7 +1825,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
/* first DWORD empty */
/* hash context in */
- if (!req_ctx->first_desc || req_ctx->swinit) {
+ if (!req_ctx->first || req_ctx->swinit) {
map_single_talitos_ptr_nosync(dev, &desc->ptr[1],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1833,7 +1833,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
req_ctx->swinit = 0;
}
/* Indicate next op is not the first. */
- req_ctx->first_desc = 0;
+ req_ctx->first = 0;
/* HMAC key */
if (ctx->keylen)
@@ -1866,7 +1866,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
/* fifth DWORD empty */
/* hash/HMAC out -or- hash context out */
- if (req_ctx->last_desc)
+ if (req_ctx->last)
map_single_talitos_ptr(dev, &desc->ptr[5],
crypto_ahash_digestsize(tfm),
req_ctx->hw_context, DMA_FROM_DEVICE);
@@ -1908,7 +1908,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
if (sg_count > 1)
sync_needed = true;
copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
- if (req_ctx->last_desc)
+ if (req_ctx->last)
map_single_talitos_ptr_nosync(dev, &desc->ptr[5],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1964,7 +1964,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
bool is_sec1 = has_ftr_sec1(priv);
u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
- if (!req_ctx->last_desc && (nbytes + req_ctx->nbuf <= blocksize)) {
+ if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
if (nents < 0) {
@@ -1981,7 +1981,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
nbytes_to_hash = nbytes + req_ctx->nbuf;
to_hash_later = nbytes_to_hash & (blocksize - 1);
- if (req_ctx->last_desc)
+ if (req_ctx->last)
to_hash_later = 0;
else if (to_hash_later)
/* There is a partial block. Hash the full block(s) now */
@@ -2041,19 +2041,19 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
edesc->desc.hdr = ctx->desc_hdr_template;
/* On last one, request SEC to pad; otherwise continue */
- if (req_ctx->last_desc)
+ if (req_ctx->last)
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_PAD;
else
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_CONT;
/* request SEC to INIT hash. */
- if (req_ctx->first_desc && !req_ctx->swinit)
+ if (req_ctx->first && !req_ctx->swinit)
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
/* When the tfm context has a keylen, it's an HMAC.
* A first or last (ie. not middle) descriptor must request HMAC.
*/
- if (ctx->keylen && (req_ctx->first_desc || req_ctx->last_desc))
+ if (ctx->keylen && (req_ctx->first || req_ctx->last))
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
return common_nonsnoop_hash(edesc, req_ctx->areq, nbytes_to_hash, ahash_done);
@@ -2076,7 +2076,7 @@ static void sec1_ahash_process_remaining(struct work_struct *work)
req_ctx->remaining_ahash_request_bytes;
if (req_ctx->last_request)
- req_ctx->last_desc = 1;
+ req_ctx->last = 1;
}
err = ahash_process_req_one(req_ctx->areq,
@@ -2103,7 +2103,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
if (nbytes > TALITOS1_MAX_DATA_LEN)
nbytes = TALITOS1_MAX_DATA_LEN;
else if (req_ctx->last_request)
- req_ctx->last_desc = 1;
+ req_ctx->last = 1;
}
req_ctx->current_ahash_request_bytes = nbytes;
@@ -2124,14 +2124,14 @@ static int ahash_init(struct ahash_request *areq)
/* Initialize the context */
req_ctx->buf_idx = 0;
req_ctx->nbuf = 0;
- req_ctx->first_desc = 1; /* first_desc indicates h/w must init its context */
+ req_ctx->first = 1; /* first indicates h/w must init its context */
req_ctx->swinit = 0; /* assume h/w init of context */
size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
: TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
req_ctx->hw_context_size = size;
req_ctx->last_request = 0;
- req_ctx->last_desc = 0;
+ req_ctx->last = 0;
INIT_WORK(&req_ctx->sec1_ahash_process_remaining, sec1_ahash_process_remaining);
dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
@@ -2223,8 +2223,8 @@ static int ahash_export(struct ahash_request *areq, void *out)
req_ctx->hw_context_size);
memcpy(export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf);
export->swinit = req_ctx->swinit;
- export->first_desc = req_ctx->first_desc;
- export->last_desc = req_ctx->last_desc;
+ export->first = req_ctx->first;
+ export->last = req_ctx->last;
export->to_hash_later = req_ctx->to_hash_later;
export->nbuf = req_ctx->nbuf;
@@ -2249,8 +2249,8 @@ static int ahash_import(struct ahash_request *areq, const void *in)
memcpy(req_ctx->hw_context, export->hw_context, size);
memcpy(req_ctx->buf[0], export->buf, export->nbuf);
req_ctx->swinit = export->swinit;
- req_ctx->first_desc = export->first_desc;
- req_ctx->last_desc = export->last_desc;
+ req_ctx->first = export->first;
+ req_ctx->last = export->last;
req_ctx->to_hash_later = export->to_hash_later;
req_ctx->nbuf = export->nbuf;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0066/1266] Revert "crypto: talitos - fix SEC1 32k ahash request limitation"
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0065/1266] Revert "crypto: talitos - rename first/last to first_desc/last_desc" Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0067/1266] crypto: talitos - stop using crypto_ahash::init Greg Kroah-Hartman
` (932 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Goetz Goerisch, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goetz Goerisch <ggoerisch@gmail.com>
This reverts commit 00463d5f864ae28b7938d5acd0ddd800d5457e8b.
Which was backported without applying upstream
commit 9826d1d6ed5f86cb3d61610b3b1fe31e96a40418 first.
Commit a1b80018b8cec27fc06a8b04a7f8b5f6cfe86eae
was backported to 6.6.y with a866e2b1c65edaee2e1bb1024ee2c761ced335f8
It renames last to last_desc but misses one occurrence which leads to compile errors on mpc85xx
drivers/crypto/talitos.c: In function 'ahash_digest':
drivers/crypto/talitos.c:2204:16: error: 'struct talitos_ahash_req_ctx' has no member named 'last'
2204 | req_ctx->last = 1;
| ^~~~
Instead of renaming req_ctx->last, commit 9826d1d6ed5f8 ("crypto: talitos - stop
using crypto_ahash::init") should be applied.
Ideally before commit 00463d5f864a ("crypto: talitos - fix SEC1 32k ahash
request limitation") to avoid any compilation breakage and ensure correctness of
the code.
Reverting and applying in correct order.
Link: https://lore.kernel.org/all/DIOA24QU02W5.2RSVK05RE7BJK@bootlin.com/
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 216 +++++++++++++--------------------------
1 file changed, 69 insertions(+), 147 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index f78a44f991013b..4ca4fbd227bce1 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -12,7 +12,6 @@
* All rights reserved.
*/
-#include <linux/workqueue.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
@@ -871,18 +870,10 @@ struct talitos_ahash_req_ctx {
unsigned int swinit;
unsigned int first;
unsigned int last;
- unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
struct scatterlist bufsl[2];
struct scatterlist *psrc;
-
- struct scatterlist request_bufsl[2];
- struct ahash_request *areq;
- struct scatterlist *request_sl;
- unsigned int remaining_ahash_request_bytes;
- unsigned int current_ahash_request_bytes;
- struct work_struct sec1_ahash_process_remaining;
};
struct talitos_export_state {
@@ -1768,20 +1759,7 @@ static void ahash_done(struct device *dev,
kfree(edesc);
- if (err) {
- ahash_request_complete(areq, err);
- return;
- }
-
- req_ctx->remaining_ahash_request_bytes -=
- req_ctx->current_ahash_request_bytes;
-
- if (!req_ctx->remaining_ahash_request_bytes) {
- ahash_request_complete(areq, 0);
- return;
- }
-
- schedule_work(&req_ctx->sec1_ahash_process_remaining);
+ ahash_request_complete(areq, err);
}
/*
@@ -1947,7 +1925,60 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
nbytes, 0, 0, 0, areq->base.flags, false);
}
-static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes)
+static int ahash_init(struct ahash_request *areq)
+{
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+ struct device *dev = ctx->dev;
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ unsigned int size;
+ dma_addr_t dma;
+
+ /* Initialize the context */
+ req_ctx->buf_idx = 0;
+ req_ctx->nbuf = 0;
+ req_ctx->first = 1; /* first indicates h/w must init its context */
+ req_ctx->swinit = 0; /* assume h/w init of context */
+ size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
+ ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
+ : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
+ req_ctx->hw_context_size = size;
+
+ dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
+ DMA_TO_DEVICE);
+ dma_unmap_single(dev, dma, req_ctx->hw_context_size, DMA_TO_DEVICE);
+
+ return 0;
+}
+
+/*
+ * on h/w without explicit sha224 support, we initialize h/w context
+ * manually with sha224 constants, and tell it to run sha256.
+ */
+static int ahash_init_sha224_swinit(struct ahash_request *areq)
+{
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+
+ req_ctx->hw_context[0] = SHA224_H0;
+ req_ctx->hw_context[1] = SHA224_H1;
+ req_ctx->hw_context[2] = SHA224_H2;
+ req_ctx->hw_context[3] = SHA224_H3;
+ req_ctx->hw_context[4] = SHA224_H4;
+ req_ctx->hw_context[5] = SHA224_H5;
+ req_ctx->hw_context[6] = SHA224_H6;
+ req_ctx->hw_context[7] = SHA224_H7;
+
+ /* init 64-bit count */
+ req_ctx->hw_context[8] = 0;
+ req_ctx->hw_context[9] = 0;
+
+ ahash_init(areq);
+ req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/
+
+ return 0;
+}
+
+static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
@@ -1966,12 +1997,12 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
- nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
+ nents = sg_nents_for_len(areq->src, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_copy_to_buffer(req_ctx->request_sl, nents,
+ sg_copy_to_buffer(areq->src, nents,
ctx_buf + req_ctx->nbuf, nbytes);
req_ctx->nbuf += nbytes;
return 0;
@@ -1998,7 +2029,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
sg_init_table(req_ctx->bufsl, nsg);
sg_set_buf(req_ctx->bufsl, ctx_buf, req_ctx->nbuf);
if (nsg > 1)
- sg_chain(req_ctx->bufsl, 2, req_ctx->request_sl);
+ sg_chain(req_ctx->bufsl, 2, areq->src);
req_ctx->psrc = req_ctx->bufsl;
} else if (is_sec1 && req_ctx->nbuf && req_ctx->nbuf < blocksize) {
int offset;
@@ -2007,26 +2038,26 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
offset = blocksize - req_ctx->nbuf;
else
offset = nbytes_to_hash - req_ctx->nbuf;
- nents = sg_nents_for_len(req_ctx->request_sl, offset);
+ nents = sg_nents_for_len(areq->src, offset);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_copy_to_buffer(req_ctx->request_sl, nents,
+ sg_copy_to_buffer(areq->src, nents,
ctx_buf + req_ctx->nbuf, offset);
req_ctx->nbuf += offset;
- req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, req_ctx->request_sl,
+ req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, areq->src,
offset);
} else
- req_ctx->psrc = req_ctx->request_sl;
+ req_ctx->psrc = areq->src;
if (to_hash_later) {
- nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
+ nents = sg_nents_for_len(areq->src, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_pcopy_to_buffer(req_ctx->request_sl, nents,
+ sg_pcopy_to_buffer(areq->src, nents,
req_ctx->buf[(req_ctx->buf_idx + 1) & 1],
to_hash_later,
nbytes - to_hash_later);
@@ -2034,7 +2065,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
req_ctx->to_hash_later = to_hash_later;
/* Allocate extended descriptor */
- edesc = ahash_edesc_alloc(req_ctx->areq, nbytes_to_hash);
+ edesc = ahash_edesc_alloc(areq, nbytes_to_hash);
if (IS_ERR(edesc))
return PTR_ERR(edesc);
@@ -2056,123 +2087,14 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
if (ctx->keylen && (req_ctx->first || req_ctx->last))
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
- return common_nonsnoop_hash(edesc, req_ctx->areq, nbytes_to_hash, ahash_done);
-}
-
-static void sec1_ahash_process_remaining(struct work_struct *work)
-{
- struct talitos_ahash_req_ctx *req_ctx =
- container_of(work, struct talitos_ahash_req_ctx,
- sec1_ahash_process_remaining);
- int err = 0;
-
- req_ctx->request_sl = scatterwalk_ffwd(req_ctx->request_bufsl,
- req_ctx->request_sl, TALITOS1_MAX_DATA_LEN);
-
- if (req_ctx->remaining_ahash_request_bytes > TALITOS1_MAX_DATA_LEN)
- req_ctx->current_ahash_request_bytes = TALITOS1_MAX_DATA_LEN;
- else {
- req_ctx->current_ahash_request_bytes =
- req_ctx->remaining_ahash_request_bytes;
-
- if (req_ctx->last_request)
- req_ctx->last = 1;
- }
-
- err = ahash_process_req_one(req_ctx->areq,
- req_ctx->current_ahash_request_bytes);
-
- if (err != -EINPROGRESS)
- ahash_request_complete(req_ctx->areq, err);
-}
-
-static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
-{
- struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
- struct device *dev = ctx->dev;
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- struct talitos_private *priv = dev_get_drvdata(dev);
- bool is_sec1 = has_ftr_sec1(priv);
-
- req_ctx->areq = areq;
- req_ctx->request_sl = areq->src;
- req_ctx->remaining_ahash_request_bytes = nbytes;
-
- if (is_sec1) {
- if (nbytes > TALITOS1_MAX_DATA_LEN)
- nbytes = TALITOS1_MAX_DATA_LEN;
- else if (req_ctx->last_request)
- req_ctx->last = 1;
- }
-
- req_ctx->current_ahash_request_bytes = nbytes;
-
- return ahash_process_req_one(req_ctx->areq,
- req_ctx->current_ahash_request_bytes);
-}
-
-static int ahash_init(struct ahash_request *areq)
-{
- struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
- struct device *dev = ctx->dev;
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- unsigned int size;
- dma_addr_t dma;
-
- /* Initialize the context */
- req_ctx->buf_idx = 0;
- req_ctx->nbuf = 0;
- req_ctx->first = 1; /* first indicates h/w must init its context */
- req_ctx->swinit = 0; /* assume h/w init of context */
- size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
- ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
- : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
- req_ctx->hw_context_size = size;
- req_ctx->last_request = 0;
- req_ctx->last = 0;
- INIT_WORK(&req_ctx->sec1_ahash_process_remaining, sec1_ahash_process_remaining);
-
- dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
- DMA_TO_DEVICE);
- dma_unmap_single(dev, dma, req_ctx->hw_context_size, DMA_TO_DEVICE);
-
- return 0;
-}
-
-/*
- * on h/w without explicit sha224 support, we initialize h/w context
- * manually with sha224 constants, and tell it to run sha256.
- */
-static int ahash_init_sha224_swinit(struct ahash_request *areq)
-{
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
-
- req_ctx->hw_context[0] = SHA224_H0;
- req_ctx->hw_context[1] = SHA224_H1;
- req_ctx->hw_context[2] = SHA224_H2;
- req_ctx->hw_context[3] = SHA224_H3;
- req_ctx->hw_context[4] = SHA224_H4;
- req_ctx->hw_context[5] = SHA224_H5;
- req_ctx->hw_context[6] = SHA224_H6;
- req_ctx->hw_context[7] = SHA224_H7;
-
- /* init 64-bit count */
- req_ctx->hw_context[8] = 0;
- req_ctx->hw_context[9] = 0;
-
- ahash_init(areq);
- req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/
-
- return 0;
+ return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, ahash_done);
}
static int ahash_update(struct ahash_request *areq)
{
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- req_ctx->last_request = 0;
+ req_ctx->last = 0;
return ahash_process_req(areq, areq->nbytes);
}
@@ -2181,7 +2103,7 @@ static int ahash_final(struct ahash_request *areq)
{
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- req_ctx->last_request = 1;
+ req_ctx->last = 1;
return ahash_process_req(areq, 0);
}
@@ -2190,7 +2112,7 @@ static int ahash_finup(struct ahash_request *areq)
{
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- req_ctx->last_request = 1;
+ req_ctx->last = 1;
return ahash_process_req(areq, areq->nbytes);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0067/1266] crypto: talitos - stop using crypto_ahash::init
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0066/1266] Revert "crypto: talitos - fix SEC1 32k ahash request limitation" Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0068/1266] crypto: talitos - fix SEC1 32k ahash request limitation Greg Kroah-Hartman
` (931 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 9826d1d6ed5f86cb3d61610b3b1fe31e96a40418 upstream.
The function pointer crypto_ahash::init is an internal implementation
detail of the ahash API that exists to help it support both ahash and
shash algorithms. With an upcoming refactoring of how the ahash API
supports shash algorithms, this field will be removed.
Some drivers are invoking crypto_ahash::init to call into their own
code, which is unnecessary and inefficient. The talitos driver is one
of those drivers. Make it just call its own code directly.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 4ca4fbd227bce1..a941ec08817eb4 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -2119,13 +2119,14 @@ static int ahash_finup(struct ahash_request *areq)
static int ahash_digest(struct ahash_request *areq)
{
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq);
-
- ahash->init(areq);
- req_ctx->last = 1;
+ ahash_init(areq);
+ return ahash_finup(areq);
+}
- return ahash_process_req(areq, areq->nbytes);
+static int ahash_digest_sha224_swinit(struct ahash_request *areq)
+{
+ ahash_init_sha224_swinit(areq);
+ return ahash_finup(areq);
}
static int ahash_export(struct ahash_request *areq, void *out)
@@ -3242,6 +3243,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
(!strcmp(alg->cra_name, "sha224") ||
!strcmp(alg->cra_name, "hmac(sha224)"))) {
t_alg->algt.alg.hash.init = ahash_init_sha224_swinit;
+ t_alg->algt.alg.hash.digest =
+ ahash_digest_sha224_swinit;
t_alg->algt.desc_hdr_template =
DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
DESC_HDR_SEL0_MDEUA |
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0068/1266] crypto: talitos - fix SEC1 32k ahash request limitation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0067/1266] crypto: talitos - stop using crypto_ahash::init Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0069/1266] crypto: talitos - rename first/last to first_desc/last_desc Greg Kroah-Hartman
` (930 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 655ef638a2bc3cd0a9eff99a02f83cab94a3a917 upstream.
Since commit c662b043cdca ("crypto: af_alg/hash: Support
MSG_SPLICE_PAGES"), the crypto core may pass large scatterlists spanning
multiple pages to drivers supporting ahash operations. As a result, a
driver can now receive large ahash requests.
The SEC1 engine has a limitation where a single descriptor cannot
process more than 32k of data. The current implementation attempts to
handle the entire request within a single descriptor, which leads to
failures raised by the driver:
"length exceeds h/w max limit"
Address this limitation by splitting large ahash requests into multiple
descriptors, each respecting the 32k hardware limit. This allows
processing arbitrarily large requests.
Cc: stable@vger.kernel.org
Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES")
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 216 ++++++++++++++++++++++++++-------------
1 file changed, 147 insertions(+), 69 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index a941ec08817eb4..ea6ae72c71ad62 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -12,6 +12,7 @@
* All rights reserved.
*/
+#include <linux/workqueue.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
@@ -870,10 +871,18 @@ struct talitos_ahash_req_ctx {
unsigned int swinit;
unsigned int first;
unsigned int last;
+ unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
struct scatterlist bufsl[2];
struct scatterlist *psrc;
+
+ struct scatterlist request_bufsl[2];
+ struct ahash_request *areq;
+ struct scatterlist *request_sl;
+ unsigned int remaining_ahash_request_bytes;
+ unsigned int current_ahash_request_bytes;
+ struct work_struct sec1_ahash_process_remaining;
};
struct talitos_export_state {
@@ -1759,7 +1768,20 @@ static void ahash_done(struct device *dev,
kfree(edesc);
- ahash_request_complete(areq, err);
+ if (err) {
+ ahash_request_complete(areq, err);
+ return;
+ }
+
+ req_ctx->remaining_ahash_request_bytes -=
+ req_ctx->current_ahash_request_bytes;
+
+ if (!req_ctx->remaining_ahash_request_bytes) {
+ ahash_request_complete(areq, 0);
+ return;
+ }
+
+ schedule_work(&req_ctx->sec1_ahash_process_remaining);
}
/*
@@ -1925,60 +1947,7 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
nbytes, 0, 0, 0, areq->base.flags, false);
}
-static int ahash_init(struct ahash_request *areq)
-{
- struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
- struct device *dev = ctx->dev;
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- unsigned int size;
- dma_addr_t dma;
-
- /* Initialize the context */
- req_ctx->buf_idx = 0;
- req_ctx->nbuf = 0;
- req_ctx->first = 1; /* first indicates h/w must init its context */
- req_ctx->swinit = 0; /* assume h/w init of context */
- size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
- ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
- : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
- req_ctx->hw_context_size = size;
-
- dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
- DMA_TO_DEVICE);
- dma_unmap_single(dev, dma, req_ctx->hw_context_size, DMA_TO_DEVICE);
-
- return 0;
-}
-
-/*
- * on h/w without explicit sha224 support, we initialize h/w context
- * manually with sha224 constants, and tell it to run sha256.
- */
-static int ahash_init_sha224_swinit(struct ahash_request *areq)
-{
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
-
- req_ctx->hw_context[0] = SHA224_H0;
- req_ctx->hw_context[1] = SHA224_H1;
- req_ctx->hw_context[2] = SHA224_H2;
- req_ctx->hw_context[3] = SHA224_H3;
- req_ctx->hw_context[4] = SHA224_H4;
- req_ctx->hw_context[5] = SHA224_H5;
- req_ctx->hw_context[6] = SHA224_H6;
- req_ctx->hw_context[7] = SHA224_H7;
-
- /* init 64-bit count */
- req_ctx->hw_context[8] = 0;
- req_ctx->hw_context[9] = 0;
-
- ahash_init(areq);
- req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/
-
- return 0;
-}
-
-static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
@@ -1997,12 +1966,12 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
- nents = sg_nents_for_len(areq->src, nbytes);
+ nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_copy_to_buffer(areq->src, nents,
+ sg_copy_to_buffer(req_ctx->request_sl, nents,
ctx_buf + req_ctx->nbuf, nbytes);
req_ctx->nbuf += nbytes;
return 0;
@@ -2029,7 +1998,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
sg_init_table(req_ctx->bufsl, nsg);
sg_set_buf(req_ctx->bufsl, ctx_buf, req_ctx->nbuf);
if (nsg > 1)
- sg_chain(req_ctx->bufsl, 2, areq->src);
+ sg_chain(req_ctx->bufsl, 2, req_ctx->request_sl);
req_ctx->psrc = req_ctx->bufsl;
} else if (is_sec1 && req_ctx->nbuf && req_ctx->nbuf < blocksize) {
int offset;
@@ -2038,26 +2007,26 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
offset = blocksize - req_ctx->nbuf;
else
offset = nbytes_to_hash - req_ctx->nbuf;
- nents = sg_nents_for_len(areq->src, offset);
+ nents = sg_nents_for_len(req_ctx->request_sl, offset);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_copy_to_buffer(areq->src, nents,
+ sg_copy_to_buffer(req_ctx->request_sl, nents,
ctx_buf + req_ctx->nbuf, offset);
req_ctx->nbuf += offset;
- req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, areq->src,
+ req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, req_ctx->request_sl,
offset);
} else
- req_ctx->psrc = areq->src;
+ req_ctx->psrc = req_ctx->request_sl;
if (to_hash_later) {
- nents = sg_nents_for_len(areq->src, nbytes);
+ nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_pcopy_to_buffer(areq->src, nents,
+ sg_pcopy_to_buffer(req_ctx->request_sl, nents,
req_ctx->buf[(req_ctx->buf_idx + 1) & 1],
to_hash_later,
nbytes - to_hash_later);
@@ -2065,7 +2034,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
req_ctx->to_hash_later = to_hash_later;
/* Allocate extended descriptor */
- edesc = ahash_edesc_alloc(areq, nbytes_to_hash);
+ edesc = ahash_edesc_alloc(req_ctx->areq, nbytes_to_hash);
if (IS_ERR(edesc))
return PTR_ERR(edesc);
@@ -2087,14 +2056,123 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
if (ctx->keylen && (req_ctx->first || req_ctx->last))
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
- return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, ahash_done);
+ return common_nonsnoop_hash(edesc, req_ctx->areq, nbytes_to_hash, ahash_done);
}
-static int ahash_update(struct ahash_request *areq)
+static void sec1_ahash_process_remaining(struct work_struct *work)
+{
+ struct talitos_ahash_req_ctx *req_ctx =
+ container_of(work, struct talitos_ahash_req_ctx,
+ sec1_ahash_process_remaining);
+ int err = 0;
+
+ req_ctx->request_sl = scatterwalk_ffwd(req_ctx->request_bufsl,
+ req_ctx->request_sl, TALITOS1_MAX_DATA_LEN);
+
+ if (req_ctx->remaining_ahash_request_bytes > TALITOS1_MAX_DATA_LEN)
+ req_ctx->current_ahash_request_bytes = TALITOS1_MAX_DATA_LEN;
+ else {
+ req_ctx->current_ahash_request_bytes =
+ req_ctx->remaining_ahash_request_bytes;
+
+ if (req_ctx->last_request)
+ req_ctx->last = 1;
+ }
+
+ err = ahash_process_req_one(req_ctx->areq,
+ req_ctx->current_ahash_request_bytes);
+
+ if (err != -EINPROGRESS)
+ ahash_request_complete(req_ctx->areq, err);
+}
+
+static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+{
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+ struct device *dev = ctx->dev;
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+
+ req_ctx->areq = areq;
+ req_ctx->request_sl = areq->src;
+ req_ctx->remaining_ahash_request_bytes = nbytes;
+
+ if (is_sec1) {
+ if (nbytes > TALITOS1_MAX_DATA_LEN)
+ nbytes = TALITOS1_MAX_DATA_LEN;
+ else if (req_ctx->last_request)
+ req_ctx->last = 1;
+ }
+
+ req_ctx->current_ahash_request_bytes = nbytes;
+
+ return ahash_process_req_one(req_ctx->areq,
+ req_ctx->current_ahash_request_bytes);
+}
+
+static int ahash_init(struct ahash_request *areq)
{
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+ struct device *dev = ctx->dev;
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ unsigned int size;
+ dma_addr_t dma;
+ /* Initialize the context */
+ req_ctx->buf_idx = 0;
+ req_ctx->nbuf = 0;
+ req_ctx->first = 1; /* first indicates h/w must init its context */
+ req_ctx->swinit = 0; /* assume h/w init of context */
+ size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
+ ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
+ : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
+ req_ctx->hw_context_size = size;
+ req_ctx->last_request = 0;
req_ctx->last = 0;
+ INIT_WORK(&req_ctx->sec1_ahash_process_remaining, sec1_ahash_process_remaining);
+
+ dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
+ DMA_TO_DEVICE);
+ dma_unmap_single(dev, dma, req_ctx->hw_context_size, DMA_TO_DEVICE);
+
+ return 0;
+}
+
+/*
+ * on h/w without explicit sha224 support, we initialize h/w context
+ * manually with sha224 constants, and tell it to run sha256.
+ */
+static int ahash_init_sha224_swinit(struct ahash_request *areq)
+{
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+
+ req_ctx->hw_context[0] = SHA224_H0;
+ req_ctx->hw_context[1] = SHA224_H1;
+ req_ctx->hw_context[2] = SHA224_H2;
+ req_ctx->hw_context[3] = SHA224_H3;
+ req_ctx->hw_context[4] = SHA224_H4;
+ req_ctx->hw_context[5] = SHA224_H5;
+ req_ctx->hw_context[6] = SHA224_H6;
+ req_ctx->hw_context[7] = SHA224_H7;
+
+ /* init 64-bit count */
+ req_ctx->hw_context[8] = 0;
+ req_ctx->hw_context[9] = 0;
+
+ ahash_init(areq);
+ req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/
+
+ return 0;
+}
+
+static int ahash_update(struct ahash_request *areq)
+{
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+
+ req_ctx->last_request = 0;
return ahash_process_req(areq, areq->nbytes);
}
@@ -2103,7 +2181,7 @@ static int ahash_final(struct ahash_request *areq)
{
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- req_ctx->last = 1;
+ req_ctx->last_request = 1;
return ahash_process_req(areq, 0);
}
@@ -2112,7 +2190,7 @@ static int ahash_finup(struct ahash_request *areq)
{
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- req_ctx->last = 1;
+ req_ctx->last_request = 1;
return ahash_process_req(areq, areq->nbytes);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0069/1266] crypto: talitos - rename first/last to first_desc/last_desc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0068/1266] crypto: talitos - fix SEC1 32k ahash request limitation Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0070/1266] arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 Greg Kroah-Hartman
` (929 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit a1b80018b8cec27fc06a8b04a7f8b5f6cfe86eae upstream.
Previous commit introduces a new last_request variable in the context
structure.
Renaming the first/last existing member variable in the context
structure to improve readability.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 46 ++++++++++++++++++++--------------------
1 file changed, 23 insertions(+), 23 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index ea6ae72c71ad62..fb1adc2956b899 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -869,8 +869,8 @@ struct talitos_ahash_req_ctx {
u8 buf[2][HASH_MAX_BLOCK_SIZE];
int buf_idx;
unsigned int swinit;
- unsigned int first;
- unsigned int last;
+ unsigned int first_desc;
+ unsigned int last_desc;
unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
@@ -889,8 +889,8 @@ struct talitos_export_state {
u32 hw_context[TALITOS_MDEU_MAX_CONTEXT_SIZE / sizeof(u32)];
u8 buf[HASH_MAX_BLOCK_SIZE];
unsigned int swinit;
- unsigned int first;
- unsigned int last;
+ unsigned int first_desc;
+ unsigned int last_desc;
unsigned int to_hash_later;
unsigned int nbuf;
};
@@ -1722,7 +1722,7 @@ static void common_nonsnoop_hash_unmap(struct device *dev,
if (desc->next_desc &&
desc->ptr[5].ptr != desc2->ptr[5].ptr)
unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
- if (req_ctx->last)
+ if (req_ctx->last_desc)
memcpy(areq->result, req_ctx->hw_context,
crypto_ahash_digestsize(tfm));
@@ -1759,7 +1759,7 @@ static void ahash_done(struct device *dev,
container_of(desc, struct talitos_edesc, desc);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- if (!req_ctx->last && req_ctx->to_hash_later) {
+ if (!req_ctx->last_desc && req_ctx->to_hash_later) {
/* Position any partial block for next update/final/finup */
req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
req_ctx->nbuf = req_ctx->to_hash_later;
@@ -1825,7 +1825,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
/* first DWORD empty */
/* hash context in */
- if (!req_ctx->first || req_ctx->swinit) {
+ if (!req_ctx->first_desc || req_ctx->swinit) {
map_single_talitos_ptr_nosync(dev, &desc->ptr[1],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1833,7 +1833,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
req_ctx->swinit = 0;
}
/* Indicate next op is not the first. */
- req_ctx->first = 0;
+ req_ctx->first_desc = 0;
/* HMAC key */
if (ctx->keylen)
@@ -1866,7 +1866,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
/* fifth DWORD empty */
/* hash/HMAC out -or- hash context out */
- if (req_ctx->last)
+ if (req_ctx->last_desc)
map_single_talitos_ptr(dev, &desc->ptr[5],
crypto_ahash_digestsize(tfm),
req_ctx->hw_context, DMA_FROM_DEVICE);
@@ -1908,7 +1908,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
if (sg_count > 1)
sync_needed = true;
copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
- if (req_ctx->last)
+ if (req_ctx->last_desc)
map_single_talitos_ptr_nosync(dev, &desc->ptr[5],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1964,7 +1964,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
bool is_sec1 = has_ftr_sec1(priv);
u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
- if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
+ if (!req_ctx->last_desc && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
if (nents < 0) {
@@ -1981,7 +1981,7 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
nbytes_to_hash = nbytes + req_ctx->nbuf;
to_hash_later = nbytes_to_hash & (blocksize - 1);
- if (req_ctx->last)
+ if (req_ctx->last_desc)
to_hash_later = 0;
else if (to_hash_later)
/* There is a partial block. Hash the full block(s) now */
@@ -2041,19 +2041,19 @@ static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes
edesc->desc.hdr = ctx->desc_hdr_template;
/* On last one, request SEC to pad; otherwise continue */
- if (req_ctx->last)
+ if (req_ctx->last_desc)
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_PAD;
else
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_CONT;
/* request SEC to INIT hash. */
- if (req_ctx->first && !req_ctx->swinit)
+ if (req_ctx->first_desc && !req_ctx->swinit)
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
/* When the tfm context has a keylen, it's an HMAC.
* A first or last (ie. not middle) descriptor must request HMAC.
*/
- if (ctx->keylen && (req_ctx->first || req_ctx->last))
+ if (ctx->keylen && (req_ctx->first_desc || req_ctx->last_desc))
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
return common_nonsnoop_hash(edesc, req_ctx->areq, nbytes_to_hash, ahash_done);
@@ -2076,7 +2076,7 @@ static void sec1_ahash_process_remaining(struct work_struct *work)
req_ctx->remaining_ahash_request_bytes;
if (req_ctx->last_request)
- req_ctx->last = 1;
+ req_ctx->last_desc = 1;
}
err = ahash_process_req_one(req_ctx->areq,
@@ -2103,7 +2103,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
if (nbytes > TALITOS1_MAX_DATA_LEN)
nbytes = TALITOS1_MAX_DATA_LEN;
else if (req_ctx->last_request)
- req_ctx->last = 1;
+ req_ctx->last_desc = 1;
}
req_ctx->current_ahash_request_bytes = nbytes;
@@ -2124,14 +2124,14 @@ static int ahash_init(struct ahash_request *areq)
/* Initialize the context */
req_ctx->buf_idx = 0;
req_ctx->nbuf = 0;
- req_ctx->first = 1; /* first indicates h/w must init its context */
+ req_ctx->first_desc = 1; /* first_desc indicates h/w must init its context */
req_ctx->swinit = 0; /* assume h/w init of context */
size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
: TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
req_ctx->hw_context_size = size;
req_ctx->last_request = 0;
- req_ctx->last = 0;
+ req_ctx->last_desc = 0;
INIT_WORK(&req_ctx->sec1_ahash_process_remaining, sec1_ahash_process_remaining);
dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
@@ -2224,8 +2224,8 @@ static int ahash_export(struct ahash_request *areq, void *out)
req_ctx->hw_context_size);
memcpy(export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf);
export->swinit = req_ctx->swinit;
- export->first = req_ctx->first;
- export->last = req_ctx->last;
+ export->first_desc = req_ctx->first_desc;
+ export->last_desc = req_ctx->last_desc;
export->to_hash_later = req_ctx->to_hash_later;
export->nbuf = req_ctx->nbuf;
@@ -2250,8 +2250,8 @@ static int ahash_import(struct ahash_request *areq, const void *in)
memcpy(req_ctx->hw_context, export->hw_context, size);
memcpy(req_ctx->buf[0], export->buf, export->nbuf);
req_ctx->swinit = export->swinit;
- req_ctx->first = export->first;
- req_ctx->last = export->last;
+ req_ctx->first_desc = export->first_desc;
+ req_ctx->last_desc = export->last_desc;
req_ctx->to_hash_later = export->to_hash_later;
req_ctx->nbuf = export->nbuf;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0070/1266] arm64: sysreg: Add layout for ID_AA64MMFR4_EL1
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0069/1266] crypto: talitos - rename first/last to first_desc/last_desc Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0071/1266] arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative Greg Kroah-Hartman
` (928 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suzuki K Poulose, Marc Zyngier,
Catalin Marinas, Miguel Luis, Oliver Upton, Colton Lewis,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit cfc680bb04c54e61faa51a34d8383a0aa25b583f ]
ARMv9.5 has infroduced ID_AA64MMFR4_EL1 with a bunch of new features.
Add the corresponding layout.
This is extracted from the public ARM SysReg_xml_A_profile-2023-09
delivery, timestamped d55f5af8e09052abe92a02adf820deea2eaed717.
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Miguel Luis <miguel.luis@oracle.com>
Link: https://lore.kernel.org/r/20240122181344.258974-5-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/tools/sysreg | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index 76ce150e7347e5..f7180d391f829f 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -1669,6 +1669,43 @@ UnsignedEnum 3:0 TCRX
EndEnum
EndSysreg
+Sysreg ID_AA64MMFR4_EL1 3 0 0 7 4
+Res0 63:40
+UnsignedEnum 39:36 E3DSE
+ 0b0000 NI
+ 0b0001 IMP
+EndEnum
+Res0 35:28
+SignedEnum 27:24 E2H0
+ 0b0000 IMP
+ 0b1110 NI_NV1
+ 0b1111 NI
+EndEnum
+UnsignedEnum 23:20 NV_frac
+ 0b0000 NV_NV2
+ 0b0001 NV2_ONLY
+EndEnum
+UnsignedEnum 19:16 FGWTE3
+ 0b0000 NI
+ 0b0001 IMP
+EndEnum
+UnsignedEnum 15:12 HACDBS
+ 0b0000 NI
+ 0b0001 IMP
+EndEnum
+UnsignedEnum 11:8 ASID2
+ 0b0000 NI
+ 0b0001 IMP
+EndEnum
+SignedEnum 7:4 EIESB
+ 0b0000 NI
+ 0b0001 ToEL3
+ 0b0010 ToELx
+ 0b1111 ANY
+EndEnum
+Res0 3:0
+EndSysreg
+
Sysreg SCTLR_EL1 3 0 1 0 0
Field 63 TIDCP
Field 62 SPINTMASK
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0071/1266] arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0070/1266] arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0072/1266] arm64: Fix early handling of FEAT_E2H0 not being implemented Greg Kroah-Hartman
` (927 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suzuki K Poulose, Marc Zyngier,
Catalin Marinas, Oliver Upton, Colton Lewis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 3944382fa6f22b54fd399632b1af92c28123979b ]
For CPUs that have ID_AA64MMFR4_EL1.E2H0 as negative, it is important
to avoid the boot path that sets HCR_EL2.E2H=0. Fortunately, we
already have this path to cope with fruity CPUs.
Tweak init_el2 to look at ID_AA64MMFR4_EL1.E2H0 first.
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20240122181344.258974-8-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/head.S | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 6517bf2644a08b..e32c8dd0b17a77 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -589,25 +589,32 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
mov_q x1, INIT_SCTLR_EL1_MMU_OFF
/*
- * Fruity CPUs seem to have HCR_EL2.E2H set to RES1,
- * making it impossible to start in nVHE mode. Is that
- * compliant with the architecture? Absolutely not!
+ * Compliant CPUs advertise their VHE-onlyness with
+ * ID_AA64MMFR4_EL1.E2H0 < 0. HCR_EL2.E2H can be
+ * RES1 in that case.
+ *
+ * Fruity CPUs seem to have HCR_EL2.E2H set to RES1, but
+ * don't advertise it (they predate this relaxation).
*/
+ mrs_s x0, SYS_ID_AA64MMFR4_EL1
+ ubfx x0, x0, #ID_AA64MMFR4_EL1_E2H0_SHIFT, #ID_AA64MMFR4_EL1_E2H0_WIDTH
+ tbnz x0, #(ID_AA64MMFR4_EL1_E2H0_SHIFT + ID_AA64MMFR4_EL1_E2H0_WIDTH - 1), 1f
+
mrs x0, hcr_el2
and x0, x0, #HCR_E2H
- cbz x0, 1f
-
+ cbz x0, 2f
+1:
/* Set a sane SCTLR_EL1, the VHE way */
pre_disable_mmu_workaround
msr_s SYS_SCTLR_EL12, x1
mov x2, #BOOT_CPU_FLAG_E2H
- b 2f
+ b 3f
-1:
+2:
pre_disable_mmu_workaround
msr sctlr_el1, x1
mov x2, xzr
-2:
+3:
__init_el2_nvhe_prepare_eret
mov w0, #BOOT_CPU_MODE_EL2
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0072/1266] arm64: Fix early handling of FEAT_E2H0 not being implemented
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0071/1266] arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0073/1266] KVM: arm64: Initialize HCR_EL2.E2H early Greg Kroah-Hartman
` (926 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Catalin Marinas,
Oliver Upton, Colton Lewis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit b3320142f3db9b3f2a23460abd3e22292e1530a5 ]
Commit 3944382fa6f2 introduced checks for the FEAT_E2H0 not being
implemented. However, the check is absolutely wrong and makes a
point it testing a bit that is guaranteed to be zero.
On top of that, the detection happens way too late, after the
init_el2_state has done its job.
This went undetected because the HW this was tested on has E2H being
RAO/WI, and not RES1. However, the bug shows up when run as a nested
guest, where HCR_EL2.E2H is not necessarily set to 1. As a result,
booting the kernel in hVHE mode fails with timer accesses being
cought in a trap loop (which was fun to debug).
Fix the check for ID_AA64MMFR4_EL1.E2H0, and set the HCR_EL2.E2H bit
early so that it can be checked by the rest of the init sequence.
With this, hVHE works again in a NV environment that doesn't have
FEAT_E2H0.
Fixes: 3944382fa6f2 ("arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20240321115414.3169115-1-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/head.S | 29 ++++++++++++++++-------------
1 file changed, 16 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index e32c8dd0b17a77..e0e710b36da378 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -576,6 +576,21 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
isb
0:
mov_q x0, HCR_HOST_NVHE_FLAGS
+
+ /*
+ * Compliant CPUs advertise their VHE-onlyness with
+ * ID_AA64MMFR4_EL1.E2H0 < 0. HCR_EL2.E2H can be
+ * RES1 in that case. Publish the E2H bit early so that
+ * it can be picked up by the init_el2_state macro.
+ *
+ * Fruity CPUs seem to have HCR_EL2.E2H set to RAO/WI, but
+ * don't advertise it (they predate this relaxation).
+ */
+ mrs_s x1, SYS_ID_AA64MMFR4_EL1
+ tbz x1, #(ID_AA64MMFR4_EL1_E2H0_SHIFT + ID_AA64MMFR4_EL1_E2H0_WIDTH - 1), 1f
+
+ orr x0, x0, #HCR_E2H
+1:
msr hcr_el2, x0
isb
@@ -588,22 +603,10 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
mov_q x1, INIT_SCTLR_EL1_MMU_OFF
- /*
- * Compliant CPUs advertise their VHE-onlyness with
- * ID_AA64MMFR4_EL1.E2H0 < 0. HCR_EL2.E2H can be
- * RES1 in that case.
- *
- * Fruity CPUs seem to have HCR_EL2.E2H set to RES1, but
- * don't advertise it (they predate this relaxation).
- */
- mrs_s x0, SYS_ID_AA64MMFR4_EL1
- ubfx x0, x0, #ID_AA64MMFR4_EL1_E2H0_SHIFT, #ID_AA64MMFR4_EL1_E2H0_WIDTH
- tbnz x0, #(ID_AA64MMFR4_EL1_E2H0_SHIFT + ID_AA64MMFR4_EL1_E2H0_WIDTH - 1), 1f
-
mrs x0, hcr_el2
and x0, x0, #HCR_E2H
cbz x0, 2f
-1:
+
/* Set a sane SCTLR_EL1, the VHE way */
pre_disable_mmu_workaround
msr_s SYS_SCTLR_EL12, x1
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0073/1266] KVM: arm64: Initialize HCR_EL2.E2H early
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0072/1266] arm64: Fix early handling of FEAT_E2H0 not being implemented Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0074/1266] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() Greg Kroah-Hartman
` (925 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Ahmed Genidi,
Ben Horgan, Catalin Marinas, Leo Yan, Marc Zyngier, Oliver Upton,
Will Deacon, Colton Lewis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit 7a68b55ff39b0a1638acb1694c185d49f6077a0d ]
On CPUs without FEAT_E2H0, HCR_EL2.E2H is RES1, but may reset to an
UNKNOWN value out of reset and consequently may not read as 1 unless it
has been explicitly initialized.
We handled this for the head.S boot code in commits:
3944382fa6f22b54 ("arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative")
b3320142f3db9b3f ("arm64: Fix early handling of FEAT_E2H0 not being implemented")
Unfortunately, we forgot to apply a similar fix to the KVM PSCI entry
points used when relaying CPU_ON, CPU_SUSPEND, and SYSTEM SUSPEND. When
KVM is entered via these entry points, the value of HCR_EL2.E2H may be
consumed before it has been initialized (e.g. by the 'init_el2_state'
macro).
Initialize HCR_EL2.E2H early in these paths such that it can be consumed
reliably. The existing code in head.S is factored out into a new
'init_el2_hcr' macro, and this is used in the __kvm_hyp_init_cpu()
function common to all the relevant PSCI entry points.
For clarity, I've tweaked the assembly used to check whether
ID_AA64MMFR4_EL1.E2H0 is negative. The bitfield is extracted as a signed
value, and this is checked with a signed-greater-or-equal (GE) comparison.
As the hyp code will reconfigure HCR_EL2 later in ___kvm_hyp_init(), all
bits other than E2H are initialized to zero in __kvm_hyp_init_cpu().
Fixes: 3944382fa6f22b54 ("arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative")
Fixes: b3320142f3db9b3f ("arm64: Fix early handling of FEAT_E2H0 not being implemented")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Ahmed Genidi <ahmed.genidi@arm.com>
Cc: Ben Horgan <ben.horgan@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20250227180526.1204723-2-mark.rutland@arm.com
[maz: fixed LT->GE thinko]
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ Backport: Resolved trivial conflict in arch/arm64/kvm/hyp/nvhe/hyp-init.S
caused by __kvm_init_el2_state not existing in 6.6.y (EL2 state is initialized
inline via init_el2_state / finalise_el2_state); placed init_el2_hcr 0
directly before the inline sequence. ]
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/el2_setup.h | 26 ++++++++++++++++++++++++++
arch/arm64/kernel/head.S | 19 +------------------
arch/arm64/kvm/hyp/nvhe/hyp-init.S | 2 ++
3 files changed, 29 insertions(+), 18 deletions(-)
diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
index b7afaa026842b7..3498dc5d02c188 100644
--- a/arch/arm64/include/asm/el2_setup.h
+++ b/arch/arm64/include/asm/el2_setup.h
@@ -16,6 +16,32 @@
#include <asm/sysreg.h>
#include <linux/irqchip/arm-gic-v3.h>
+.macro init_el2_hcr val
+ mov_q x0, \val
+
+ /*
+ * Compliant CPUs advertise their VHE-onlyness with
+ * ID_AA64MMFR4_EL1.E2H0 < 0. On such CPUs HCR_EL2.E2H is RES1, but it
+ * can reset into an UNKNOWN state and might not read as 1 until it has
+ * been initialized explicitly.
+ *
+ * Fruity CPUs seem to have HCR_EL2.E2H set to RAO/WI, but
+ * don't advertise it (they predate this relaxation).
+ *
+ * Initalize HCR_EL2.E2H so that later code can rely upon HCR_EL2.E2H
+ * indicating whether the CPU is running in E2H mode.
+ */
+ mrs_s x1, SYS_ID_AA64MMFR4_EL1
+ sbfx x1, x1, #ID_AA64MMFR4_EL1_E2H0_SHIFT, #ID_AA64MMFR4_EL1_E2H0_WIDTH
+ cmp x1, #0
+ b.ge .LnVHE_\@
+
+ orr x0, x0, #HCR_E2H
+.LnVHE_\@:
+ msr hcr_el2, x0
+ isb
+.endm
+
.macro __init_el2_sctlr
mov_q x0, INIT_SCTLR_EL2_MMU_OFF
msr sctlr_el2, x0
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index e0e710b36da378..ff7769821166a4 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -575,25 +575,8 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
msr sctlr_el2, x0
isb
0:
- mov_q x0, HCR_HOST_NVHE_FLAGS
-
- /*
- * Compliant CPUs advertise their VHE-onlyness with
- * ID_AA64MMFR4_EL1.E2H0 < 0. HCR_EL2.E2H can be
- * RES1 in that case. Publish the E2H bit early so that
- * it can be picked up by the init_el2_state macro.
- *
- * Fruity CPUs seem to have HCR_EL2.E2H set to RAO/WI, but
- * don't advertise it (they predate this relaxation).
- */
- mrs_s x1, SYS_ID_AA64MMFR4_EL1
- tbz x1, #(ID_AA64MMFR4_EL1_E2H0_SHIFT + ID_AA64MMFR4_EL1_E2H0_WIDTH - 1), 1f
-
- orr x0, x0, #HCR_E2H
-1:
- msr hcr_el2, x0
- isb
+ init_el2_hcr HCR_HOST_NVHE_FLAGS
init_el2_state
/* Hypervisor stub */
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-init.S b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
index 1cc06e6797bda3..3efa9cfaa9d48d 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-init.S
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
@@ -202,6 +202,8 @@ SYM_CODE_START_LOCAL(__kvm_hyp_init_cpu)
2: msr SPsel, #1 // We want to use SP_EL{1,2}
+ init_el2_hcr 0
+
/* Initialize EL2 CPU state to sane values. */
init_el2_state // Clobbers x0..x2
finalise_el2_state
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0074/1266] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0073/1266] KVM: arm64: Initialize HCR_EL2.E2H early Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0075/1266] arm64: Revamp HCR_EL2.E2H RES1 detection Greg Kroah-Hartman
` (924 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, Ahmed Genidi, Mark Rutland,
Ben Horgan, Catalin Marinas, Marc Zyngier, Oliver Upton,
Will Deacon, Colton Lewis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Genidi <ahmed.genidi@arm.com>
[ Upstream commit 3855a7b91d42ebf3513b7ccffc44807274978b3d ]
When KVM is in protected mode, host calls to PSCI are proxied via EL2,
and cold entries from CPU_ON, CPU_SUSPEND, and SYSTEM_SUSPEND bounce
through __kvm_hyp_init_cpu() at EL2 before entering the host kernel's
entry point at EL1. While __kvm_hyp_init_cpu() initializes SPSR_EL2 for
the exception return to EL1, it does not initialize SCTLR_EL1.
Due to this, it's possible to enter EL1 with SCTLR_EL1 in an UNKNOWN
state. In practice this has been seen to result in kernel crashes after
CPU_ON as a result of SCTLR_EL1.M being 1 in violation of the initial
core configuration specified by PSCI.
Fix this by initializing SCTLR_EL1 for cold entry to the host kernel.
As it's necessary to write to SCTLR_EL12 in VHE mode, this
initialization is moved into __kvm_host_psci_cpu_entry() where we can
use write_sysreg_el1().
The remnants of the '__init_el2_nvhe_prepare_eret' macro are folded into
its only caller, as this is clearer than having the macro.
Fixes: cdf367192766ad11 ("KVM: arm64: Intercept host's CPU_ON SMCs")
Reported-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Ahmed Genidi <ahmed.genidi@arm.com>
[ Mark: clarify commit message, handle E2H, move to C, remove macro ]
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Ahmed Genidi <ahmed.genidi@arm.com>
Cc: Ben Horgan <ben.horgan@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Link: https://lore.kernel.org/r/20250227180526.1204723-3-mark.rutland@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ Backport: Resolved context conflicts when removing the
__init_el2_nvhe_prepare_eret macro and invocation:
- arch/arm64/include/asm/el2_setup.h: conflicted because 6.6.y lacks later
GCS/MPAM macros (__init_el2_gcs / __init_el2_mpam) surrounding the definition.
- arch/arm64/kvm/hyp/nvhe/hyp-init.S: conflicted because __kvm_init_el2_state
does not exist in 6.6.y (EL2 state is initialized inline). ]
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/el2_setup.h | 4 ----
arch/arm64/kernel/head.S | 3 ++-
arch/arm64/kvm/hyp/nvhe/hyp-init.S | 1 -
arch/arm64/kvm/hyp/nvhe/psci-relay.c | 3 +++
4 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
index 3498dc5d02c188..76b0d50d286d59 100644
--- a/arch/arm64/include/asm/el2_setup.h
+++ b/arch/arm64/include/asm/el2_setup.h
@@ -229,10 +229,6 @@
.Lskip_fgt_\@:
.endm
-.macro __init_el2_nvhe_prepare_eret
- mov x0, #INIT_PSTATE_EL1
- msr spsr_el2, x0
-.endm
/**
* Initialize EL2 registers to sane values. This should be called early on all
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index ff7769821166a4..9996029853d236 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -601,7 +601,8 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
msr sctlr_el1, x1
mov x2, xzr
3:
- __init_el2_nvhe_prepare_eret
+ mov x0, #INIT_PSTATE_EL1
+ msr spsr_el2, x0
mov w0, #BOOT_CPU_MODE_EL2
orr x0, x0, x2
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-init.S b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
index 3efa9cfaa9d48d..9b2ada54be5384 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-init.S
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
@@ -207,7 +207,6 @@ SYM_CODE_START_LOCAL(__kvm_hyp_init_cpu)
/* Initialize EL2 CPU state to sane values. */
init_el2_state // Clobbers x0..x2
finalise_el2_state
- __init_el2_nvhe_prepare_eret
/* Enable MMU, set vectors and stack. */
mov x0, x28
diff --git a/arch/arm64/kvm/hyp/nvhe/psci-relay.c b/arch/arm64/kvm/hyp/nvhe/psci-relay.c
index d57bcb6ab94d25..5688a16e2ea75d 100644
--- a/arch/arm64/kvm/hyp/nvhe/psci-relay.c
+++ b/arch/arm64/kvm/hyp/nvhe/psci-relay.c
@@ -218,6 +218,9 @@ asmlinkage void __noreturn __kvm_host_psci_cpu_entry(bool is_cpu_on)
if (is_cpu_on)
release_boot_args(boot_args);
+ write_sysreg_el1(INIT_SCTLR_EL1_MMU_OFF, SYS_SCTLR);
+ write_sysreg(INIT_PSTATE_EL1, SPSR_EL2);
+
__host_enter(host_ctxt);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0075/1266] arm64: Revamp HCR_EL2.E2H RES1 detection
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0074/1266] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0076/1266] arm64: sysreg: Correct sign definitions for EIESB and DoubleLock Greg Kroah-Hartman
` (923 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Catalin Marinas,
Oliver Upton, Jan Kotas, Marc Zyngier, Colton Lewis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit ca88ecdce5f51874a7c151809bd2c936ee0d3805 ]
We currently have two ways to identify CPUs that only implement FEAT_VHE
and not FEAT_E2H0:
- either they advertise it via ID_AA64MMFR4_EL1.E2H0,
- or the HCR_EL2.E2H bit is RAO/WI
However, there is a third category of "cpus" that fall between these
two cases: on CPUs that do not implement FEAT_FGT, it is IMPDEF whether
an access to ID_AA64MMFR4_EL1 can trap to EL2 when the register value
is zero.
A consequence of this is that on systems such as Neoverse V2, a NV
guest cannot reliably detect that it is in a VHE-only configuration
(E2H is writable, and ID_AA64MMFR0_EL1 is 0), despite the hypervisor's
best effort to repaint the id register.
Replace the RAO/WI test by a sequence that makes use of the VHE
register remnapping between EL1 and EL2 to detect this situation,
and work out whether we get the VHE behaviour even after having
set HCR_EL2.E2H to 0.
This solves the NV problem, and provides a more reliable acid test
for CPUs that do not completely follow the letter of the architecture
while providing a RES1 behaviour for HCR_EL2.E2H.
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Tested-by: Jan Kotas <jank@cadence.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/15A85F2B-1A0C-4FA7-9FE4-EEC2203CC09E@global.cadence.com
[ Backport: Resolved conflict in arch/arm64/include/asm/el2_setup.h
by replacing msr_hcr_el2 macro usages with raw msr hcr_el2 (since
the macro is missing in 6.6.y). ]
Signed-off-by: Colton Lewis <coltonlewis@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/el2_setup.h | 38 +++++++++++++++++++++++++-----
1 file changed, 32 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
index 76b0d50d286d59..4c7467b382b608 100644
--- a/arch/arm64/include/asm/el2_setup.h
+++ b/arch/arm64/include/asm/el2_setup.h
@@ -24,22 +24,48 @@
* ID_AA64MMFR4_EL1.E2H0 < 0. On such CPUs HCR_EL2.E2H is RES1, but it
* can reset into an UNKNOWN state and might not read as 1 until it has
* been initialized explicitly.
- *
- * Fruity CPUs seem to have HCR_EL2.E2H set to RAO/WI, but
- * don't advertise it (they predate this relaxation).
- *
* Initalize HCR_EL2.E2H so that later code can rely upon HCR_EL2.E2H
* indicating whether the CPU is running in E2H mode.
*/
mrs_s x1, SYS_ID_AA64MMFR4_EL1
sbfx x1, x1, #ID_AA64MMFR4_EL1_E2H0_SHIFT, #ID_AA64MMFR4_EL1_E2H0_WIDTH
cmp x1, #0
- b.ge .LnVHE_\@
+ b.lt .LnE2H0_\@
+ /*
+ * Unfortunately, HCR_EL2.E2H can be RES1 even if not advertised
+ * as such via ID_AA64MMFR4_EL1.E2H0:
+ *
+ * - Fruity CPUs predate the !FEAT_E2H0 relaxation, and seem to
+ * have HCR_EL2.E2H implemented as RAO/WI.
+ *
+ * - On CPUs that lack FEAT_FGT, a hypervisor can't trap guest
+ * reads of ID_AA64MMFR4_EL1 to advertise !FEAT_E2H0. NV
+ * guests on these hosts can write to HCR_EL2.E2H without
+ * trapping to the hypervisor, but these writes have no
+ * functional effect.
+ *
+ * Handle both cases by checking for an essential VHE property
+ * (system register remapping) to decide whether we're
+ * effectively VHE-only or not.
+ */
+ msr hcr_el2, x0 // Setup HCR_EL2 as nVHE
+ isb
+ mov x1, #1 // Write something to FAR_EL1
+ msr far_el1, x1
+ isb
+ mov x1, #2 // Try to overwrite it via FAR_EL2
+ msr far_el2, x1
+ isb
+ mrs x1, far_el1 // If we see the latest write in FAR_EL1,
+ cmp x1, #2 // we can safely assume we are VHE only.
+ b.ne .LnVHE_\@ // Otherwise, we know that nVHE works.
+
+.LnE2H0_\@:
orr x0, x0, #HCR_E2H
-.LnVHE_\@:
msr hcr_el2, x0
isb
+.LnVHE_\@:
.endm
.macro __init_el2_sctlr
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0076/1266] arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0075/1266] arm64: Revamp HCR_EL2.E2H RES1 detection Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0077/1266] virtio_net: Support dynamic rss indirection table size Greg Kroah-Hartman
` (922 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fuad Tabba, Mark Rutland,
Will Deacon, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fuad Tabba <tabba@google.com>
[ Upstream commit f4d4ebc84995178273740f3e601e97fdefc561d2 ]
The `ID_AA64MMFR4_EL1.EIESB` field, is an unsigned enumeration, but was
incorrectly defined as a `SignedEnum` when introduced in commit
cfc680bb04c5 ("arm64: sysreg: Add layout for ID_AA64MMFR4_EL1"). This is
corrected to `UnsignedEnum`.
Conversely, the `ID_AA64DFR0_EL1.DoubleLock` field, is a signed
enumeration, but was incorrectly defined as an `UnsignedEnum`. This is
corrected to `SignedEnum`, which wasn't correctly set when annotated as
such in commit ad16d4cf0b4f ("arm64/sysreg: Initial unsigned annotations
for ID registers").
Signed-off-by: Fuad Tabba <tabba@google.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/tools/sysreg | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index f7180d391f829f..43089787196bad 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -1130,7 +1130,7 @@ UnsignedEnum 43:40 TraceFilt
0b0000 NI
0b0001 IMP
EndEnum
-UnsignedEnum 39:36 DoubleLock
+SignedEnum 39:36 DoubleLock
0b0000 IMP
0b1111 NI
EndEnum
@@ -1697,7 +1697,7 @@ UnsignedEnum 11:8 ASID2
0b0000 NI
0b0001 IMP
EndEnum
-SignedEnum 7:4 EIESB
+UnsignedEnum 7:4 EIESB
0b0000 NI
0b0001 ToEL3
0b0010 ToELx
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0077/1266] virtio_net: Support dynamic rss indirection table size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0076/1266] arm64: sysreg: Correct sign definitions for EIESB and DoubleLock Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0078/1266] LoongArch: Add PIO for early access before ACPI PCI root register Greg Kroah-Hartman
` (921 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philo Lu, Xuan Zhuo, Joe Damato,
Michael S. Tsirkin, Paolo Abeni, Hyokyung Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philo Lu <lulie@linux.alibaba.com>
commit 86a48a00efdf61197b6658e52c6140463eb313dc upstream.
When reading/writing virtio_net_ctrl_rss, the indirection table size is
obtained from vi->rss_indir_table_size, initialized during virtnet_probe().
However, the indirection_table was statically sized as
VIRTIO_NET_RSS_MAX_TABLE_LEN=128, potentially causing issues when
vi->rss_indir_table_size exceeds this limit.
This patch implements dynamic allocation for the indirection table,
allocated alongside vi->rss after vi->rss_indir_table_size is initialized,
and freed in virtnet_remove().
In virtnet_commit_rss_command(), scatter-gather lists for RSS are
initialized differently based on hash_report presence, so indirection_table
is unused when !vi->has_rss. Therefore, allocation is unnecessary for
hash_report-only scenarios.
Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.")
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Joe Damato <jdamato@fastly.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ Hyokyung Kim: 6.6.y predates the refactor that moved the RSS config into
struct virtnet_info, so struct virtio_net_ctrl_rss is still embedded in
struct control_buf and reached through the heap-allocated vi->ctrl. Every
adaptation below follows from that single difference:
- the new allocation and all indirection_table accesses use vi->ctrl->rss
in place of upstream's vi->rss;
- because vi->ctrl is allocated in virtnet_alloc_queues() (via init_vqs())
and freed in virtnet_free_queues(), the table is allocated and freed there
too, not in virtnet_probe()/virtnet_remove(), so its lifetime tracks
vi->ctrl across the probe error-unwind and freeze/restore paths;
- since freeing the table now dereferences vi->ctrl, vi->ctrl is set to NULL
after each kfree so a re-entered virtnet_free_queues() cannot dereference
or free a stale pointer;
- the table is allocated with kcalloc() so it is zero-filled when
reallocated on the restore path (upstream never reallocates it). ]
Signed-off-by: Hyokyung Kim <pulpannie@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 43 +++++++++++++++++++++++++++++++++++-----
1 file changed, 38 insertions(+), 5 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 33f61922c13994..5bcd1296851c6c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -208,15 +208,16 @@ struct receive_queue {
* because table sizes may be differ according to the device configuration.
*/
#define VIRTIO_NET_RSS_MAX_KEY_SIZE 40
-#define VIRTIO_NET_RSS_MAX_TABLE_LEN 128
struct virtio_net_ctrl_rss {
u32 hash_types;
u16 indirection_table_mask;
u16 unclassified_queue;
- u16 indirection_table[VIRTIO_NET_RSS_MAX_TABLE_LEN];
+ u16 hash_cfg_reserved; /* for HASH_CONFIG (see virtio_net_hash_config for details) */
u16 max_tx_vq;
u8 hash_key_length;
u8 key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
+
+ u16 *indirection_table;
};
/* Control VQ buffers: protected by the rtnl lock */
@@ -3011,6 +3012,25 @@ static int virtnet_set_ringparam(struct net_device *dev,
return 0;
}
+static int rss_indirection_table_alloc(struct virtio_net_ctrl_rss *rss, u16 indir_table_size)
+{
+ if (!indir_table_size) {
+ rss->indirection_table = NULL;
+ return 0;
+ }
+
+ rss->indirection_table = kcalloc(indir_table_size, sizeof(u16), GFP_KERNEL);
+ if (!rss->indirection_table)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static void rss_indirection_table_free(struct virtio_net_ctrl_rss *rss)
+{
+ kfree(rss->indirection_table);
+}
+
static bool virtnet_commit_rss_command(struct virtnet_info *vi)
{
struct net_device *dev = vi->dev;
@@ -3020,11 +3040,15 @@ static bool virtnet_commit_rss_command(struct virtnet_info *vi)
/* prepare sgs */
sg_init_table(sgs, 4);
- sg_buf_size = offsetof(struct virtio_net_ctrl_rss, indirection_table);
+ sg_buf_size = offsetof(struct virtio_net_ctrl_rss, hash_cfg_reserved);
sg_set_buf(&sgs[0], &vi->ctrl->rss, sg_buf_size);
- sg_buf_size = sizeof(uint16_t) * (vi->ctrl->rss.indirection_table_mask + 1);
- sg_set_buf(&sgs[1], vi->ctrl->rss.indirection_table, sg_buf_size);
+ if (vi->has_rss) {
+ sg_buf_size = sizeof(uint16_t) * vi->rss_indir_table_size;
+ sg_set_buf(&sgs[1], vi->ctrl->rss.indirection_table, sg_buf_size);
+ } else {
+ sg_set_buf(&sgs[1], &vi->ctrl->rss.hash_cfg_reserved, sizeof(uint16_t));
+ }
sg_buf_size = offsetof(struct virtio_net_ctrl_rss, key)
- offsetof(struct virtio_net_ctrl_rss, max_tx_vq);
@@ -4080,7 +4104,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
kfree(vi->rq);
kfree(vi->sq);
+ if (vi->ctrl)
+ rss_indirection_table_free(&vi->ctrl->rss);
kfree(vi->ctrl);
+ vi->ctrl = NULL;
}
static void _free_receive_bufs(struct virtnet_info *vi)
@@ -4266,6 +4293,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
if (!vi->ctrl)
goto err_ctrl;
+ if ((vi->has_rss || vi->has_rss_hash_report) &&
+ rss_indirection_table_alloc(&vi->ctrl->rss, vi->rss_indir_table_size))
+ goto err_sq;
} else {
vi->ctrl = NULL;
}
@@ -4298,7 +4328,10 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
err_rq:
kfree(vi->sq);
err_sq:
+ if (vi->ctrl)
+ rss_indirection_table_free(&vi->ctrl->rss);
kfree(vi->ctrl);
+ vi->ctrl = NULL;
err_ctrl:
return -ENOMEM;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0078/1266] LoongArch: Add PIO for early access before ACPI PCI root register
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0077/1266] virtio_net: Support dynamic rss indirection table size Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0079/1266] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
` (920 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huacai Chen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit 6061e65f95713b01f4313cda6637dfe3aa5412b4 upstream.
For ACPI system we suppose the ISA/LPC PIO range is registered together
with PCI root bridge. But the fact is there may be some early access to
the ISA/LPC PIO range before ACPI PCI root register (most of them are
due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range
usually causes ACPI PCI root register fail because of the address range
confliction. So we add a pair of helpers: acpi_add_early_pio() to add
PIO for early access, and acpi_remove_early_pio() to remove PIO before
PCI root register. Since acpi_remove_early_pio() may be called multiple
times, we add an acpi_pio flag to ensure PIO be removed only once.
Cc: <stable@vger.kernel.org>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/acpi.h | 2 ++
arch/loongarch/kernel/acpi.c | 28 ++++++++++++++++++++++++++++
arch/loongarch/kernel/setup.c | 2 ++
arch/loongarch/pci/acpi.c | 2 ++
4 files changed, 34 insertions(+)
diff --git a/arch/loongarch/include/asm/acpi.h b/arch/loongarch/include/asm/acpi.h
index 49e29b29996f0f..4f31109714c0ab 100644
--- a/arch/loongarch/include/asm/acpi.h
+++ b/arch/loongarch/include/asm/acpi.h
@@ -37,6 +37,8 @@ static inline bool acpi_has_cpu_in_madt(void)
extern struct list_head acpi_wakeup_device_list;
extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC];
+extern void acpi_add_early_pio(void);
+extern void acpi_remove_early_pio(void);
extern int __init parse_acpi_topology(void);
static inline u32 get_acpi_id_for_cpu(unsigned int cpu)
diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c
index 1f529b13490b3b..34101b753eaac3 100644
--- a/arch/loongarch/kernel/acpi.c
+++ b/arch/loongarch/kernel/acpi.c
@@ -14,6 +14,7 @@
#include <linux/memblock.h>
#include <linux/of_fdt.h>
#include <linux/serial_core.h>
+#include <linux/vmalloc.h>
#include <asm/io.h>
#include <asm/numa.h>
#include <asm/loongson.h>
@@ -57,6 +58,33 @@ void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
return ioremap_cache(phys, size);
}
+#define PIO_BASE (unsigned long)PCI_IOBASE
+#define PIO_SIZE ALIGN(ISA_IOSIZE, PAGE_SIZE)
+
+static bool acpi_pio;
+
+/* Add PIO for early access */
+void acpi_add_early_pio(void)
+{
+ if (!acpi_disabled) {
+ acpi_pio = true;
+ ioremap_page_range(PIO_BASE, PIO_BASE + PIO_SIZE,
+ LOONGSON_LIO_BASE, pgprot_device(PAGE_KERNEL));
+ }
+}
+
+/* Remove PIO for PCI register */
+void acpi_remove_early_pio(void)
+{
+ if (!acpi_pio)
+ return;
+
+ if (!acpi_disabled) {
+ acpi_pio = false;
+ vunmap_range(PIO_BASE, PIO_BASE + PIO_SIZE);
+ }
+}
+
#ifdef CONFIG_SMP
static int set_processor_mask(u32 id, u32 flags)
{
diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
index 2e34ece474eece..729b0660b61c1a 100644
--- a/arch/loongarch/kernel/setup.c
+++ b/arch/loongarch/kernel/setup.c
@@ -530,6 +530,8 @@ static __init int arch_reserve_pio_range(void)
{
struct device_node *np;
+ acpi_add_early_pio();
+
for_each_node_by_name(np, "isa") {
struct of_range range;
struct of_range_parser parser;
diff --git a/arch/loongarch/pci/acpi.c b/arch/loongarch/pci/acpi.c
index 2d584a59a2a049..b53dae9d57c899 100644
--- a/arch/loongarch/pci/acpi.c
+++ b/arch/loongarch/pci/acpi.c
@@ -65,6 +65,8 @@ static int acpi_prepare_root_resources(struct acpi_pci_root_info *ci)
struct resource_entry *entry, *tmp;
struct acpi_device *device = ci->bridge;
+ acpi_remove_early_pio();
+
status = acpi_pci_probe_root_resources(ci);
if (status > 0) {
acpi_evaluate_integer(device->handle, "PCIH", NULL, &pci_h);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0079/1266] net: Drop the lock in skb_may_tx_timestamp()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0078/1266] LoongArch: Add PIO for early access before ACPI PCI root register Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0080/1266] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
` (919 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Willem de Bruijn, Jason Xing, Eric Dumazet, Paolo Abeni, Philo Lu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 upstream.
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ adapted sk_set_socket() in include/net/sock.h to fix the conflict from
not having commit 5d6b58c932ec ("net: lockless sock_i_ino()") and the
additional previous changes required by it.
It comes down to just now having the lines of
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
}
below the changed line. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index a6944844553afe..c1f129a532b200 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2155,7 +2155,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
}
static inline wait_queue_head_t *sk_sleep(struct sock *sk)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c5e2ae6d0406bd..732204d99822a2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5258,15 +5258,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index fa242d7e51c791..ae31c54664632c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -671,7 +671,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0080/1266] MIPS: smp: report dying CPU to RCU in stop_this_cpu()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0079/1266] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0081/1266] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
` (918 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Jelonek, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Jelonek <jelonek.jonas@gmail.com>
commit 9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7 upstream.
smp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function
marks the CPU offline for the scheduler via set_cpu_online(false) but
never informs RCU, so RCU keeps expecting a quiescent state from CPUs
that are now spinning forever with interrupts disabled.
As long as nothing waits for an RCU grace period after smp_send_stop()
this is harmless, which is why it went unnoticed. Since commit
91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")
however, irq_work_sync() calls synchronize_rcu() on architectures without
an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns
false. That is the asm-generic default used by MIPS. Any irq_work_sync()
issued in the reboot/shutdown path after smp_send_stop() then blocks on
a grace period that can never complete, hanging the reboot:
WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
...
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
rcu: Offline CPU 1 blocking current GP.
rcu: Offline CPU 2 blocking current GP.
rcu: Offline CPU 3 blocking current GP.
This issue was noticed on several Realtek MIPS switch SoCs (MIPS
interAptiv) and came up during kernel bump downstream in OpenWrt from
6.18.33 to 6.18.34, after the backport of the patch to the 6.18 stable
branch. The patch also has been backported all the way back to 6.1.
Call rcu_report_dead() once interrupts are disabled, mirroring the
generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs
and grace periods can still complete. MIPS shuts down all CPUs here
without going through the CPU-hotplug mechanism, so this report is not
otherwise issued. Reporting a dying CPU to RCU outside the regular hotplug
offline path is not unprecedented: arm64 does the same in cpu_die_early().
There it is an exception for a CPU that was coming online and is aborting
bringup, rather than the default shutdown action as on MIPS.
Note: this differs from the upstream commit in that it calls
rcu_report_dead(smp_processor_id()) instead of rcutree_report_cpu_dead().
The latter, along with the rcutree_report_cpu_dead() name, was introduced
by commit 448e9f34d91d ("rcu: Standardize explicit CPU-hotplug calls")
in v6.7; on this kernel the equivalent function is still named
rcu_report_dead() and takes an explicit CPU argument.
Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/smp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 81f6c4f8fbc154..1a3eb4820eb702 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -19,6 +19,7 @@
#include <linux/sched/mm.h>
#include <linux/cpumask.h>
#include <linux/cpu.h>
+#include <linux/rcupdate.h>
#include <linux/err.h>
#include <linux/ftrace.h>
#include <linux/irqdomain.h>
@@ -410,6 +411,7 @@ static void stop_this_cpu(void *dummy)
set_cpu_online(smp_processor_id(), false);
calculate_cpu_foreign_map();
local_irq_disable();
+ rcu_report_dead(smp_processor_id());
while (1);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0081/1266] usb: gadget: function: rndis: add length check to response query
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0080/1266] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0082/1266] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
` (917 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Griffin Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <griffin@kroah.com>
commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream.
Add variable representations for BufLength and BufOffset in
rndis_query_response(), and perform a length check on them.
This is identical to how rndis_set_response() handles these parameters.
Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/rndis.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -591,6 +591,7 @@ static int rndis_init_response(struct rn
static int rndis_query_response(struct rndis_params *params,
rndis_query_msg_type *buf)
{
+ u32 BufLength, BufOffset;
rndis_query_cmplt_type *resp;
rndis_resp_t *r;
@@ -598,6 +599,13 @@ static int rndis_query_response(struct r
if (!params->dev)
return -ENOTSUPP;
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+ return -EINVAL;
+
/*
* we need more memory:
* gen_ndis_query_resp expects enough space for
@@ -614,10 +622,8 @@ static int rndis_query_response(struct r
resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID),
- le32_to_cpu(buf->InformationBufferOffset)
- + 8 + (u8 *)buf,
- le32_to_cpu(buf->InformationBufferLength),
- r)) {
+ BufOffset + 8 + (u8 *)buf,
+ BufLength, r)) {
/* OID not supported */
resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
resp->MessageLength = cpu_to_le32(sizeof *resp);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0082/1266] usb: gadget: function: rndis: add length check for header
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0081/1266] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0083/1266] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
` (916 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Griffin Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <griffin@kroah.com>
commit 21b5bf155435008e0fb0736795289788e63d426f upstream.
Add a length check for the rndis header in rndis_rm_hdr, to ensure that
MessageType, MessageLength, DataOffset, and DataLength fields are
present before they are accessed.
Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/rndis.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port,
/* tmp points to a struct rndis_packet_msg_type */
__le32 *tmp = (void *)skb->data;
+ /* Need at least MessageType, MessageLength, DataOffset, DataLength */
+ if (skb->len < 16) {
+ dev_kfree_skb_any(skb);
+ return -EINVAL;
+ }
+
/* MessageType, MessageLength */
if (cpu_to_le32(RNDIS_MSG_PACKET)
!= get_unaligned(tmp++)) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0083/1266] iio: accel: bmc150: clamp the device-reported FIFO frame count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0082/1266] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0084/1266] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
` (915 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream.
__bmc150_accel_fifo_flush() copies the number of samples the device
reports in its hardware FIFO into an on-stack buffer
u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The
frame count is read from the FIFO_STATUS register and only masked to its
7 valid bits:
count = val & 0x7F;
so it can be 0..127. The only other limit applied to it is the optional
caller-supplied sample budget:
if (samples && count > samples)
count = samples;
which does not constrain count on the flush-all path (samples == 0), and
leaves it well above 32 whenever samples is larger. count samples are
then transferred into buffer[]:
bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a
malfunctioning, malicious or counterfeit accelerometer (or an attacker
tampering with the I2C/SPI bus) that reports up to 127 frames writes up
to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up
to 570 bytes that clobbers the stack canary, saved registers and the
return address.
Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]
is sized for, before the transfer, mirroring the watermark clamp already
done in bmc150_accel_set_watermark(). A well-formed flush reports at most
BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/bmc150-accel-core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -1037,6 +1037,8 @@ static int __bmc150_accel_fifo_flush(str
if (samples && count > samples)
count = samples;
+ count = min_t(u8, count, BMC150_ACCEL_FIFO_LENGTH);
+
ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0084/1266] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0083/1266] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0085/1266] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
` (914 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream.
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
but returns -EINVAL directly when a scale with a non-zero integer part is
requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
a runtime PM usage-counter reference on every such write, after which the
device can no longer autosuspend.
Set the error code and fall through to the existing put instead of
returning early.
Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Assisted-by: Claude:claude-opus-4-8 coccinelle
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kxsd9.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -146,8 +146,9 @@ static int kxsd9_write_raw(struct iio_de
if (mask == IIO_CHAN_INFO_SCALE) {
/* Check no integer component */
if (val)
- return -EINVAL;
- ret = kxsd9_write_scale(indio_dev, val2);
+ ret = -EINVAL;
+ else
+ ret = kxsd9_write_scale(indio_dev, val2);
}
pm_runtime_mark_last_busy(st->dev);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0085/1266] iio: adc: lpc32xx: Initialize completion before requesting IRQ
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0084/1266] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0086/1266] iio: adc: spear: " Greg Kroah-Hartman
` (913 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Kyungwook Boo,
Jaeyoung Chung, Maxwell Doose, Vladimir Zapolskiy, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream.
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Fixes: 7901b2a1453e ("staging:iio:adc:lpc32xx rename local state structure to _state")
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/lpc32xx_adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/adc/lpc32xx_adc.c
+++ b/drivers/iio/adc/lpc32xx_adc.c
@@ -179,6 +179,8 @@ static int lpc32xx_adc_probe(struct plat
if (irq < 0)
return irq;
+ init_completion(&st->completion);
+
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st);
if (retval < 0) {
@@ -197,8 +199,6 @@ static int lpc32xx_adc_probe(struct plat
platform_set_drvdata(pdev, iodev);
- init_completion(&st->completion);
-
iodev->name = LPC32XXAD_NAME;
iodev->info = &lpc32xx_adc_iio_info;
iodev->modes = INDIO_DIRECT_MODE;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0086/1266] iio: adc: spear: Initialize completion before requesting IRQ
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0085/1266] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0087/1266] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
` (912 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Kyungwook Boo,
Jaeyoung Chung, Maxwell Doose, Vladimir Zapolskiy, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
commit 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 upstream.
In the report from Jaeyoung Chung:
"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in spear_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
spear_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Fixes: b586e5d9eee0 ("staging:iio:adc:spear rename device specific state structure to _state")
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/spear_adc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/adc/spear_adc.c
+++ b/drivers/iio/adc/spear_adc.c
@@ -282,6 +282,7 @@ static int spear_adc_probe(struct platfo
st = iio_priv(indio_dev);
+ init_completion(&st->completion);
mutex_init(&st->lock);
st->np = np;
@@ -346,8 +347,6 @@ static int spear_adc_probe(struct platfo
platform_set_drvdata(pdev, indio_dev);
- init_completion(&st->completion);
-
indio_dev->name = SPEAR_ADC_MOD_NAME;
indio_dev->info = &spear_adc_info;
indio_dev->modes = INDIO_DIRECT_MODE;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0087/1266] iio: adc: ti-ads124s08: Return reset GPIO lookup errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0086/1266] iio: adc: spear: " Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0088/1266] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
` (911 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Crofts, Pengpeng Hou,
Andy Shevchenko, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream.
devm_gpiod_get_optional() returns NULL when the optional GPIO is absent,
but returns an ERR_PTR when the GPIO provider lookup fails, including
probe deferral.
Probe currently logs the ERR_PTR case as if the reset GPIO were simply
absent and keeps the error pointer in reset_gpio. Later ads124s_reset()
treats any non-NULL reset_gpio as a valid descriptor and passes it to
gpiod_set_value_cansleep().
Return the lookup error instead of retaining the ERR_PTR.
Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Cc: stable@vger.kernel.org
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ti-ads124s08.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -322,7 +322,8 @@ static int ads124s_probe(struct spi_devi
ads124s_priv->reset_gpio = devm_gpiod_get_optional(&spi->dev,
"reset", GPIOD_OUT_LOW);
if (IS_ERR(ads124s_priv->reset_gpio))
- dev_info(&spi->dev, "Reset GPIO not defined\n");
+ return dev_err_probe(&spi->dev, PTR_ERR(ads124s_priv->reset_gpio),
+ "Failed to get reset GPIO\n");
ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data];
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0088/1266] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0087/1266] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0089/1266] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
` (910 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko, Maxwell Doose, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
commit 60d877910a43c305b5165131b258a17b1d772d57 upstream.
Include linux/bitfield.h for FIELD_GET().
Create new macros for bit manipulation in combination with manual bit
manipulation being replaced with FIELD_GET().
The current variable declaration and initializations are barely readable
and use comma separations across multiple lines. Refactor the
initializations so that mantissa and exp have separate declarations and
sign gets initialized later.
In addition (and due to the nature of the cleanup), fix a sign-extension
bug where, float32 would get bitwise anded with ~BIT(31)
(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
Fixes: 64b3d8b1b0f5c ("iio: chemical: scd30: add core driver")
Reported-by: sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260524020309.18618-1-m32285159%40gmail.com
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/drivers/iio/chemical/scd30_core.c
+++ b/drivers/iio/chemical/scd30_core.c
@@ -4,6 +4,8 @@
*
* Copyright (c) 2020 Tomasz Duszynski <tomasz.duszynski@octakon.com>
*/
+
+#include <linux/bitfield.h>
#include <linux/bits.h>
#include <linux/cleanup.h>
#include <linux/completion.h>
@@ -43,6 +45,11 @@
#define SCD30_TEMP_OFFSET_MAX 655360
#define SCD30_EXTRA_TIMEOUT_PER_S 250
+/* Floating point arithmetic macros */
+#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0)
+#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23)
+#define SCD30_FLOAT_SIGN_MSK BIT(31)
+
enum {
SCD30_CONC,
SCD30_TEMP,
@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat
/* simplified float to fixed point conversion with a scaling factor of 0.01 */
static int scd30_float_to_fp(int float32)
{
- int fraction, shift,
- mantissa = float32 & GENMASK(22, 0),
- sign = (float32 & BIT(31)) ? -1 : 1,
- exp = (float32 & ~BIT(31)) >> 23;
+ int fraction, shift, sign;
+ int mantissa = FIELD_GET(SCD30_FLOAT_MANTISSA_MSK, float32);
+ int exp = FIELD_GET(SCD30_FLOAT_EXP_MSK, float32);
+
+ if (float32 & SCD30_FLOAT_SIGN_MSK)
+ sign = -1;
+ else
+ sign = 1;
/* special case 0 */
if (!exp && !mantissa)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0089/1266] iio: event: Fix event FIFO reset race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0088/1266] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0090/1266] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
` (909 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Nuno Sá,
Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream.
`iio_event_getfd()` creates the event file descriptor with
`anon_inode_getfd()`, which allocates a new fd, creates the anonymous
file and installs it in the process fd table before returning to the
caller.
The IIO code resets the event FIFO after `anon_inode_getfd()` has returned,
but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.
But since fd tables are shared between threads, another thread can guess
the newly allocated fd number and issue a `read()` on it as soon as the fd
has been installed.
This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in
parallel with the `kfifo_reset_out()` in `iio_event_getfd()`.
The kfifo documentation says that `kfifo_reset_out()` is only safe when it
is called from the reader thread and there is only one concurrent reader.
Otherwise it is dangerous and must be handled in the same way as
`kfifo_reset()`.
If that happens, `kfifo_to_user()` can advance the FIFO `out` index based
on state from before the reset, after the reset has already moved the `out`
index to the current `in` index. That can leave the FIFO with an `out`
index past the `in` index. A later `read()` can then see an underflowed
FIFO length and copy more data than the event FIFO buffer contains. This
can result in an out-of-bounds read and leak adjacent kernel memory to
userspace.
Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is
marked busy, but the new fd has not been installed yet, so userspace cannot
access it while the FIFO is reset.
Fixes: b91accafbb10 ("iio:event: Fix and cleanup locking")
Reported-by: Codex:gpt-5.5
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-event.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -207,6 +207,8 @@ static int iio_event_getfd(struct iio_de
goto unlock;
}
+ kfifo_reset_out(&ev_int->det_events);
+
iio_device_get(indio_dev);
fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
@@ -214,10 +216,7 @@ static int iio_event_getfd(struct iio_de
if (fd < 0) {
clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
iio_device_put(indio_dev);
- } else {
- kfifo_reset_out(&ev_int->det_events);
}
-
unlock:
mutex_unlock(&iio_dev_opaque->mlock);
return fd;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0090/1266] iio: gyro: bmg160: bail out when bandwidth/filter is not in table
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0089/1266] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0091/1266] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
` (908 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Andy Shevchenko,
Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream.
bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
matching the bw_bits value read from the chip:
for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
break;
}
*val = bmg160_samp_freq_table[i].filter;
If no entry matches, i ends up equal to the array size and the next line
reads one slot past the end. bmg160_set_filter() has the same shape, driven
by 'val' instead of bw_bits.
smatch flags both:
drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
Return -EINVAL when no entry matches.
The set_filter() path is reachable from userspace via the sysfs
in_anglvel_filter_low_pass_3db_frequency interface, so userspace can
trivially trigger the out-of-bounds read with a value that is not in
bmg160_samp_freq_table[].filter.
Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/bmg160_core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -204,6 +204,9 @@ static int bmg160_get_filter(struct bmg1
break;
}
+ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
+ return -EINVAL;
+
*val = bmg160_samp_freq_table[i].filter;
return ret ? ret : IIO_VAL_INT;
@@ -221,6 +224,9 @@ static int bmg160_set_filter(struct bmg1
break;
}
+ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
+ return -EINVAL;
+
ret = regmap_write(data->regmap, BMG160_REG_PMU_BW,
bmg160_samp_freq_table[i].bw_bits);
if (ret < 0) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0091/1266] iio: gyro: bmg160: wait full startup time after mode change at probe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0090/1266] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0092/1266] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
` (907 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream.
bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and
then waits only 500-1000 us. Per the BMG160 datasheet
(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up
times (tsu, twusm) are 30 ms.
The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms)
in bmg160_runtime_resume() after the same set_mode(NORMAL)
operation. The 500 us value at probe was likely a unit mix-up;
the old comment said "500 ms" while the code used microseconds.
Reuse the same constant via msleep() and add a code comment
explaining the datasheet basis for the wait. Without this,
register writes that follow the mode change can hit the chip
before it is ready.
Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/bmg160_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -267,8 +267,14 @@ static int bmg160_chip_init(struct bmg16
if (ret < 0)
return ret;
- /* Wait upto 500 ms to be ready after changing mode */
- usleep_range(500, 1000);
+ /*
+ * Wait for the chip to be ready after switching to normal mode.
+ * The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013)
+ * specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use
+ * BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching
+ * what bmg160_runtime_resume() already does.
+ */
+ msleep(BMG160_MAX_STARTUP_TIME_MS);
/* Set Bandwidth */
ret = bmg160_set_bw(data, BMG160_DEF_BW);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0092/1266] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0091/1266] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0093/1266] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
` (906 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream.
bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq(), but it passes only irq_type and does not add
IRQF_NO_THREAD.
When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is dispatched from irq/... thread context instead of hardirq
context. Because the handler immediately pushes the event into
iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
contract and can drive downstream trigger consumers through the wrong
execution context.
Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
ready trigger handler.
Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -784,7 +784,8 @@ int bmi160_probe_trigger(struct iio_dev
ret = devm_request_irq(&indio_dev->dev, irq,
&iio_trigger_generic_data_rdy_poll,
- irq_type, "bmi160", data->trig);
+ irq_type | IRQF_NO_THREAD,
+ "bmi160", data->trig);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0093/1266] iio: imu: inv_icm42600: fix timestamp clock period by using lower value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0092/1266] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0094/1266] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
` (905 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
Clock period value is used for computing periods of sampling. There is
no need for it to be higher than the maximum odr, otherwise we are
losing precision in the computation for nothing.
Switch clock period value to maximum odr period (8kHz).
Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -718,10 +718,10 @@ struct iio_dev *inv_icm42600_accel_init(
return ERR_PTR(-ENOMEM);
/*
- * clock period is 32kHz (31250ns)
+ * clock period is 8kHz (125000ns)
* jitter is +/- 2% (20 per mille)
*/
- ts_chip.clock_period = 31250;
+ ts_chip.clock_period = 125000;
ts_chip.jitter = 20;
ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -729,10 +729,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
return ERR_PTR(-ENOMEM);
/*
- * clock period is 32kHz (31250ns)
+ * clock period is 8kHz (125000ns)
* jitter is +/- 2% (20 per mille)
*/
- ts_chip.clock_period = 31250;
+ ts_chip.clock_period = 125000;
ts_chip.jitter = 20;
ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0094/1266] iio: imu: st_lsm6dsx: deselect shub page before reading whoami
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0093/1266] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0095/1266] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
` (904 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kempe, Lorenzo Bianconi,
Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kempe <andreas.kempe@actia.se>
commit aede83625ff5d9539508582036df30c809d51058 upstream.
As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects
the shub register page using st_lsm6dsx_set_page(). Selecting the shub
register page shadows the regular register space so whoami, among other
registers, is no longer accessible.
In applications where the IMU is permanently powered separately from the
processor, there is a window where a reset of the CPU leaves the IMU in
the shub register page. Once this occurs, any subsequent probe attempt
fails because of the register shadowing.
Using the ism330dlc, the error typically looks like
st_lsm6dsx_i2c 3-006a: unsupported whoami [10]
with the unknown whoami read from a reserved register in the shub page.
The reset register is also shadowed by the page select, preventing a
reset from recovering the chip.
Unconditionally clear the shub page before the whoami readout to ensure
normal register access and allow the initialization to proceed.
Place the fix in st_lsm6dsx_check_whoami() before the whoami check
because hw->settings, which st_lsm6dsx_set_page() relies on, is first
assigned in that function.
Placing the fix in a more logical place than the whoami check would
require a bigger restructuring of the code.
Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
Signed-off-by: Andreas Kempe <andreas.kempe@actia.se>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
@@ -1576,6 +1576,26 @@ static int st_lsm6dsx_check_whoami(struc
return -ENODEV;
}
+ hw->settings = &st_lsm6dsx_sensor_settings[i];
+
+ if (hw->settings->shub_settings.page_mux.addr) {
+ /*
+ * If the IMU has the shub page selected on init, for example
+ * after a CPU watchdog reset while the page is selected, the
+ * regular register space is shadowed. While the regular
+ * register space is shadowed, the registers needed for
+ * initializing the IMU are not available.
+ *
+ * Unconditionally clear the shub page selection to ensure
+ * normal register access.
+ */
+ err = st_lsm6dsx_set_page(hw, false);
+ if (err < 0) {
+ dev_err(hw->dev, "failed to clear shub page\n");
+ return err;
+ }
+ }
+
err = regmap_read(hw->regmap, ST_LSM6DSX_REG_WHOAMI_ADDR, &data);
if (err < 0) {
dev_err(hw->dev, "failed to read whoami register\n");
@@ -1588,7 +1608,6 @@ static int st_lsm6dsx_check_whoami(struc
}
*name = st_lsm6dsx_sensor_settings[i].id[j].name;
- hw->settings = &st_lsm6dsx_sensor_settings[i];
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0095/1266] iio: light: al3010: fix incorrect scale for the highest gain range
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0094/1266] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0096/1266] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
` (903 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vidhu Sarwal, Andy Shevchenko,
Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidhu Sarwal <vidhu.linux@gmail.com>
commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream.
al3010_scales[] encodes the highest gain range as {0, 1187200}.
For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than
1000000, so the scale 1.1872 should instead be represented as
{ 1, 187200 }.
Since write_raw() compares the value from userspace against this
table, writing the advertised 1.1872 scale never matches the malformed
entry and returns -EINVAL. As a result, the highest gain range cannot
be selected. Reading the scale in that state also reports the malformed
value.
Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/al3010.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/al3010.c
+++ b/drivers/iio/light/al3010.c
@@ -43,7 +43,7 @@ enum al3xxxx_range {
};
static const int al3010_scales[][2] = {
- {0, 1187200}, {0, 296800}, {0, 74200}, {0, 18600}
+ { 1, 187200 }, { 0, 296800 }, { 0, 74200 }, { 0, 18600 },
};
struct al3010_data {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0096/1266] iio: light: gp2ap002: fix runtime PM leak on read error
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0095/1266] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0097/1266] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
` (902 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream.
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the
lux value, but if gp2ap002_get_lux() fails, it returns directly. This
skips the pm_runtime_put_autosuspend() call at the "out" label,
permanently leaking a runtime PM reference and preventing the device
from autosuspending.
Replace the direct return with a "goto out" to ensure the reference
is properly dropped on the error path.
Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/gp2ap002.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/gp2ap002.c
+++ b/drivers/iio/light/gp2ap002.c
@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_
case IIO_LIGHT:
ret = gp2ap002_get_lux(gp2ap002);
if (ret < 0)
- return ret;
+ goto out;
*val = ret;
ret = IIO_VAL_INT;
goto out;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0097/1266] iio: light: opt3001: fix missing state reset on timeout
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0096/1266] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0098/1266] iio: light: tsl2591: return actual error from probe IRQ failure Greg Kroah-Hartman
` (901 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Joshua Crofts,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream.
Currently in the function opt3001_get_processed(), there is a check
that directly returns -ETIMEDOUT if the conversion IRQ times out,
completely bypassing the err label, leaving ok_to_ignore_lock
permanently true, potentially breaking the device's falling threshold
interrupt detection.
Assign -ETIMEDOUT to the return variable and jump to the error label
to ensure ok_to_ignore_lock is properly reset.
Fixes: 26d90b559057 ("iio: light: opt3001: Fixed timeout error when 0 lux")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260525-opt3001-cleanup-v4-0-65b36a174f78%40gmail.com?part=1
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt3001.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@@ -280,8 +280,10 @@ static int opt3001_get_lux(struct opt300
ret = wait_event_timeout(opt->result_ready_queue,
opt->result_ready,
msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
- if (ret == 0)
- return -ETIMEDOUT;
+ if (ret == 0) {
+ ret = -ETIMEDOUT;
+ goto err;
+ }
} else {
/* Sleep for result ready time */
timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0098/1266] iio: light: tsl2591: return actual error from probe IRQ failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0097/1266] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0099/1266] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
` (900 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
commit a00ffd15674bfaf8b906503c1600e3d8709af56c upstream.
When devm_request_threaded_irq() fails, probe logs the error and
then returns -EINVAL, dropping the real error code and breaking the
deferred-probe flow for -EPROBE_DEFER.
Return ret directly; the IRQ subsystem already prints on failure.
Fixes: 2335f0d7c790 ("iio: light: Added AMS tsl2591 driver implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/tsl2591.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/iio/light/tsl2591.c
+++ b/drivers/iio/light/tsl2591.c
@@ -1139,10 +1139,8 @@ static int tsl2591_probe(struct i2c_clie
NULL, tsl2591_event_handler,
IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
"tsl2591_irq", indio_dev);
- if (ret) {
- dev_err_probe(&client->dev, ret, "IRQ request error\n");
- return -EINVAL;
- }
+ if (ret)
+ return ret;
indio_dev->info = &tsl2591_info;
} else {
indio_dev->info = &tsl2591_info_no_irq;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0099/1266] iio: light: veml6030: fix channel type when pushing events
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0098/1266] iio: light: tsl2591: return actual error from probe IRQ failure Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0100/1266] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
` (899 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream.
The events are registered for IIO_LIGHT and not for IIO_INTENSITY.
Use the correct channel type.
When at it, fix minor checkpatch code style warning (alignment).
Cc: stable@vger.kernel.org
Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/veml6030.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/iio/light/veml6030.c
+++ b/drivers/iio/light/veml6030.c
@@ -710,9 +710,11 @@ static irqreturn_t veml6030_event_handle
else
evtdir = IIO_EV_DIR_FALLING;
- iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
- 0, IIO_EV_TYPE_THRESH, evtdir),
- iio_get_time_ns(indio_dev));
+ iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+ 0,
+ IIO_EV_TYPE_THRESH,
+ evtdir),
+ iio_get_time_ns(indio_dev));
return IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0100/1266] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0099/1266] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0101/1266] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
` (898 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Andy Shevchenko,
Joshua Crofts, Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream.
On the failure in the ak8975_read_axis() the PM runtime gets unbalanced.
Balance it by calling pm_runtime_put_autosuspend() on error path as well.
Fixes: cde4cb5dd422 ("iio: magn: ak8975: deploy runtime and system PM")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260505-magnetometer-fixes-v5-0-831b9b5550fc%40gmail.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/ak8975.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -746,6 +746,7 @@ static int ak8975_read_axis(struct iio_d
exit:
mutex_unlock(&data->lock);
+ pm_runtime_put_autosuspend(&data->client->dev);
dev_err(&client->dev, "Error in reading axis\n");
return ret;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0101/1266] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0100/1266] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0102/1266] ALSA: virtio: Add missing 384 kHz PCM rate mapping Greg Kroah-Hartman
` (897 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liviu Stan, Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <liviu.stan@analog.com>
commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream.
reinit_completion() was called after regmap_write() initiated the hardware
conversion, creating a race window where the interrupt could fire and call
complete() before reinit_completion() reset the completion.
Move reinit_completion() before the regmap_write() to close the race.
ltc2983_eeprom_cmd() already does it in the correct order.
Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/temperature/ltc2983.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/temperature/ltc2983.c
+++ b/drivers/iio/temperature/ltc2983.c
@@ -1231,12 +1231,11 @@ static int ltc2983_chan_read(struct ltc2
start_conversion |= LTC2983_STATUS_CHAN_SEL(sensor->chan);
dev_dbg(&st->spi->dev, "Start conversion on chan:%d, status:%02X\n",
sensor->chan, start_conversion);
+ reinit_completion(&st->completion);
/* start conversion */
ret = regmap_write(st->regmap, LTC2983_STATUS_REG, start_conversion);
if (ret)
return ret;
-
- reinit_completion(&st->completion);
/*
* wait for conversion to complete.
* 300 ms should be more than enough to complete the conversion.
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0102/1266] ALSA: virtio: Add missing 384 kHz PCM rate mapping
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0101/1266] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
@ 2026-07-21 15:08 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0103/1266] ALSA: ymfpci: check snd_ctl_new1() return value Greg Kroah-Hartman
` (896 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d upstream.
The VirtIO sound UAPI defines VIRTIO_SND_PCM_RATE_384000, and ALSA
has SNDRV_PCM_RATE_384000. However, virtio-snd's rate conversion
tables stop at 192 kHz.
A device advertising only 384 kHz is rejected as having no supported
PCM frame rates. A device advertising 384 kHz together with lower rates
does not expose 384 kHz through the ALSA hardware constraints. The
selected ALSA rate also needs a reverse mapping for SET_PARAMS.
Add the missing 384 kHz entries to both conversion tables.
Fixes: 29b96bf50ba9 ("ALSA: virtio: build PCM devices and substream hardware descriptors")
Fixes: da76e9f3e43a ("ALSA: virtio: PCM substream operators")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260515-alsa-virtio-384k-rate-v1-1-35ecb5df835c@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/virtio/virtio_pcm.c | 3 ++-
sound/virtio/virtio_pcm_ops.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/sound/virtio/virtio_pcm.c
+++ b/sound/virtio/virtio_pcm.c
@@ -77,7 +77,8 @@ static const struct virtsnd_v2a_rate g_v
[VIRTIO_SND_PCM_RATE_88200] = { SNDRV_PCM_RATE_88200, 88200 },
[VIRTIO_SND_PCM_RATE_96000] = { SNDRV_PCM_RATE_96000, 96000 },
[VIRTIO_SND_PCM_RATE_176400] = { SNDRV_PCM_RATE_176400, 176400 },
- [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 }
+ [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 },
+ [VIRTIO_SND_PCM_RATE_384000] = { SNDRV_PCM_RATE_384000, 384000 }
};
/**
--- a/sound/virtio/virtio_pcm_ops.c
+++ b/sound/virtio/virtio_pcm_ops.c
@@ -90,7 +90,8 @@ static const struct virtsnd_a2v_rate g_a
{ 88200, VIRTIO_SND_PCM_RATE_88200 },
{ 96000, VIRTIO_SND_PCM_RATE_96000 },
{ 176400, VIRTIO_SND_PCM_RATE_176400 },
- { 192000, VIRTIO_SND_PCM_RATE_192000 }
+ { 192000, VIRTIO_SND_PCM_RATE_192000 },
+ { 384000, VIRTIO_SND_PCM_RATE_384000 }
};
static int virtsnd_pcm_sync_stop(struct snd_pcm_substream *substream);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0103/1266] ALSA: ymfpci: check snd_ctl_new1() return value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-07-21 15:08 ` [PATCH 6.6 0102/1266] ALSA: virtio: Add missing 384 kHz PCM rate mapping Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0104/1266] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
` (895 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit e64d170346d00b580c0043de3e5ccb3e331c47d4 upstream.
snd_ctl_new1() can return NULL when memory allocation fails.
snd_ymfpci_create_spdif_controls() does not check the return value
before dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: c9b83ae4a160 ("ALSA: ymfpci: Fix kctl->id initialization")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_4745C5DC2333325C0EDAB1EFC88A136E6809@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ymfpci/ymfpci_main.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -1822,16 +1822,22 @@ int snd_ymfpci_mixer(struct snd_ymfpci *
if (snd_BUG_ON(!chip->pcm_spdif))
return -ENXIO;
kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = chip->pcm_spdif->device;
err = snd_ctl_add(chip->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = chip->pcm_spdif->device;
err = snd_ctl_add(chip->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = chip->pcm_spdif->device;
err = snd_ctl_add(chip->card, kctl);
if (err < 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0104/1266] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0103/1266] ALSA: ymfpci: check snd_ctl_new1() return value Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0105/1266] ALSA: cmipci: check snd_ctl_new1() return value Greg Kroah-Hartman
` (894 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream.
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".
len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.
Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.
Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/caiaq/input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/caiaq/input.c
+++ b/sound/usb/caiaq/input.c
@@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(
{
struct device *dev = caiaqdev_to_dev(cdev);
- while (len) {
+ while (len >= TKS4_MSGBLOCK_SIZE) {
unsigned int i, block_id = (buf[0] << 8) | buf[1];
switch (block_id) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0105/1266] ALSA: cmipci: check snd_ctl_new1() return value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0104/1266] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0106/1266] ALSA: es1938: " Greg Kroah-Hartman
` (893 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit c205bd1b28fb7e5f1061a4e78813fad7d315cb3e upstream.
snd_ctl_new1() can return NULL when memory allocation fails.
snd_cmipci_spdif_controls() does not check the return value before
dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: f2f312ad88c6 ("ALSA: cmipci: Fix kctl->id initialization")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_964433DCD132125D5EDA79EE068A2D6EFA09@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/cmipci.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -2688,16 +2688,22 @@ static int snd_cmipci_mixer_new(struct c
}
if (cm->can_ac3_hw) {
kctl = snd_ctl_new1(&snd_cmipci_spdif_default, cm);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = pcm_spdif_device;
err = snd_ctl_add(card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_cmipci_spdif_mask, cm);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = pcm_spdif_device;
err = snd_ctl_add(card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_cmipci_spdif_stream, cm);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = pcm_spdif_device;
err = snd_ctl_add(card, kctl);
if (err < 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0106/1266] ALSA: es1938: check snd_ctl_new1() return value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0105/1266] ALSA: cmipci: check snd_ctl_new1() return value Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0107/1266] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
` (892 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit 1edd1f02dddd20aeb6066ded41017615766ea42f upstream.
snd_ctl_new1() can return NULL when memory allocation fails.
snd_es1938_mixer() does not check the return value before dereferencing
the pointer, which can lead to a NULL pointer dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_E0DC65165FDF2C8982BAFB6794B854B53B0A@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/es1938.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/es1938.c
+++ b/sound/pci/es1938.c
@@ -1670,6 +1670,8 @@ static int snd_es1938_mixer(struct es193
for (idx = 0; idx < ARRAY_SIZE(snd_es1938_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es1938_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
switch (idx) {
case 0:
chip->master_volume = kctl;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0107/1266] ALSA: firewire: isight: bound the sample count to the packet payload
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0106/1266] ALSA: es1938: " Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0108/1266] ALSA: gus: check snd_ctl_new1() return value Greg Kroah-Hartman
` (891 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takashi Sakamoto, Maoyi Xie,
Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 29b9667982e4df2ed7744f86b1144f8bb58eb698 upstream.
isight_packet() takes the frame count from the device iso packet and
checks it only against the device claimed iso length.
count = be32_to_cpu(payload->sample_count);
if (likely(count <= (length - 16) / 4))
isight_samples(isight, payload->samples, count);
length is the iso header data_length. It can be up to 0xffff. So the
gate allows a count up to about 16379. isight_samples() then copies
count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The
device multiplexes two samples per frame. A count past
MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer
size writes past runtime->dma_area. The smallest PCM buffer is larger
than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET
keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this
during a normal capture.
Add the MAX_FRAMES_PER_PACKET bound to the gate.
Fixes: 3a691b28a0ca ("ALSA: add Apple iSight microphone driver")
Suggested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178205454729.1900991.7807310178296762772@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/isight.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/firewire/isight.c
+++ b/sound/firewire/isight.c
@@ -179,7 +179,8 @@ static void isight_packet(struct fw_iso_
if (likely(length >= 16 &&
payload->signature == cpu_to_be32(0x73676874/*"sght"*/))) {
count = be32_to_cpu(payload->sample_count);
- if (likely(count <= (length - 16) / 4)) {
+ if (likely(count <= (length - 16) / 4 &&
+ count <= MAX_FRAMES_PER_PACKET)) {
total = be32_to_cpu(payload->sample_total);
if (unlikely(total != isight->total_samples)) {
if (!isight->first_packet)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0108/1266] ALSA: gus: check snd_ctl_new1() return value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0107/1266] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0109/1266] ALSA: ice1712: " Greg Kroah-Hartman
` (890 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit c7fa99d30c7a166a5e5db5a585ce7501ff68326b upstream.
snd_ctl_new1() can return NULL when memory allocation fails.
snd_gf1_pcm_volume_control() does not check the return value before
dereferencing kctl->id.index, which can lead to a NULL pointer
dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: c5ae57b1bb99 ("ALSA: gus: Fix kctl->id initialization")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_F644A3DCAD32945D62DB2FEEBE8A996F6809@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/isa/gus/gus_pcm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/isa/gus/gus_pcm.c
+++ b/sound/isa/gus/gus_pcm.c
@@ -875,6 +875,8 @@ int snd_gf1_pcm_new(struct snd_gus_card
kctl = snd_ctl_new1(&snd_gf1_pcm_volume_control1, gus);
else
kctl = snd_ctl_new1(&snd_gf1_pcm_volume_control, gus);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.index = control_index;
err = snd_ctl_add(card, kctl);
if (err < 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0109/1266] ALSA: ice1712: check snd_ctl_new1() return value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0108/1266] ALSA: gus: check snd_ctl_new1() return value Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0110/1266] ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Greg Kroah-Hartman
` (889 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit 2b929b91b0f3bc6de8a844370049cd99ee8e31ff upstream.
snd_ctl_new1() can return NULL when memory allocation fails. The
ice1712 driver calls snd_ctl_new1() without checking the return value
before dereferencing the pointer in multiple places (ice1712.c,
ice1724.c, aureon.c), which can lead to NULL pointer dereferences.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: b9a4efd61b6b ("ALSA: ice1712,ice1724: fix the kcontrol->id initialization")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_42E5E2AB1B6A5101F7EE8C2117F1F687BB07@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ice1712/aureon.c | 2 ++
sound/pci/ice1712/ice1712.c | 8 ++++++++
sound/pci/ice1712/ice1724.c | 6 ++++++
3 files changed, 16 insertions(+)
--- a/sound/pci/ice1712/aureon.c
+++ b/sound/pci/ice1712/aureon.c
@@ -1900,6 +1900,8 @@ static int aureon_add_controls(struct sn
for (i = 0; i < ARRAY_SIZE(cs8415_controls); i++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&cs8415_controls[i], ice);
+ if (!kctl)
+ return -ENOMEM;
if (i > 1)
kctl->id.device = ice->pcm->device;
err = snd_ctl_add(ice->card, kctl);
--- a/sound/pci/ice1712/ice1712.c
+++ b/sound/pci/ice1712/ice1712.c
@@ -2372,21 +2372,29 @@ int snd_ice1712_spdif_build_controls(str
if (snd_BUG_ON(!ice->pcm_pro))
return -EIO;
kctl = snd_ctl_new1(&snd_ice1712_spdif_default, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm_pro->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_ice1712_spdif_maskc, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm_pro->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_ice1712_spdif_maskp, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm_pro->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_ice1712_spdif_stream, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm_pro->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
--- a/sound/pci/ice1712/ice1724.c
+++ b/sound/pci/ice1712/ice1724.c
@@ -2393,16 +2393,22 @@ static int snd_vt1724_spdif_build_contro
return err;
kctl = snd_ctl_new1(&snd_vt1724_spdif_default, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_vt1724_spdif_maskc, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
return err;
kctl = snd_ctl_new1(&snd_vt1724_spdif_maskp, ice);
+ if (!kctl)
+ return -ENOMEM;
kctl->id.device = ice->pcm->device;
err = snd_ctl_add(ice->card, kctl);
if (err < 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0110/1266] ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0109/1266] ALSA: ice1712: " Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0111/1266] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
` (888 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.
snd_seq_event_dup() copies an incoming event into a pool cell and, in
the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
the memcpy() did not cover. The guard deciding whether to clear it
compares the copied size against sizeof(cell->event):
memcpy(&cell->ump, event, size);
if (size < sizeof(cell->event))
cell->ump.raw.extra = 0;
For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
sizeof(cell->event), so the condition is false and the extra word keeps
stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
cells are reused via a free list, so that word holds uninitialised heap
or leftover event data.
When such a cell is delivered to a UMP client (client->midi_version > 0)
that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
unconverted -- snd_seq_read() reads it out as the larger struct
snd_seq_ump_event and copies the stale word to user space, a 4-byte
kernel heap infoleak to an unprivileged /dev/snd/seq client.
Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
for every event shorter than the UMP cell.
Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -366,7 +366,7 @@ int snd_seq_event_dup(struct snd_seq_poo
size = snd_seq_event_packet_size(event);
memcpy(&cell->ump, event, size);
#if IS_ENABLED(CONFIG_SND_SEQ_UMP)
- if (size < sizeof(cell->event))
+ if (size < sizeof(cell->ump))
cell->ump.raw.extra = 0;
#endif
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0111/1266] ALSA: usb-audio: avoid kobject path lookup in DualSense match
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0110/1266] ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0112/1266] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
` (887 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Darvell Long, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darvell Long <contact@darvell.me>
commit 7693c0cc415f3a16a7a3355f245474a5e661be4e upstream.
The DualSense jack-detection input handler verifies that a matching input
device belongs to the same physical controller by building kobject path
strings for both the input device and the USB audio device, then comparing
the path prefix.
This was observed when a weak physical connection caused the controller
to rapidly disconnect and reconnect. During that repeated hotplug,
snd_dualsense_ih_match() can run while the controller's USB device is
being disconnected. kobject_get_path() walks ancestor kobjects and
dereferences their names; if the USB device kobject name is no longer
valid, this can fault in strlen():
RIP: 0010:strlen+0x10/0x30
Call Trace:
kobject_get_path+0x34/0x150
snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0
ps_probe+0xb89/0x1590 [hid_playstation]
The same ownership check can be done without building kobject path
strings. The input device is parented below the HID device, USB interface
and USB device, so walking the input device parent chain and comparing
against the mixer USB device preserves the check without dereferencing
kobject names during disconnect.
Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5")
Cc: <stable@vger.kernel.org>
Assisted-by: Cute:gpt-5.5
Signed-off-by: Darvell Long <contact@darvell.me>
Link: https://patch.msgid.link/20260624143723.2986353-1-contact@darvell.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 40 ++++++++++++----------------------------
1 file changed, 12 insertions(+), 28 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -573,46 +573,30 @@ static bool snd_dualsense_ih_match(struc
{
struct dualsense_mixer_elem_info *mei;
struct usb_device *snd_dev;
- char *input_dev_path, *usb_dev_path;
- size_t usb_dev_path_len;
- bool match = false;
+ struct device *parent;
mei = container_of(handler, struct dualsense_mixer_elem_info, ih);
snd_dev = mei->info.head.mixer->chip->dev;
- input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
- if (!input_dev_path) {
- dev_warn(&snd_dev->dev, "Failed to get input dev path\n");
- return false;
- }
-
- usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL);
- if (!usb_dev_path) {
- dev_warn(&snd_dev->dev, "Failed to get USB dev path\n");
- goto free_paths;
- }
-
/*
* Ensure the VID:PID matched input device supposedly owned by the
* hid-playstation driver belongs to the actual hardware handled by
- * the current USB audio device, which implies input_dev_path being
- * a subpath of usb_dev_path.
+ * the current USB audio device.
*
* This verification is necessary when there is more than one identical
* controller attached to the host system.
+ *
+ * The input device is registered below the HID device, USB interface and
+ * USB device, so compare the parent chain directly instead of building
+ * kobject path strings. This avoids dereferencing kobject names while the
+ * USB device hierarchy is being torn down during disconnect.
*/
- usb_dev_path_len = strlen(usb_dev_path);
- if (usb_dev_path_len >= strlen(input_dev_path))
- goto free_paths;
-
- usb_dev_path[usb_dev_path_len] = '/';
- match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1);
-
-free_paths:
- kfree(input_dev_path);
- kfree(usb_dev_path);
+ for (parent = dev->dev.parent; parent; parent = parent->parent) {
+ if (parent == &snd_dev->dev)
+ return true;
+ }
- return match;
+ return false;
}
static int snd_dualsense_ih_connect(struct input_handler *handler,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0112/1266] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0111/1266] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0113/1266] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
` (886 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 0f25cf1f02e3dba626791d949c759a48c0a44996 upstream.
scarlett_ctl_enum_put() ignores the return value from
snd_usb_set_cur_mix_value() and reports success whenever the
requested enum value differs from the current one.
If the SET_CUR request fails, the callback still returns success even
though neither the hardware state nor the cached mixer value changed.
Fixes: 76b188c4b370 ("ALSA: usb-audio: Scarlett mixer interface for 6i6, 18i6, 18i8 and 18i20")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-2-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_scarlett.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer_scarlett.c
+++ b/sound/usb/mixer_scarlett.c
@@ -438,7 +438,9 @@ static int scarlett_ctl_enum_put(struct
val = ucontrol->value.integer.value[0];
val = val + opt->start;
if (val != oval) {
- snd_usb_set_cur_mix_value(elem, 0, 0, val);
+ err = snd_usb_set_cur_mix_value(elem, 0, 0, val);
+ if (err < 0)
+ return err;
return 1;
}
return 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0113/1266] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0112/1266] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0114/1266] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
` (885 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 3c06aec8abda6ba068b58a8b7119cdb2a48456b1 upstream.
Several US-16x08 mixer put callbacks log failed control URBs but
still return success to userspace. That hides device write failures
even though the requested value was not applied.
Return the negative write error instead in the route, master, bus,
channel, and EQ switch put callbacks.
Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-3-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_us16x08.c | 49 ++++++++++++++++++++++------------------------
1 file changed, 24 insertions(+), 25 deletions(-)
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -225,14 +225,14 @@ static int snd_us16x08_route_put(struct
err = snd_us16x08_send_urb(chip, buf, sizeof(route_msg));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set routing, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_master_info(struct snd_kcontrol *kcontrol,
@@ -284,14 +284,14 @@ static int snd_us16x08_master_put(struct
buf[5] = index + 1;
err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_out));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set master, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_bus_put(struct snd_kcontrol *kcontrol,
@@ -325,14 +325,14 @@ static int snd_us16x08_bus_put(struct sn
break;
}
- if (err > 0) {
- elem->cached |= 1;
- elem->cache_val[0] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set bus parameter, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1;
+ elem->cache_val[0] = val;
+ return 1;
}
static int snd_us16x08_bus_get(struct snd_kcontrol *kcontrol,
@@ -393,14 +393,14 @@ static int snd_us16x08_channel_put(struc
err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_in));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set channel, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_mix_info(struct snd_kcontrol *kcontrol,
@@ -530,13 +530,13 @@ static int snd_us16x08_eqswitch_put(stru
msleep(15);
}
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set eq switch, err:%d\n", err);
+ return err;
}
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
@@ -1419,4 +1419,3 @@ int snd_us16x08_controls_create(struct u
return 0;
}
-
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0114/1266] ALSA: usb-audio: Roll back quirk control caches on write errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0113/1266] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0115/1266] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
` (884 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 6380957fa24251856a532e48a46a4dc3d1ae26b6 upstream.
Several mixer quirk callbacks cache the requested
control value in kcontrol->private_value before
issuing a single vendor or class write.
Their paired get and resume paths consume that cache
directly, so a failed write currently leaves software
state changed even though the update did not succeed.
That can make later reads report a value the device
never accepted and can replay the stale cache on resume.
Restore the previous cached value on failure in
the Audigy2NX LED, Emu0204 channel switch,
Xonar U1 output switch, Native Instruments controls,
FTU effect program switch, and Sound Blaster E1 input source switch.
Fixes: 9cf3689bfe07 ("ALSA: usb-audio: Add audigy2nx resume support")
Fixes: 5f503ee9e270 ("ALSA: usb-audio: Add Emu0204 channel switch resume support")
Fixes: 2bfb14c3b8fb ("ALSA: usb-audio: Add Xonar U1 resume support")
Fixes: da6d276957ea ("ALSA: usb-audio: Add resume support for Native Instruments controls")
Fixes: 0b4e9cfcef05 ("ALSA: usb-audio: Add resume support for FTU controls")
Fixes: 388fdb8f882a ("ALSA: usb-audio: Support changing input on Sound Blaster E1")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-1-01b35c688b80@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 45 +++++++++++++++++++++++++++++++++++++--------
1 file changed, 37 insertions(+), 8 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -335,6 +335,7 @@ static int snd_audigy2nx_led_put(struct
int index = kcontrol->private_value & 0xff;
unsigned int value = ucontrol->value.integer.value[0];
int old_value = kcontrol->private_value >> 8;
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (value > 1)
@@ -343,7 +344,11 @@ static int snd_audigy2nx_led_put(struct
return 0;
kcontrol->private_value = (value << 8) | index;
err = snd_audigy2nx_led_update(mixer, value, index);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_audigy2nx_led_resume(struct usb_mixer_elem_list *list)
@@ -493,6 +498,7 @@ static int snd_emu0204_ch_switch_put(str
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
struct usb_mixer_interface *mixer = list->mixer;
unsigned int value = ucontrol->value.enumerated.item[0];
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (value > 1)
@@ -503,7 +509,11 @@ static int snd_emu0204_ch_switch_put(str
kcontrol->private_value = value;
err = snd_emu0204_ch_switch_update(mixer, value);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_emu0204_ch_switch_resume(struct usb_mixer_elem_list *list)
@@ -814,7 +824,11 @@ static int snd_xonar_u1_switch_put(struc
kcontrol->private_value = new_status;
err = snd_xonar_u1_switch_update(list->mixer, new_status);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_status;
+ return err;
+ }
+ return 1;
}
static int snd_xonar_u1_switch_resume(struct usb_mixer_elem_list *list)
@@ -1163,7 +1177,8 @@ static int snd_nativeinstruments_control
struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
- u8 oldval = (kcontrol->private_value >> 24) & 0xff;
+ unsigned long old_pval = kcontrol->private_value;
+ u8 oldval = (old_pval >> 24) & 0xff;
u8 newval = ucontrol->value.integer.value[0];
int err;
@@ -1173,7 +1188,11 @@ static int snd_nativeinstruments_control
kcontrol->private_value &= ~(0xff << 24);
kcontrol->private_value |= (unsigned int)newval << 24;
err = snd_ni_update_cur_val(list);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static const struct snd_kcontrol_new snd_nativeinstruments_ta6_mixers[] = {
@@ -1331,7 +1350,8 @@ static int snd_ftu_eff_switch_put(struct
struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl);
- unsigned int pval = list->kctl->private_value;
+ unsigned long old_pval = list->kctl->private_value;
+ unsigned int pval = old_pval;
int cur_val, err, new_val;
cur_val = pval >> 24;
@@ -1342,7 +1362,11 @@ static int snd_ftu_eff_switch_put(struct
kctl->private_value &= ~(0xff << 24);
kctl->private_value |= new_val << 24;
err = snd_ftu_eff_switch_update(list);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kctl->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
@@ -2140,13 +2164,18 @@ static int snd_soundblaster_e1_switch_pu
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
unsigned char value = !!ucontrol->value.integer.value[0];
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (kcontrol->private_value == value)
return 0;
kcontrol->private_value = value;
err = snd_soundblaster_e1_switch_update(list->mixer, value);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_soundblaster_e1_switch_resume(struct usb_mixer_elem_list *list)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0115/1266] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0114/1266] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0116/1266] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
` (883 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit d8f802ccf1fdbeb89d62748d6a0d0fbd442c8127 upstream.
snd_bbfpro_ctl_put() and snd_bbfpro_vol_put()
cache the requested packed control state in
kcontrol->private_value before issuing the USB write.
Their get and resume paths use that cached value directly,
so a failed write can leave the driver reporting and later
replaying a setting the hardware never accepted.
Update the cached state only after a successful USB write.
Fixes: 3e8f3bd04716 ("ALSA: usb-audio: RME Babyface Pro mixer patch")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-2-01b35c688b80@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -2950,12 +2950,14 @@ static int snd_bbfpro_ctl_put(struct snd
if (val == old_value)
return 0;
+ err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
+ if (err < 0)
+ return err;
+
kcontrol->private_value = reg
| ((idx & SND_BBFPRO_CTL_IDX_MASK) << SND_BBFPRO_CTL_IDX_SHIFT)
| ((val & SND_BBFPRO_CTL_VAL_MASK) << SND_BBFPRO_CTL_VAL_SHIFT);
-
- err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
- return err < 0 ? err : 1;
+ return 1;
}
static int snd_bbfpro_ctl_resume(struct usb_mixer_elem_list *list)
@@ -3040,11 +3042,13 @@ static int snd_bbfpro_vol_put(struct snd
new_val = uvalue & SND_BBFPRO_MIXER_VAL_MASK;
+ err = snd_bbfpro_vol_update(mixer, idx, new_val);
+ if (err < 0)
+ return err;
+
kcontrol->private_value = idx
| (new_val << SND_BBFPRO_MIXER_VAL_SHIFT);
-
- err = snd_bbfpro_vol_update(mixer, idx, new_val);
- return err < 0 ? err : 1;
+ return 1;
}
static int snd_bbfpro_vol_resume(struct usb_mixer_elem_list *list)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0116/1266] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0115/1266] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0117/1266] vfio/pci: Use a private flag to prevent power state change with VFs Greg Kroah-Hartman
` (882 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit a440c17869ecd71da0f295b62868fc742d09a8ba upstream.
snd_us16x08_comp_put() and snd_us16x08_eq_put() update their
software stores before sending the USB write. If the transfer
fails, later get callbacks report a value the hardware never
accepted.
Build the outgoing message from the current store plus the
pending value, then commit the store only after a successful
write.
Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-4-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_us16x08.c | 78 ++++++++++++++++++++++++++++++----------------
1 file changed, 52 insertions(+), 26 deletions(-)
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -436,6 +436,7 @@ static int snd_us16x08_comp_put(struct s
int index = ucontrol->id.index;
char buf[sizeof(comp_msg)];
int val_idx, val;
+ int threshold, ratio, attack, release, gain, switch_on;
int err;
val = ucontrol->value.integer.value[0];
@@ -448,36 +449,61 @@ static int snd_us16x08_comp_put(struct s
/* new control value incl. bias*/
val_idx = elem->head.id - SND_US16X08_ID_COMP_BASE;
- store->val[val_idx][index] = ucontrol->value.integer.value[0];
+ threshold = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)]
+ [index];
+ ratio = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index];
+ attack = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index];
+ release = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)]
+ [index];
+ gain = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
+ switch_on = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
+ [index];
+
+ switch (val_idx) {
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD):
+ threshold = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO):
+ ratio = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK):
+ attack = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE):
+ release = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN):
+ gain = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH):
+ switch_on = val;
+ break;
+ }
/* prepare compressor URB message from template */
memcpy(buf, comp_msg, sizeof(comp_msg));
/* place comp values in message buffer watch bias! */
- buf[8] = store->val[
- COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)][index]
- - SND_US16X08_COMP_THRESHOLD_BIAS;
- buf[11] = ratio_map[store->val[
- COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index]];
- buf[14] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index]
- + SND_US16X08_COMP_ATTACK_BIAS;
- buf[17] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)][index]
- + SND_US16X08_COMP_RELEASE_BIAS;
- buf[20] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
- buf[26] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)][index];
+ buf[8] = threshold - SND_US16X08_COMP_THRESHOLD_BIAS;
+ buf[11] = ratio_map[ratio];
+ buf[14] = attack + SND_US16X08_COMP_ATTACK_BIAS;
+ buf[17] = release + SND_US16X08_COMP_RELEASE_BIAS;
+ buf[20] = gain;
+ buf[26] = switch_on;
/* place channel selector in message buffer */
buf[5] = index + 1;
err = snd_us16x08_send_urb(chip, buf, sizeof(comp_msg));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set compressor, err:%d\n", err);
+ return err;
}
+ store->val[val_idx][index] = val;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
@@ -579,11 +605,10 @@ static int snd_us16x08_eq_put(struct snd
/* copy URB buffer from EQ template */
memcpy(buf, eqs_msq, sizeof(eqs_msq));
- store->val[b_idx][p_idx][index] = val;
- buf[20] = store->val[b_idx][3][index];
- buf[17] = store->val[b_idx][2][index];
- buf[14] = store->val[b_idx][1][index];
- buf[11] = store->val[b_idx][0][index];
+ buf[20] = p_idx == 3 ? val : store->val[b_idx][3][index];
+ buf[17] = p_idx == 2 ? val : store->val[b_idx][2][index];
+ buf[14] = p_idx == 1 ? val : store->val[b_idx][1][index];
+ buf[11] = p_idx == 0 ? val : store->val[b_idx][0][index];
/* place channel index in URB buffer */
buf[5] = index + 1;
@@ -593,14 +618,15 @@ static int snd_us16x08_eq_put(struct snd
err = snd_us16x08_send_urb(chip, buf, sizeof(eqs_msq));
- if (err > 0) {
- /* store new value in EQ band cache */
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set eq param, err:%d\n", err);
+ return err;
}
+ store->val[b_idx][p_idx][index] = val;
+ /* store new value in EQ band cache */
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0117/1266] vfio/pci: Use a private flag to prevent power state change with VFs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0116/1266] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0118/1266] vfio/pci: Latch disable_idle_d3 per device Greg Kroah-Hartman
` (881 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Alex Williamson,
Raghavendra Rao Ananta
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra Rao Ananta <rananta@google.com>
commit 40ef3edf151e184d021917a5c4c771cc0870844a upstream.
The current implementation uses pci_num_vf() while holding the
memory_lock to prevent changing the power state of a PF when
VFs are enabled. This creates a lockdep circular dependency
warning because memory_lock is held during device probing.
[ 286.997167] ======================================================
[ 287.003363] WARNING: possible circular locking dependency detected
[ 287.009562] 7.0.0-dbg-DEV #3 Tainted: G S
[ 287.015074] ------------------------------------------------------
[ 287.021270] vfio_pci_sriov_/18636 is trying to acquire lock:
[ 287.026942] ff45bea2294d4968 (&vdev->memory_lock){+.+.}-{4:4}, at:
vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.036530]
[ 287.036530] but task is already holding lock:
[ 287.042383] ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at:
vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.051879]
[ 287.051879] which lock already depends on the new lock.
[ 287.051879]
[ 287.060070]
[ 287.060070] the existing dependency chain (in reverse order) is:
[ 287.067568]
[ 287.067568] -> #2 (&new_dev_set->lock){+.+.}-{4:4}:
[ 287.073941] __mutex_lock+0x92/0xb80
[ 287.078058] vfio_assign_device_set+0x66/0x1b0
[ 287.083042] vfio_pci_core_register_device+0xd1/0x2a0
[ 287.088638] vfio_pci_probe+0xd2/0x100
[ 287.092933] local_pci_probe_callback+0x4d/0xa0
[ 287.098001] process_scheduled_works+0x2ca/0x680
[ 287.103158] worker_thread+0x1e8/0x2f0
[ 287.107452] kthread+0x10c/0x140
[ 287.111230] ret_from_fork+0x18e/0x360
[ 287.115519] ret_from_fork_asm+0x1a/0x30
[ 287.119983]
[ 287.119983] -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}:
[ 287.127219] __flush_work+0x345/0x490
[ 287.131429] pci_device_probe+0x2e3/0x490
[ 287.135979] really_probe+0x1f9/0x4e0
[ 287.140180] __driver_probe_device+0x77/0x100
[ 287.145079] driver_probe_device+0x1e/0x110
[ 287.149803] __device_attach_driver+0xe3/0x170
[ 287.154789] bus_for_each_drv+0x125/0x150
[ 287.159346] __device_attach+0xca/0x1a0
[ 287.163720] device_initial_probe+0x34/0x50
[ 287.168445] pci_bus_add_device+0x6e/0x90
[ 287.172995] pci_iov_add_virtfn+0x3c9/0x3e0
[ 287.177719] sriov_add_vfs+0x2c/0x60
[ 287.181838] sriov_enable+0x306/0x4a0
[ 287.186038] vfio_pci_core_sriov_configure+0x184/0x220
[ 287.191715] sriov_numvfs_store+0xd9/0x1c0
[ 287.196351] kernfs_fop_write_iter+0x13f/0x1d0
[ 287.201338] vfs_write+0x2be/0x3b0
[ 287.205286] ksys_write+0x73/0x100
[ 287.209233] do_syscall_64+0x14d/0x750
[ 287.213529] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.219120]
[ 287.219120] -> #0 (&vdev->memory_lock){+.+.}-{4:4}:
[ 287.225491] __lock_acquire+0x14c6/0x2800
[ 287.230048] lock_acquire+0xd3/0x2f0
[ 287.234168] down_write+0x3a/0xc0
[ 287.238019] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.243436] __rpm_callback+0x8c/0x310
[ 287.247730] rpm_resume+0x529/0x6f0
[ 287.251765] __pm_runtime_resume+0x68/0x90
[ 287.256402] vfio_pci_core_enable+0x44/0x310
[ 287.261216] vfio_pci_open_device+0x1c/0x80
[ 287.265947] vfio_df_open+0x10f/0x150
[ 287.270148] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.275476] __se_sys_ioctl+0x71/0xc0
[ 287.279679] do_syscall_64+0x14d/0x750
[ 287.283975] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.289559]
[ 287.289559] other info that might help us debug this:
[ 287.289559]
[ 287.297582] Chain exists of:
[ 287.297582] &vdev->memory_lock --> (work_completion)(&arg.work)
--> &new_dev_set->lock
[ 287.297582]
[ 287.310023] Possible unsafe locking scenario:
[ 287.310023]
[ 287.315961] CPU0 CPU1
[ 287.320510] ---- ----
[ 287.325059] lock(&new_dev_set->lock);
[ 287.328917]
lock((work_completion)(&arg.work));
[ 287.336153] lock(&new_dev_set->lock);
[ 287.342523] lock(&vdev->memory_lock);
[ 287.346382]
[ 287.346382] *** DEADLOCK ***
[ 287.346382]
[ 287.352315] 2 locks held by vfio_pci_sriov_/18636:
[ 287.357125] #0: ff45bea208ed3e18 (&group->group_lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x3e3/0x7b0
[ 287.367048] #1: ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4},
at: vfio_group_fops_unl_ioctl+0x44d/0x7b0
[ 287.376976]
[ 287.376976] stack backtrace:
[ 287.381353] CPU: 191 UID: 0 PID: 18636 Comm: vfio_pci_sriov_
Tainted: G S 7.0.0-dbg-DEV #3 PREEMPTLAZY
[ 287.381355] Tainted: [S]=CPU_OUT_OF_SPEC
[ 287.381356] Call Trace:
[ 287.381357] <TASK>
[ 287.381358] dump_stack_lvl+0x54/0x70
[ 287.381361] print_circular_bug+0x2e1/0x300
[ 287.381363] check_noncircular+0xf9/0x120
[ 287.381364] ? __lock_acquire+0x5b4/0x2800
[ 287.381366] __lock_acquire+0x14c6/0x2800
[ 287.381368] ? pci_mmcfg_read+0x4f/0x220
[ 287.381370] ? pci_mmcfg_write+0x57/0x220
[ 287.381371] ? lock_acquire+0xd3/0x2f0
[ 287.381373] ? pci_mmcfg_write+0x57/0x220
[ 287.381374] ? lock_release+0xef/0x360
[ 287.381376] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381377] lock_acquire+0xd3/0x2f0
[ 287.381378] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381379] ? lock_is_held_type+0x76/0x100
[ 287.381382] down_write+0x3a/0xc0
[ 287.381382] ? vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381383] vfio_pci_core_runtime_resume+0x1f/0xa0
[ 287.381384] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381385] __rpm_callback+0x8c/0x310
[ 287.381386] ? ktime_get_mono_fast_ns+0x3d/0xb0
[ 287.381389] ? __pfx_pci_pm_runtime_resume+0x10/0x10
[ 287.381390] rpm_resume+0x529/0x6f0
[ 287.381392] ? lock_is_held_type+0x76/0x100
[ 287.381394] __pm_runtime_resume+0x68/0x90
[ 287.381396] vfio_pci_core_enable+0x44/0x310
[ 287.381398] vfio_pci_open_device+0x1c/0x80
[ 287.381399] vfio_df_open+0x10f/0x150
[ 287.381401] vfio_group_fops_unl_ioctl+0x4a4/0x7b0
[ 287.381402] __se_sys_ioctl+0x71/0xc0
[ 287.381404] do_syscall_64+0x14d/0x750
[ 287.381405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 287.381406] ? trace_irq_disable+0x25/0xd0
[ 287.381409] entry_SYSCALL_64_after_hwframe+0x77/0x7f
Introduce a private flag 'sriov_active' in the vfio_pci_core_device
struct. This allows the driver to track the SR-IOV power state requirement
without relying on pci_num_vf() while holding the memory_lock. The lock is
now only held to set the flag and ensure the device is in D0, after which
pci_enable_sriov() can be called without the lock.
Fixes: f4162eb1e2fc ("vfio/pci: Change the PF power state to D0 before enabling VFs")
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
Suggested-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
Link: https://lore.kernel.org/r/20260514173449.3282188-1-rananta@google.com
[promote bitfield to plain bool to avoid storage-unit races]
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/vfio_pci_core.c | 17 ++++++++++++++---
include/linux/vfio_pci_core.h | 1 +
2 files changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -242,8 +242,11 @@ int vfio_pci_set_power_state(struct vfio
int ret;
/* Prevent changing power state for PFs with VFs enabled */
- if (pci_num_vf(pdev) && state > PCI_D0)
- return -EBUSY;
+ if (state > PCI_D0) {
+ lockdep_assert_held_write(&vdev->memory_lock);
+ if (vdev->sriov_active)
+ return -EBUSY;
+ }
if (vdev->needs_pm_restore) {
if (pdev->current_state < PCI_D3hot && state >= PCI_D3hot) {
@@ -2236,8 +2239,9 @@ int vfio_pci_core_sriov_configure(struct
down_write(&vdev->memory_lock);
vfio_pci_set_power_state(vdev, PCI_D0);
- ret = pci_enable_sriov(pdev, nr_virtfn);
+ vdev->sriov_active = true;
up_write(&vdev->memory_lock);
+ ret = pci_enable_sriov(pdev, nr_virtfn);
if (ret) {
pm_runtime_put(&pdev->dev);
goto out_del;
@@ -2251,6 +2255,13 @@ int vfio_pci_core_sriov_configure(struct
}
out_del:
+ /*
+ * Avoid taking the memory_lock intentionally. A race with a power
+ * state transition would at most result in an -EBUSY, leaving the
+ * device in PCI_D0.
+ */
+ vdev->sriov_active = false;
+
mutex_lock(&vfio_pci_sriov_pfs_mutex);
list_del_init(&vdev->sriov_pfs_item);
out_unlock:
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -80,6 +80,7 @@ struct vfio_pci_core_device {
bool needs_pm_restore:1;
bool pm_intx_masked:1;
bool pm_runtime_engaged:1;
+ bool sriov_active;
struct pci_saved_state *pci_saved_state;
struct pci_saved_state *pm_save;
int ioeventfds_nr;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0118/1266] vfio/pci: Latch disable_idle_d3 per device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0117/1266] vfio/pci: Use a private flag to prevent power state change with VFs Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0119/1266] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
` (880 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Kevin Tian,
Alex Williamson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@nvidia.com>
commit 4575e9aac5336d1365138c0284773bf8da4b1fa3 upstream.
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated
the device power state with pci_set_power_state(). There were no
refcounts to maintain or balanced operations, we could unconditionally
bring the device to D0 and conditionally move it to D3hot. Therefore
the module parameter was made writable.
Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to
vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect
of the module parameter was nullified. The parameter value could still
be changed through sysfs, but the vfio-pci driver latched the values
into vfio-pci-core globals at module init. Loading the vfio-pci module,
or unloading and reloading, with non-default or different values could
change the globals relative to existing devices bound to vfio-pci
variant drivers.
Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the
unused device into low power state with runtime PM"), which marks the
point where power states became refcounted. PM get and put operations
need to be balanced, but the same module operations noted above can
change the global variables relative to those devices already bound to
vfio-pci variant drivers. This introduces a window where PM operations
can now become unbalanced.
To resolve this with a narrow footprint for stable backports, the
disable_idle_d3 flag is latched into the vfio_pci_core_device at the
time of initialization, such that the device always operates with a
consistent value.
NB. vfio_pci_dev_set_try_reset() now unconditionally raises the
runtime PM usage count around bus reset to account for disable_idle_d3
becoming a per-device rather than global flag. When this flag is set,
the additional get/put pair is harmless and allows continued use of the
shared vfio_pci_dev_set_pm_runtime_get() helper.
Fixes: 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260615191241.688297-2-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/vfio_pci_core.c | 19 ++++++++++---------
include/linux/vfio_pci_core.h | 1 +
2 files changed, 11 insertions(+), 9 deletions(-)
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -477,7 +477,7 @@ int vfio_pci_core_enable(struct vfio_pci
u16 cmd;
u8 msix_pos;
- if (!disable_idle_d3) {
+ if (!vdev->disable_idle_d3) {
ret = pm_runtime_resume_and_get(&pdev->dev);
if (ret < 0)
return ret;
@@ -555,7 +555,7 @@ out_free_state:
out_disable_device:
pci_disable_device(pdev);
out_power:
- if (!disable_idle_d3)
+ if (!vdev->disable_idle_d3)
pm_runtime_put(&pdev->dev);
return ret;
}
@@ -682,7 +682,7 @@ out:
vfio_pci_dev_set_try_reset(vdev->vdev.dev_set);
/* Put the pm-runtime usage counter acquired during enable */
- if (!disable_idle_d3)
+ if (!vdev->disable_idle_d3)
pm_runtime_put(&pdev->dev);
}
EXPORT_SYMBOL_GPL(vfio_pci_core_disable);
@@ -2058,6 +2058,8 @@ int vfio_pci_core_init_dev(struct vfio_d
init_rwsem(&vdev->memory_lock);
xa_init(&vdev->ctx);
+ vdev->disable_idle_d3 = disable_idle_d3;
+
return 0;
}
EXPORT_SYMBOL_GPL(vfio_pci_core_init_dev);
@@ -2149,7 +2151,7 @@ int vfio_pci_core_register_device(struct
dev->driver->pm = &vfio_pci_core_pm_ops;
pm_runtime_allow(dev);
- if (!disable_idle_d3)
+ if (!vdev->disable_idle_d3)
pm_runtime_put(dev);
ret = vfio_register_group_dev(&vdev->vdev);
@@ -2158,7 +2160,7 @@ int vfio_pci_core_register_device(struct
return 0;
out_power:
- if (!disable_idle_d3)
+ if (!vdev->disable_idle_d3)
pm_runtime_get_noresume(dev);
pm_runtime_forbid(dev);
@@ -2177,7 +2179,7 @@ void vfio_pci_core_unregister_device(str
vfio_pci_vf_uninit(vdev);
vfio_pci_vga_uninit(vdev);
- if (!disable_idle_d3)
+ if (!vdev->disable_idle_d3)
pm_runtime_get_noresume(&vdev->pdev->dev);
pm_runtime_forbid(&vdev->pdev->dev);
@@ -2505,7 +2507,7 @@ static void vfio_pci_dev_set_try_reset(s
* state. Increment the usage count for all the devices in the dev_set
* before reset and decrement the same after reset.
*/
- if (!disable_idle_d3 && vfio_pci_dev_set_pm_runtime_get(dev_set))
+ if (vfio_pci_dev_set_pm_runtime_get(dev_set))
return;
if (!pci_reset_bus(pdev))
@@ -2515,8 +2517,7 @@ static void vfio_pci_dev_set_try_reset(s
if (reset_done)
cur->needs_reset = false;
- if (!disable_idle_d3)
- pm_runtime_put(&cur->pdev->dev);
+ pm_runtime_put(&cur->pdev->dev);
}
}
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -80,6 +80,7 @@ struct vfio_pci_core_device {
bool needs_pm_restore:1;
bool pm_intx_masked:1;
bool pm_runtime_engaged:1;
+ bool disable_idle_d3:1;
bool sriov_active;
struct pci_saved_state *pci_saved_state;
struct pci_saved_state *pm_save;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0119/1266] vfio/pci: Release the VGA arbiter client on register_device() failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0118/1266] vfio/pci: Latch disable_idle_d3 per device Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0120/1266] vfio/pci: Fix racy bitfields and tighten struct layout Greg Kroah-Hartman
` (879 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Kevin Tian,
Alex Williamson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@nvidia.com>
commit daedde7f024ecf88bc8e832ed40cf2c795f0796a upstream.
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
the last failure point of what is now vfio_pci_core_register_device()
without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode()
only uses pci_dev state, but the original failure path could leave a
callback with a freed vdev cookie. The stale registration also becomes
unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
Fixes: 4aeec3984ddc ("vfio/pci: Re-order vfio_pci_probe()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260615191241.688297-3-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/vfio_pci_core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -2164,6 +2164,7 @@ out_power:
pm_runtime_get_noresume(dev);
pm_runtime_forbid(dev);
+ vfio_pci_vga_uninit(vdev);
out_vf:
vfio_pci_vf_uninit(vdev);
return ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0120/1266] vfio/pci: Fix racy bitfields and tighten struct layout
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0119/1266] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0121/1266] vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Greg Kroah-Hartman
` (878 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Kevin Tian,
Alex Williamson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@nvidia.com>
commit e73638e55f861758d49f14d7bb5dba3035981cd7 upstream.
Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.
Note that the virq_disabled and bardirty flags are relocated to fill
an existing hole in the structure.
Bitfield justifications:
has_dyn_msix: written only in vfio_pci_core_enable()
pci_2_3: written only in vfio_pci_core_enable()
reset_works: written only in vfio_pci_core_enable()
extended_caps: written only in vfio_cap_len() under vfio_config_init()
has_vga: written only in vfio_pci_core_enable()
nointx: written only in vfio_pci_core_enable()
needs_pm_restore: written only in vfio_pci_probe_power_state()
disable_idle_d3: written only at .init in vfio_pci_core_init_dev()
Dedicated storage units:
virq_disabled: written by guest INTx command writes in
vfio_basic_config_write() while the device is open
bardirty: written by guest BAR writes in vfio_basic_config_write()
while the device is open
pm_intx_masked: written in the runtime-PM suspend path.
pm_runtime_engaged: written by low-power feature entry/exit paths
needs_reset: set in vfio_pci_core_disable() and cleared for devices in
the set by vfio_pci_dev_set_try_reset()
sriov_active: written by vfio_pci_core_sriov_configure() via sysfs
sriov_numvfs while bound.
Fixes: 9cd0f6d5cbb6 ("vfio/pci: Use bitfield for struct vfio_pci_core_device flags")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260615191241.688297-4-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/vfio_pci_core.h | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -54,6 +54,9 @@ struct vfio_pci_core_device {
struct pci_dev *pdev;
void __iomem *barmap[PCI_STD_NUM_BARS];
bool bar_mmap_supported[PCI_STD_NUM_BARS];
+ /* Flags modified at runtime - dedicated storage unit */
+ bool virq_disabled;
+ bool bardirty;
u8 *pci_config_map;
u8 *vconfig;
struct perm_bits *msi_perm;
@@ -68,19 +71,19 @@ struct vfio_pci_core_device {
u16 msix_size;
u32 msix_offset;
u32 rbar[7];
+ /* Flags only modified on setup/release - bitfield ok */
bool has_dyn_msix:1;
bool pci_2_3:1;
- bool virq_disabled:1;
bool reset_works:1;
bool extended_caps:1;
- bool bardirty:1;
bool has_vga:1;
- bool needs_reset:1;
bool nointx:1;
bool needs_pm_restore:1;
- bool pm_intx_masked:1;
- bool pm_runtime_engaged:1;
bool disable_idle_d3:1;
+ /* Flags modified at runtime - dedicated storage unit */
+ bool needs_reset;
+ bool pm_intx_masked;
+ bool pm_runtime_engaged;
bool sriov_active;
struct pci_saved_state *pci_saved_state;
struct pci_saved_state *pm_save;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0121/1266] vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0120/1266] vfio/pci: Fix racy bitfields and tighten struct layout Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0122/1266] Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Greg Kroah-Hartman
` (877 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo, Kevin Tian,
Jason Gunthorpe, Alex Williamson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit a26b499b757cfc8bbff1088bb1b844639e250893 upstream.
vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time,
looping to skip optional states the device does not support until
*next_fsm is supported. A blocked transition is encoded as
VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.
The skip loop does not account for the ERROR sentinel.
state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is
ERROR, so once *next_fsm becomes ERROR the loop condition stays true and
*next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and
STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a
precopy-capable device, causing the loop to spin forever while holding
the driver state mutex. This can result in a soft lockup, and a panic
with softlockup_panic set.
Terminate the skip loop on the ERROR sentinel so a blocked transition
falls through to the existing return and reports -EINVAL.
Fixes: 4db52602a607 ("vfio: Extend the device migration protocol with PRE_COPY")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/SYBPR01MB7881290BBDE79B61AE6A017FAF122@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/vfio_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -843,7 +843,8 @@ int vfio_mig_get_next_state(struct vfio_
* logical state, as per the above comment.
*/
*next_fsm = vfio_from_fsm_table[cur_fsm][new_fsm];
- while ((state_flags_table[*next_fsm] & device->migration_flags) !=
+ while (*next_fsm != VFIO_DEVICE_STATE_ERROR &&
+ (state_flags_table[*next_fsm] & device->migration_flags) !=
state_flags_table[*next_fsm])
*next_fsm = vfio_from_fsm_table[*next_fsm][new_fsm];
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0122/1266] Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0121/1266] vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0123/1266] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
` (876 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zenm Chen, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenm Chen <zenmchen@gmail.com>
commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream.
Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based
Wi-Fi + Bluetooth adapter.
The information in /sys/kernel/debug/usb/devices about the Bluetooth
device is listed as the below:
T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c4e ProdID=0128 Rev= 0.00
S: Manufacturer=Realtek
S: Product=802.11ax WLAN Adapter
S: SerialNumber=00e04c000001
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: stable@vger.kernel.org # 6.6.x
Signed-off-by: Zenm Chen <zenmchen@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -518,6 +518,8 @@ static const struct usb_device_id quirks
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x7392, 0xe611), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Realtek 8852AE Bluetooth devices */
{ USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0123/1266] Bluetooth: btusb: fix use-after-free on registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0122/1266] Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0124/1266] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
` (875 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Johan Hovold,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream.
Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org # 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4078,7 +4078,7 @@ static int btusb_probe(struct usb_interf
err = hci_register_dev(hdev);
if (err < 0)
- goto out_free_dev;
+ goto err_release_siblings;
usb_set_intfdata(intf, data);
@@ -4087,6 +4087,15 @@ static int btusb_probe(struct usb_interf
return 0;
+err_release_siblings:
+ if (data->diag) {
+ usb_set_intfdata(data->diag, NULL);
+ usb_driver_release_interface(&btusb_driver, data->diag);
+ }
+ if (data->isoc) {
+ usb_set_intfdata(data->isoc, NULL);
+ usb_driver_release_interface(&btusb_driver, data->isoc);
+ }
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0124/1266] Bluetooth: btusb: fix use-after-free on marvell probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0123/1266] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0125/1266] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
` (874 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajat Jain, Johan Hovold,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 upstream.
Make sure to stop any TX URBs submitted during Marvell OOB wakeup
configuration on later probe failures to avoid use-after-free in the
completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the pins for oob wakeup")
Cc: stable@vger.kernel.org # 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3894,7 +3894,7 @@ static int btusb_probe(struct usb_interf
if (id->driver_info & BTUSB_INTEL_COMBINED) {
err = btintel_configure_setup(hdev, btusb_driver.name);
if (err)
- goto out_free_dev;
+ goto err_kill_tx_urbs;
/* Transport specific configuration */
hdev->send = btusb_send_frame_intel;
@@ -4052,7 +4052,7 @@ static int btusb_probe(struct usb_interf
err = usb_set_interface(data->udev, 0, 0);
if (err < 0) {
BT_ERR("failed to set interface 0, alt 0 %d", err);
- goto out_free_dev;
+ goto err_kill_tx_urbs;
}
}
@@ -4060,7 +4060,7 @@ static int btusb_probe(struct usb_interf
err = usb_driver_claim_interface(&btusb_driver,
data->isoc, data);
if (err < 0)
- goto out_free_dev;
+ goto err_kill_tx_urbs;
}
if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
@@ -4096,6 +4096,8 @@ err_release_siblings:
usb_set_intfdata(data->isoc, NULL);
usb_driver_release_interface(&btusb_driver, data->isoc);
}
+err_kill_tx_urbs:
+ usb_kill_anchored_urbs(&data->tx_anchor);
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0125/1266] Bluetooth: btusb: fix wakeup source leak on probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0124/1266] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0126/1266] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
` (873 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajat Jain, Johan Hovold,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d upstream.
Make sure to disable wakeup on probe failure to avoid leaking the wakeup
source.
Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")
Cc: stable@vger.kernel.org # 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2811,6 +2811,11 @@ static int marvell_config_oob_wake(struc
return 0;
}
+#else
+static inline int marvell_config_oob_wake(struct hci_dev *hdev)
+{
+ return 0;
+}
#endif
static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
@@ -3625,6 +3630,11 @@ static int btusb_config_oob_wake(struct
bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
return 0;
}
+#else
+static inline int btusb_config_oob_wake(struct hci_dev *hdev)
+{
+ return 0;
+}
#endif
static void btusb_check_needs_reset_resume(struct usb_interface *intf)
@@ -3848,7 +3858,6 @@ static int btusb_probe(struct usb_interf
hdev->notify = btusb_notify;
hdev->wakeup = btusb_wakeup;
-#ifdef CONFIG_PM
err = btusb_config_oob_wake(hdev);
if (err)
goto out_free_dev;
@@ -3857,9 +3866,9 @@ static int btusb_probe(struct usb_interf
if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
err = marvell_config_oob_wake(hdev);
if (err)
- goto out_free_dev;
+ goto err_disable_wakeup;
}
-#endif
+
if (id->driver_info & BTUSB_CW6622)
set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
@@ -4098,6 +4107,9 @@ err_release_siblings:
}
err_kill_tx_urbs:
usb_kill_anchored_urbs(&data->tx_anchor);
+err_disable_wakeup:
+ if (data->oob_wake_irq)
+ device_init_wakeup(&data->udev->dev, false);
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0126/1266] binder: fix UAF in binder_thread_release()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0125/1266] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0127/1266] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
` (872 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alice Ryhl, Carlos Llamas
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream.
When a thread exits, binder_thread_release() walks its transaction stack
to clear the t->from and t->to_proc that correspond with the exiting
thread. However, a process dying in parallel might attempt to kfree some
of these transactions. And if one of them has no associated t->to_proc,
the t->to_proc->inner_lock will not be acquired.
This means that transaction accesses in binder_thread_release() after
t->to_proc has been cleared might race with binder_free_transaction()
and cause a use-after-free error as reported by KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798
Write of size 8 at addr ffff000016627500 by task X/715
CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
binder_thread_release+0x5d0/0x798
binder_ioctl+0x12c0/0x299c
[...]
Allocated by task 717 on cpu 18 at 67.267803s:
__kasan_kmalloc+0xa0/0xbc
__kmalloc_cache_noprof+0x174/0x444
binder_transaction+0x554/0x8150
binder_thread_write+0xa30/0x4354
binder_ioctl+0x20f0/0x299c
[...]
Freed by task 202 on cpu 18 at 90.416221s:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_free_transaction+0x150/0x294
binder_send_failed_reply+0x398/0x6d8
binder_release_work+0x3e4/0x4ec
binder_deferred_func+0xbd8/0x104c
[...]
==================================================================
In order to avoid this, make sure that binder_free_transaction() reads
the t->to_proc under the transaction lock. This will serialize the
transaction release with the accesses in binder_thread_release(). Plus,
it matches the documented locking rules for @to_proc.
Cc: stable <stable@kernel.org>
Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1567,7 +1567,11 @@ static void binder_txn_latency_free(stru
static void binder_free_transaction(struct binder_transaction *t)
{
- struct binder_proc *target_proc = t->to_proc;
+ struct binder_proc *target_proc;
+
+ spin_lock(&t->lock);
+ target_proc = t->to_proc;
+ spin_unlock(&t->lock);
if (target_proc) {
binder_inner_proc_lock(target_proc);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0127/1266] binder: fix UAF in binder_free_transaction()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0126/1266] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0128/1266] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
` (871 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alice Ryhl, Carlos Llamas
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 upstream.
In binder_free_transaction(), the t->to_proc is read under the t->lock.
However, once the t->lock is dropped, the to_proc can die in parallel.
This leads to a use-after-free error when we attempt to acquire its
inner lock right afterwards:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0
Write of size 4 at addr ffff00001125da70 by task B/672
CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x1a0
binder_free_transaction+0x8c/0x320
binder_send_failed_reply+0x21c/0x2f8
binder_thread_release+0x488/0x7e0
binder_ioctl+0x12c0/0x29a0
[...]
Allocated by task 675:
__kmalloc_cache_noprof+0x174/0x444
binder_open+0x118/0xb70
do_dentry_open+0x374/0x1040
vfs_open+0x58/0x3bc
[...]
Freed by task 212:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_proc_dec_tmpref+0x32c/0x5e0
binder_deferred_func+0xc48/0x104c
process_one_work+0x53c/0xbc0
[...]
==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the
target process remains alive. Undelivered transactions without a target
thread are already safe, as the target process can only be the current
context in those paths.
Cc: stable <stable@kernel.org>
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/all/aikJKVuny_eOivwN@google.com/
Fixes: a370003cc301 ("binder: fix possible UAF when freeing buffer")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260619185233.2194678-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1567,10 +1567,19 @@ static void binder_txn_latency_free(stru
static void binder_free_transaction(struct binder_transaction *t)
{
+ struct binder_thread *target_thread;
struct binder_proc *target_proc;
spin_lock(&t->lock);
target_proc = t->to_proc;
+ target_thread = t->to_thread;
+ /*
+ * Pin target_thread to keep target_proc alive. Undelivered
+ * transactions with !target_thread are safe, as target_proc
+ * can only be the current context there.
+ */
+ if (target_thread)
+ atomic_inc(&target_thread->tmp_ref);
spin_unlock(&t->lock);
if (target_proc) {
@@ -1585,6 +1594,10 @@ static void binder_free_transaction(stru
t->buffer->transaction = NULL;
binder_inner_proc_unlock(target_proc);
}
+
+ if (target_thread)
+ binder_thread_dec_tmpref(target_thread);
+
if (trace_binder_txn_latency_free_enabled())
binder_txn_latency_free(t);
/*
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0128/1266] usb: xhci: Fix sleep in atomic context in xhci_free_streams()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0127/1266] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0129/1266] usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Greg Kroah-Hartman
` (870 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Lianqin Hu, Mathias Nyman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: 胡连勤 <hulianqin@vivo.com>
commit 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a upstream.
When a USB device with active stream endpoints is disconnected,
xhci_free_streams() is called from the hub_event workqueue to
free the stream resources. It calls xhci_free_stream_info()
while holding xhci->lock with irqs disabled.
xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
calls dma_free_coherent() for large stream context arrays.
dma_free_coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.
Call trace:
dma_free_attrs+0x174/0x220
xhci_free_stream_info+0xd0/0x11c
xhci_free_streams+0x278/0x37c
usb_free_streams+0x98/0xc0
usb_unbind_interface+0x1b8/0x2f8
device_release_driver_internal+0x1d4/0x2cc
device_release_driver+0x18/0x28
bus_remove_device+0x160/0x1a4
device_del+0x1ec/0x350
usb_disable_device+0x98/0x214
usb_disconnect+0xf0/0x35c
hub_event+0xab4/0x19ec
process_one_work+0x278/0x63c
Fix this by saving the stream_info pointers and clearing the
ep references under the lock, then calling xhci_free_stream_info()
outside the lock where sleeping is allowed.
Fixes: 8df75f42f8e6 ("USB: xhci: Add memory allocation for USB3 bulk streams.")
Cc: stable <stable@kernel.org>
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260703144033.483286-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3577,6 +3577,7 @@ static int xhci_free_streams(struct usb_
struct xhci_virt_device *vdev;
struct xhci_command *command;
struct xhci_input_control_ctx *ctrl_ctx;
+ struct xhci_stream_info *stream_info[EP_CTX_PER_DEV];
unsigned int ep_index;
unsigned long flags;
u32 changed_ep_bitmask;
@@ -3637,10 +3638,15 @@ static int xhci_free_streams(struct usb_
if (ret < 0)
return ret;
+ /*
+ * dma_free_coherent() called by xhci_free_stream_info() may sleep,
+ * so save stream_info pointers and clear references under lock,
+ * then free the memory outside lock.
+ */
spin_lock_irqsave(&xhci->lock, flags);
for (i = 0; i < num_eps; i++) {
ep_index = xhci_get_endpoint_index(&eps[i]->desc);
- xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info);
+ stream_info[i] = vdev->eps[ep_index].stream_info;
vdev->eps[ep_index].stream_info = NULL;
/* FIXME Unset maxPstreams in endpoint context and
* update deq ptr to point to normal string ring.
@@ -3650,6 +3656,9 @@ static int xhci_free_streams(struct usb_
}
spin_unlock_irqrestore(&xhci->lock, flags);
+ for (i = 0; i < num_eps; i++)
+ xhci_free_stream_info(xhci, stream_info[i]);
+
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0129/1266] usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0128/1266] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0130/1266] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
` (869 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit e8da46d99d3710106e7c44db14566bf9b57386b5 upstream.
rt1711h_probe() registers the TCPCI port before requesting the interrupt
and enabling alert interrupts. If either of those later steps fails, the
probe function returns without unregistering the TCPCI port. The explicit
unregister currently only happens from the remove callback.
Register a devres action immediately after tcpci_register_port() succeeds,
so tcpci_unregister_port() runs on later probe failures and on driver
detach. Drop the remove callback to avoid unregistering the same port
twice.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 302c570bf36e ("usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260706145312.37260-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c
+++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
@@ -327,6 +327,8 @@ static int rt1711h_check_revision(struct
return ret;
}
+static void rt1711h_unregister_tcpci_port(void *tcpci);
+
static int rt1711h_probe(struct i2c_client *client)
{
int ret;
@@ -378,6 +380,10 @@ static int rt1711h_probe(struct i2c_clie
if (IS_ERR_OR_NULL(chip->tcpci))
return PTR_ERR(chip->tcpci);
+ ret = devm_add_action_or_reset(chip->dev, rt1711h_unregister_tcpci_port, chip->tcpci);
+ if (ret)
+ return ret;
+
ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
rt1711h_irq,
IRQF_ONESHOT | IRQF_TRIGGER_LOW,
@@ -395,11 +401,9 @@ static int rt1711h_probe(struct i2c_clie
return 0;
}
-static void rt1711h_remove(struct i2c_client *client)
+static void rt1711h_unregister_tcpci_port(void *tcpci)
{
- struct rt1711h_chip *chip = i2c_get_clientdata(client);
-
- tcpci_unregister_port(chip->tcpci);
+ tcpci_unregister_port(tcpci);
}
static const struct i2c_device_id rt1711h_id[] = {
@@ -424,7 +428,6 @@ static struct i2c_driver rt1711h_i2c_dri
.of_match_table = of_match_ptr(rt1711h_of_match),
},
.probe = rt1711h_probe,
- .remove = rt1711h_remove,
.id_table = rt1711h_id,
};
module_i2c_driver(rt1711h_i2c_driver);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0130/1266] PCI: altera: Do not dispose parent IRQ mapping
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0129/1266] usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0131/1266] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
` (868 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Vaidya, Manivannan Sadhasivam,
Subhransu S. Prusty
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Vaidya <mahesh.vaidya@altera.com>
commit 5ef4bac02189bee0b7c170e352d7a38e13fe9678 upstream.
altera_pcie_irq_teardown() calls irq_dispose_mapping() on pcie->irq.
However, pcie->irq is the parent IRQ returned by platform_get_irq(), not
the mapping created by Altera INTx irq_domain.
The Altera driver only sets the chained handler on the parent IRQ. It
should detach that handler during teardown, but it should not dispose the
parent IRQ mapping, which belongs to the parent interrupt controller's
irq_domain.
Drop irq_dispose_mapping(pcie->irq) from the teardown path.
Note that during irqchip remove(), the child IRQs should've disposed. But
since the chained handler itself is removed, there is no way the stale
child IRQs (if exists) could fire. So it is safe here.
Fixes: ec15c4d0d5d2 ("PCI: altera: Allow building as module")
Signed-off-by: Mahesh Vaidya <mahesh.vaidya@altera.com>
[mani: added a note about IRQ disposal]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Subhransu S. Prusty <subhransu.sekhar.prusty@altera.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260430204330.3121003-2-mahesh.vaidya@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-altera.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/pci/controller/pcie-altera.c
+++ b/drivers/pci/controller/pcie-altera.c
@@ -684,7 +684,6 @@ static void altera_pcie_irq_teardown(str
{
irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
irq_domain_remove(pcie->irq_domain);
- irq_dispose_mapping(pcie->irq);
}
static int altera_pcie_parse_dt(struct altera_pcie *pcie)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0131/1266] PCI: host-common: Request bus reassignment when not probe-only
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0130/1266] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0132/1266] mm/damon/ops-common: handle extreme intervals in damon_hot_score() Greg Kroah-Hartman
` (867 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratheesh Kannoth,
Manivannan Sadhasivam, Bjorn Helgaas, Vidya Sagar
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <rkannoth@marvell.com>
commit fda8749ba73638f5bbca3ffb39bc6861eb3b23fa upstream.
pci_host_common_init() is used by several generic ECAM host drivers.
After PCI core changes around pci_flags and preserve_config, these hosts
no longer opted into full bus number reassignment the way they did
before, which broke enumeration of devices on a Marvell CN106XX board.
When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so
pci_scan_bridge_extend() takes the reassignment path: bus numbers can be
assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the
flag in probe-only mode so existing assignments are not overridden.
Fixes: 7246a4520b4b ("PCI: Use preserve_config in place of pci_flags")
Closes: https://lore.kernel.org/all/abkqm_LCd9zAM8cW@rkannoth-OptiPlex-7090/
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
[mani: added stable tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add problem report link]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Cc: Vidya Sagar <vidyas@nvidia.com>
Link: https://patch.msgid.link/20260414081730.3864372-1-rkannoth@marvell.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-host-common.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/pci/controller/pci-host-common.c
+++ b/drivers/pci/controller/pci-host-common.c
@@ -77,6 +77,10 @@ int pci_host_common_probe(struct platfor
if (!pci_has_flag(PCI_PROBE_ONLY))
pci_add_flags(PCI_REASSIGN_ALL_BUS);
+ /* Do not reassign bus numbers if probe only */
+ if (!pci_has_flag(PCI_PROBE_ONLY))
+ pci_add_flags(PCI_REASSIGN_ALL_BUS);
+
bridge->sysdata = cfg;
bridge->ops = (struct pci_ops *)&ops->pci_ops;
bridge->msi_domain = true;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0132/1266] mm/damon/ops-common: handle extreme intervals in damon_hot_score()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0131/1266] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0133/1266] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
` (866 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 35d4a3cf70a855b50e53189ac2f8463e20a02046 upstream.
Fix three issues in damon_hot_score() that comes from wrong handling of
extreme (zero or too high) monitoring intervals user setup.
When the user sets sampling interval zero, damon_max_nr_accesses(), which
is called from damon_hot_score(), causes a divide-by-zero. Needless to
say, it is a problem.
When the user sets the aggregation interval zero, the function returns
zero. It is wrong, since the real maximum nr_acceses in the setup should
be one. Worse yet, it can cause another divide-by-zero from its caller,
damon_hot_score(), since it uses damon_max_nr_accesses() return value as a
denominator.
When the user sets the aggregation interval very high, damon_hot_score()
could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return
value is used as an index to the regions_score_histogram array, which is
DAMOS_MAX_SCORE+1 size, it causes out of bounds array access.
The issues can be relatively easily reproduced like below. The sysfs
write permission is required, though.
# ./damo start --damos_action lru_prio --damos_quota_space 100M \
--damos_quota_interval 1s
# cd /sys/kernel/mm/damon/admin/kdamonds/0
# echo 0 > contexts/0/monitoring_attrs/intervals/sample_us
# echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us
# echo commit > state
# dmesg
[...]
[ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI
[...]
[ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0
[...]
Fix the divide-by-zero intervals problems by explicitly handling the zero
intervals in damon_max_nr_accesses(). Fix the out-of-bound array access
by applying [0, DAMOS_MAX_SCORE] bounds before returning from
damon_hot_score().
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260623135834.67189-1-sj@kernel.org
Link: https://lore.kernel.org/20260619202459.145010-1-sj@kernel.org [1]
Fixes: 198f0f4c58b9 ("mm/damon/vaddr,paddr: support pageout prioritization")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.16.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/damon.h | 8 ++++++--
mm/damon/ops-common.c | 1 +
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/include/linux/damon.h
+++ b/include/linux/damon.h
@@ -669,9 +669,13 @@ static inline bool damon_target_has_pid(
static inline unsigned int damon_max_nr_accesses(const struct damon_attrs *attrs)
{
- /* {aggr,sample}_interval are unsigned long, hence could overflow */
- return min(attrs->aggr_interval / attrs->sample_interval,
+ unsigned long sample_interval;
+ unsigned long max_nr_accesses;
+
+ sample_interval = attrs->sample_interval ? : 1;
+ max_nr_accesses = min(attrs->aggr_interval / sample_interval,
(unsigned long)UINT_MAX);
+ return max_nr_accesses ? : 1;
}
--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
@@ -107,6 +107,7 @@ int damon_hot_score(struct damon_ctx *c,
* Transform it to fit in [0, DAMOS_MAX_SCORE]
*/
hotness = hotness * DAMOS_MAX_SCORE / DAMON_MAX_SUBSCORE;
+ hotness = max(min(hotness, DAMOS_MAX_SCORE), 0);
return hotness;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0133/1266] netfilter: ipset: fix race between dump and ip_set_list resize
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0132/1266] mm/damon/ops-common: handle extreme intervals in damon_hot_score() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0134/1266] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
` (865 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jozsef Kadlecsik, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 7cd9103283b26b917360ec99d7d2f2d761bcf1ab upstream.
The release path of ip_set_dump_do() and ip_set_dump_done() read
inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()
of the array pointer. These run from netlink_recvmsg() without the nfnl
mutex and without an RCU read-side critical section.
A concurrent ip_set_create() can grow the array: it publishes the new
array, calls synchronize_net() and then kvfree()s the old one. Since the
dump paths read the array outside any RCU reader, synchronize_net() does
not wait for them and the old array can be freed while they still index
into it, causing a use-after-free.
The dumped set itself stays pinned via set->ref_netlink, so only the
array load needs protecting. Take rcu_read_lock() around it, matching
ip_set_get_byname() and __ip_set_put_byindex().
BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
Read of size 8 at addr ffff88800b5c4018 by task exploit/150
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
netlink_dump (net/netlink/af_netlink.c:2325)
netlink_recvmsg (net/netlink/af_netlink.c:1976)
sock_recvmsg (net/socket.c:1159)
__sys_recvfrom (net/socket.c:2315)
...
Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]
RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)
Kernel panic - not syncing: Fatal exception
Fixes: 8a02bdd50b2e ("netfilter: ipset: Fix calling ip_set() macro at dumping")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1480,7 +1480,11 @@ ip_set_dump_done(struct netlink_callback
struct ip_set_net *inst =
(struct ip_set_net *)cb->args[IPSET_CB_NET];
ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
- struct ip_set *set = ip_set_ref_netlink(inst, index);
+ struct ip_set *set;
+
+ rcu_read_lock();
+ set = ip_set_ref_netlink(inst, index);
+ rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
@@ -1685,7 +1689,9 @@ next_set:
release_refcount:
/* If there was an error or set is done, release set */
if (ret || !cb->args[IPSET_CB_ARG0]) {
+ rcu_read_lock();
set = ip_set_ref_netlink(inst, index);
+ rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
pr_debug("release set %s\n", set->name);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0134/1266] virtio-mmio: fix device release warning on module unload
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0133/1266] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0135/1266] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
` (864 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawel Moll, Johan Hovold,
Michael S. Tsirkin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c687bc35694698ec4c7f92bf929c3d659f0cecb8 upstream.
Driver core expects devices to be allocated dynamically and complains
loudly when a device that lacks a release function is freed.
Use __root_device_register() to allocate and register the root device
instead of open coding using a static device.
Note that root_device_register(), which also creates a link to the
module, cannot be used as the device is registered when parsing the
module parameters which happens before the module kobject has been set
up.
Fixes: 81a054ce0b46 ("virtio-mmio: Devices parameter parsing")
Cc: stable@vger.kernel.org # 3.5
Cc: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260427143710.14702-1-johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_mmio.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -710,9 +710,7 @@ static int virtio_mmio_remove(struct pla
#if defined(CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES)
-static struct device vm_cmdline_parent = {
- .init_name = "virtio-mmio-cmdline",
-};
+static struct device *vm_cmdline_parent;
static int vm_cmdline_parent_registered;
static int vm_cmdline_id;
@@ -720,7 +718,6 @@ static int vm_cmdline_id;
static int vm_cmdline_set(const char *device,
const struct kernel_param *kp)
{
- int err;
struct resource resources[2] = {};
char *str;
long long base, size;
@@ -752,11 +749,10 @@ static int vm_cmdline_set(const char *de
resources[1].start = resources[1].end = irq;
if (!vm_cmdline_parent_registered) {
- err = device_register(&vm_cmdline_parent);
- if (err) {
- put_device(&vm_cmdline_parent);
+ vm_cmdline_parent = __root_device_register("virtio-mmio-cmdline", NULL);
+ if (IS_ERR(vm_cmdline_parent)) {
pr_err("Failed to register parent device!\n");
- return err;
+ return PTR_ERR(vm_cmdline_parent);
}
vm_cmdline_parent_registered = 1;
}
@@ -767,7 +763,7 @@ static int vm_cmdline_set(const char *de
(unsigned long long)resources[0].end,
(int)resources[1].start);
- pdev = platform_device_register_resndata(&vm_cmdline_parent,
+ pdev = platform_device_register_resndata(vm_cmdline_parent,
"virtio-mmio", vm_cmdline_id++,
resources, ARRAY_SIZE(resources), NULL, 0);
@@ -791,8 +787,12 @@ static int vm_cmdline_get_device(struct
static int vm_cmdline_get(char *buffer, const struct kernel_param *kp)
{
buffer[0] = '\0';
- device_for_each_child(&vm_cmdline_parent, buffer,
- vm_cmdline_get_device);
+
+ if (vm_cmdline_parent_registered) {
+ device_for_each_child(vm_cmdline_parent, buffer,
+ vm_cmdline_get_device);
+ }
+
return strlen(buffer) + 1;
}
@@ -814,9 +814,9 @@ static int vm_unregister_cmdline_device(
static void vm_unregister_cmdline_devices(void)
{
if (vm_cmdline_parent_registered) {
- device_for_each_child(&vm_cmdline_parent, NULL,
+ device_for_each_child(vm_cmdline_parent, NULL,
vm_unregister_cmdline_device);
- device_unregister(&vm_cmdline_parent);
+ root_device_unregister(vm_cmdline_parent);
vm_cmdline_parent_registered = 0;
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0135/1266] hwrng: virtio: clamp device-reported used.len at copy_data()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0134/1266] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0136/1266] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
` (863 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin,
Michael Bommarito
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit e3046eeada299f917a8ad883af4434bfb86556b1 upstream.
random_recv_done() stores the device-reported used.len directly into
vi->data_avail. copy_data() then indexes vi->data[] using
vi->data_idx (advanced by previous copy_data() calls) and issues a
memcpy() without re-validating either value against the posted
buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32
or 64).
A malicious or buggy virtio-rng backend can set used.len beyond
sizeof(vi->data), steering the memcpy() past the end of the inline
array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes
those bytes into the guest RNG, and guest root can also observe
them directly via /dev/hwrng.
Concrete impact is inside the guest:
- Memory-safety / hardening: any virtio-rng backend that
over-reports used.len causes the driver to read past vi->data
into unrelated slab contents. hwrng_fillfn() is a kernel thread
that runs as soon as the device is probed; no guest userspace
interaction is required to first-trigger the OOB.
- Cross-boundary leak (confidential-compute threat model): a
malicious hypervisor cooperating with a malicious or compromised
guest root userspace can use /dev/hwrng as a leak channel for
guest-kernel heap data. The host sets a large used.len, guest
root reads /dev/hwrng, and the returned bytes contain guest
kernel slab contents that were adjacent to vi->data. In
practice, confidential-compute guests (SEV-SNP, TDX) usually
disable virtio-rng entirely, so this path is narrow, but the
fix is still worth carrying because the underlying
memory-safety bug contaminates the guest RNG on any host.
KASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend
has been patched to report used.len = 0x10000:
BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0
Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52
Call Trace:
__asan_memcpy+0x23/0x60
virtio_read+0x394/0x5d0
hwrng_fillfn+0xb2/0x470
kthread+0x2cc/0x3a0
Allocated by task 1:
probe_common+0xa5/0x660
virtio_dev_probe+0x549/0xbc0
The buggy address belongs to the object at ffff88800ae0b800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)
Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer
overflow in USB transport layer"), which hardened
usb9pfs_rx_complete() against unchecked device-reported length in
the USB 9p transport.
With the clamp at point of use and array_index_nospec() in place,
the same harness boots cleanly: copy_data() returns zero for the
bogus report, the device-supplied bytes after data_idx are
discarded, and the driver issues a fresh request.
Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.")
Cc: stable@vger.kernel.org
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260531142251.2792061-1-michael.bommarito@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/hw_random/virtio-rng.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -7,6 +7,7 @@
#include <asm/barrier.h>
#include <linux/err.h>
#include <linux/hw_random.h>
+#include <linux/nospec.h>
#include <linux/scatterlist.h>
#include <linux/spinlock.h>
#include <linux/virtio.h>
@@ -66,8 +67,26 @@ static void request_entropy(struct virtr
static unsigned int copy_data(struct virtrng_info *vi, void *buf,
unsigned int size)
{
- size = min_t(unsigned int, size, vi->data_avail);
- memcpy(buf, vi->data + vi->data_idx, size);
+ unsigned int idx, avail;
+
+ /*
+ * vi->data_avail was set from the device-reported used.len and
+ * vi->data_idx was advanced by previous copy_data() calls. A
+ * malicious or buggy virtio-rng backend can drive either past
+ * sizeof(vi->data). Clamp at point of use and harden the index
+ * with array_index_nospec() so the memcpy() below cannot be
+ * steered into adjacent slab memory, including under
+ * speculation.
+ */
+ avail = min_t(unsigned int, vi->data_avail, sizeof(vi->data));
+ if (vi->data_idx >= avail) {
+ vi->data_avail = 0;
+ request_entropy(vi);
+ return 0;
+ }
+ size = min_t(unsigned int, size, avail - vi->data_idx);
+ idx = array_index_nospec(vi->data_idx, sizeof(vi->data));
+ memcpy(buf, vi->data + idx, size);
vi->data_idx += size;
vi->data_avail -= size;
if (vi->data_avail == 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0136/1266] USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0135/1266] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0137/1266] usb: dwc3: run gadget disconnect from sleepable suspend context Greg Kroah-Hartman
` (862 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Alan Stern, stable,
Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit abf76d3239dee97b66e7241ad04811f1ce562e28 upstream.
The chaoskey driver has a use-after-free bug in its release routine.
If the user closes the device file after the USB device has been
unplugged, a debugging log statement will try to access the
usb_interface structure after it has been deallocated:
BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)
Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
dev_driver_string (drivers/base/core.c:2406)
__dynamic_dev_dbg (lib/dynamic_debug.c:906)
chaoskey_release (drivers/usb/misc/chaoskey.c:323)
__fput (fs/file_table.c:510)
fput_close_sync (fs/file_table.c:615)
__x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The driver's last reference to the interface structure is dropped in
the chaoskey_free() routine, so the code must not use the interface --
even in a debugging statement -- after that routine returns.
(Exception: If we know that another reference is held by someone else,
such as the device core while the disconnect routine runs, there's no
problem. Thanks to Johan Hovold for pointing this out.)
Since the bad access is part of an unimportant debugging statement,
we can fix the problem simply by removing the whole statement.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-usb/20EC9664-054E-438B-B411-2145D347F97B@gmail.com/
Tested-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 66e3e591891d ("usb: Add driver for Altus Metrum ChaosKey device (v2)")
Cc: stable <stable@kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/bb5b1dc6-eb59-43e1-8d26-51e658e88bbe@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/chaoskey.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -320,7 +320,6 @@ bail:
mutex_unlock(&dev->lock);
destruction:
mutex_unlock(&chaoskey_list_lock);
- usb_dbg(interface, "release success");
return rv;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0137/1266] usb: dwc3: run gadget disconnect from sleepable suspend context
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0136/1266] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0138/1266] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
` (861 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Runyu Xiao, Thinh Nguyen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 010382937fb69892b3469ac4d30af072262f59e8 upstream.
dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls
dwc3_disconnect_gadget(). For async callbacks that helper only uses
plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback
still runs with IRQs disabled and any sleepable callback trips Lockdep.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the dwc3_gadget_suspend() ->
dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and
Lockdep reported:
BUG: sleeping function called from invalid context
gadget_disconnect+0x21/0x39 [vuln_msv]
dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]
Keep the disconnect callback selection in one common helper, but add a
sleepable suspend-side wrapper which snapshots the callback under
dwc->lock and then runs it after spin_unlock_irqrestore(). The regular
event path still uses the existing spin_unlock()/spin_lock() window.
Fixes: c8540870af4c ("usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume()")
Cc: stable <stable@kernel.org>
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260612052005.3849659-1-runyu.xiao@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 43 ++++++++++++++++++++++++++++++++++++-------
1 file changed, 36 insertions(+), 7 deletions(-)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3930,15 +3930,48 @@ static void dwc3_endpoint_interrupt(stru
}
}
+static bool dwc3_prepare_disconnect_gadget(struct dwc3 *dwc,
+ struct usb_gadget_driver **driver,
+ struct usb_gadget **gadget)
+{
+ if (!dwc->async_callbacks || !dwc->gadget_driver ||
+ !dwc->gadget_driver->disconnect)
+ return false;
+
+ *driver = dwc->gadget_driver;
+ *gadget = dwc->gadget;
+
+ return true;
+}
+
static void dwc3_disconnect_gadget(struct dwc3 *dwc)
{
- if (dwc->async_callbacks && dwc->gadget_driver->disconnect) {
+ struct usb_gadget_driver *driver;
+ struct usb_gadget *gadget;
+
+ if (dwc3_prepare_disconnect_gadget(dwc, &driver, &gadget)) {
spin_unlock(&dwc->lock);
- dwc->gadget_driver->disconnect(dwc->gadget);
+ driver->disconnect(gadget);
spin_lock(&dwc->lock);
}
}
+static void dwc3_disconnect_gadget_sleepable(struct dwc3 *dwc)
+{
+ struct usb_gadget_driver *driver;
+ struct usb_gadget *gadget;
+ unsigned long flags;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+ if (!dwc3_prepare_disconnect_gadget(dwc, &driver, &gadget)) {
+ spin_unlock_irqrestore(&dwc->lock, flags);
+ return;
+ }
+
+ spin_unlock_irqrestore(&dwc->lock, flags);
+ driver->disconnect(gadget);
+}
+
static void dwc3_suspend_gadget(struct dwc3 *dwc)
{
if (dwc->async_callbacks && dwc->gadget_driver->suspend) {
@@ -4818,7 +4851,6 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
int dwc3_gadget_suspend(struct dwc3 *dwc)
{
- unsigned long flags;
int ret;
ret = dwc3_gadget_soft_disconnect(dwc);
@@ -4832,10 +4864,7 @@ int dwc3_gadget_suspend(struct dwc3 *dwc
return -EAGAIN;
}
- spin_lock_irqsave(&dwc->lock, flags);
- if (dwc->gadget_driver)
- dwc3_disconnect_gadget(dwc);
- spin_unlock_irqrestore(&dwc->lock, flags);
+ dwc3_disconnect_gadget_sleepable(dwc);
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0138/1266] 6lowpan: fix NHC entry use-after-free on error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0137/1266] usb: dwc3: run gadget disconnect from sleepable suspend context Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0139/1266] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
` (860 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Alexander Aring, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit 1720db928e5a58ca7d75ac1d514c3b73fd7061a7 upstream.
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://patch.msgid.link/20260609080054.4541-1-zhaoyz24@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/6lowpan/nhc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/6lowpan/nhc.c
+++ b/net/6lowpan/nhc.c
@@ -117,9 +117,9 @@ int lowpan_nhc_do_uncompression(struct s
return ret;
}
} else {
- spin_unlock_bh(&lowpan_nhc_lock);
netdev_warn(dev, "received nhc id for %s which is not implemented.\n",
nhc->name);
+ spin_unlock_bh(&lowpan_nhc_lock);
return -ENOTSUPP;
}
} else {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0139/1266] tipc: fix out-of-bounds read in broadcast Gap ACK blocks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0138/1266] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0140/1266] staging: vme_user: bound slave read/write to the kern_buf size Greg Kroah-Hartman
` (859 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Page, Tung Nguyen,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <sam@bynar.io>
commit 2b66974a1b6134a4bbc3bfed181f7418f688eb54 upstream.
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its
data area. tipc_get_gap_ack_blks() only verifies that the record's len
field is self-consistent with its ugack_cnt/bgack_cnt counts
(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check
that the record actually fits in the message data area, msg_data_sz().
The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen)
break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the
returned size, so tipc_link_advance_transmq() copies the record off the
receive skb with an attacker-controlled count:
this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),
GFP_ATOMIC);
A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one
ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its
data area is short, carrying a Gap ACK record with len = 0x400,
bgack_cnt = 0xff and ugack_cnt = 0. len then equals
struct_size(p, gacks, 255), so the consistency check passes and ga is
non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out
of the much smaller skb:
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60
Read of size 1024 at addr ffff0000c7030d38 by task poc864/69
Call trace:
kmemdup_noprof+0x48/0x60
tipc_link_advance_transmq+0x86c/0xb80
tipc_link_bc_ack_rcv+0x19c/0x1e0
tipc_bcast_sync_rcv+0x1c4/0x2c4
tipc_rcv+0x85c/0x1340
tipc_l2_rcv_msg+0xac/0x104
The buggy address belongs to the object at ffff0000c7030d00
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 56 bytes inside of
allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)
The copied-out bytes are subsequently consumed as gap/ack values, but
the read is already out of bounds at the kmemdup() regardless of how
they are used.
The unicast STATE path drops such a message: "if (glen > dlen) break;"
skips the rest of STATE_MSG handling and the skb is freed. Make the
broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record
against msg_data_sz() and, when it does not fit, reports it back through
tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than
processed. ga is not cleared on this path: ga == NULL already means
"legacy peer without Selective ACK", a distinct legitimate state.
Fixes: d7626b5acff9 ("tipc: introduce Gap ACK blocks for broadcast link")
Cc: stable@vger.kernel.org
Signed-off-by: Samuel Page <sam@bynar.io>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260625143815.1525412-1-sam@bynar.io
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/bcast.c | 22 ++++++++++++++--------
net/tipc/bcast.h | 2 +-
net/tipc/node.c | 15 ++++++++++++---
3 files changed, 27 insertions(+), 12 deletions(-)
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -497,12 +497,13 @@ void tipc_bcast_ack_rcv(struct net *net,
*/
int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l,
struct tipc_msg *hdr,
- struct sk_buff_head *retrq)
+ struct sk_buff_head *retrq, bool *valid)
{
struct sk_buff_head *inputq = &tipc_bc_base(net)->inputq;
struct tipc_gap_ack_blks *ga;
struct sk_buff_head xmitq;
int rc = 0;
+ u16 glen;
__skb_queue_head_init(&xmitq);
@@ -510,13 +511,18 @@ int tipc_bcast_sync_rcv(struct net *net,
if (msg_type(hdr) != STATE_MSG) {
tipc_link_bc_init_rcv(l, hdr);
} else if (!msg_bc_ack_invalid(hdr)) {
- tipc_get_gap_ack_blks(&ga, l, hdr, false);
- if (!sysctl_tipc_bc_retruni)
- retrq = &xmitq;
- rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr),
- msg_bc_gap(hdr), ga, &xmitq,
- retrq);
- rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq);
+ glen = tipc_get_gap_ack_blks(&ga, l, hdr, false);
+ if (glen > msg_data_sz(hdr)) {
+ /* Malformed Gap ACK blocks; caller drops the msg */
+ *valid = false;
+ } else {
+ if (!sysctl_tipc_bc_retruni)
+ retrq = &xmitq;
+ rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr),
+ msg_bc_gap(hdr), ga, &xmitq,
+ retrq);
+ rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq);
+ }
}
tipc_bcast_unlock(net);
--- a/net/tipc/bcast.h
+++ b/net/tipc/bcast.h
@@ -97,7 +97,7 @@ void tipc_bcast_ack_rcv(struct net *net,
struct tipc_msg *hdr);
int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l,
struct tipc_msg *hdr,
- struct sk_buff_head *retrq);
+ struct sk_buff_head *retrq, bool *valid);
int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg,
struct tipc_link *bcl);
int tipc_nl_bc_link_set(struct net *net, struct nlattr *attrs[]);
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1833,12 +1833,15 @@ static void tipc_node_mcast_rcv(struct t
}
static void tipc_node_bc_sync_rcv(struct tipc_node *n, struct tipc_msg *hdr,
- int bearer_id, struct sk_buff_head *xmitq)
+ int bearer_id, struct sk_buff_head *xmitq,
+ bool *valid)
{
struct tipc_link *ucl;
int rc;
- rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq);
+ rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq, valid);
+ if (!*valid)
+ return;
if (rc & TIPC_LINK_DOWN_EVT) {
tipc_node_reset_links(n);
@@ -2142,12 +2145,18 @@ rcv:
/* Ensure broadcast reception is in synch with peer's send state */
if (unlikely(usr == LINK_PROTOCOL)) {
+ bool valid = true;
+
if (unlikely(skb_linearize(skb))) {
tipc_node_put(n);
goto discard;
}
hdr = buf_msg(skb);
- tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq);
+ tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq, &valid);
+ if (!valid) {
+ tipc_node_put(n);
+ goto discard;
+ }
} else if (unlikely(tipc_link_acked(n->bc_entry.link) != bc_ack)) {
tipc_bcast_ack_rcv(net, n->bc_entry.link, hdr);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0140/1266] staging: vme_user: bound slave read/write to the kern_buf size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0139/1266] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0141/1266] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
` (858 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Michael Tautschnig
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Tautschnig <tautschn@amazon.com>
commit 9f32f38265014fac7f5dc9490fb01a638ce6e121 upstream.
The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy
'count' bytes into/out of the fixed-size kern_buf (size_buf ==
PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without
bounding *ppos + count against size_buf.
vme_user_write()/vme_user_read() only clamp count to the VME window size
(image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the
user-supplied slave.size -- validated against the VME address space (up
to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window
exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.
Clamp count against size_buf in both helpers, with an early return when
*ppos is already at/after the buffer end. *ppos is >= 0 here (the caller
rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors
the existing clamp in the MASTER-path helpers resource_to_user() /
resource_from_user(), and matches the read()/write() convention of a
short transfer at end-of-buffer.
Found by static analysis (CodeQL taint tracking + CBMC bounded model
checking) and confirmed dynamically under KASAN with the vme_fake bridge:
BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80
Write of size 262144 at addr ffff888004100000 by task trigger/68
_copy_from_user+0x2d/0x80
vme_user_write+0x13e/0x240 [vme_user]
vfs_write+0x1b8/0x7a0
ksys_write+0xb8/0x150
Fixes: f00a86d98a1e ("Staging: vme: add VME userspace driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Michael Tautschnig <tautschn@amazon.com>
Link: https://patch.msgid.link/20260618114709.72499-1-tautschn@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/vme_user/vme_user.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/drivers/staging/vme_user/vme_user.c
+++ b/drivers/staging/vme_user/vme_user.c
@@ -153,6 +153,17 @@ static ssize_t buffer_to_user(unsigned i
{
void *image_ptr;
+ /*
+ * The slave window (image_size) can exceed the fixed kern_buf
+ * (size_buf == PCI_BUF_SIZE), so bound the copy to kern_buf.
+ * *ppos is >= 0 here (checked by the caller), so the
+ * subtraction below cannot wrap.
+ */
+ if (*ppos >= image[minor].size_buf)
+ return 0;
+ if (count > image[minor].size_buf - *ppos)
+ count = image[minor].size_buf - *ppos;
+
image_ptr = image[minor].kern_buf + *ppos;
if (copy_to_user(buf, image_ptr, (unsigned long)count))
return -EFAULT;
@@ -165,6 +176,17 @@ static ssize_t buffer_from_user(unsigned
{
void *image_ptr;
+ /*
+ * The slave window (image_size) can exceed the fixed kern_buf
+ * (size_buf == PCI_BUF_SIZE), so bound the copy to kern_buf.
+ * *ppos is >= 0 here (checked by the caller), so the
+ * subtraction below cannot wrap.
+ */
+ if (*ppos >= image[minor].size_buf)
+ return 0;
+ if (count > image[minor].size_buf - *ppos)
+ count = image[minor].size_buf - *ppos;
+
image_ptr = image[minor].kern_buf + *ppos;
if (copy_from_user(image_ptr, buf, (unsigned long)count))
return -EFAULT;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0141/1266] smb: client: restrict implied bcc[0] exemption to responses without data area
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0140/1266] staging: vme_user: bound slave read/write to the kern_buf size Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0142/1266] staging: vme_user: fix location monitor leak in fake bridge Greg Kroah-Hartman
` (857 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shoichiro Miyamoto, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
commit 53b7c271f06be4dd5cfc8c6ef552a8355c891a7f upstream.
smb2_check_message() has a long-standing quirk that accepts a response
whose calculated length is one byte larger than the bytes actually
received ("server can return one byte more due to implied bcc[0]").
This was introduced to accommodate servers that omit the trailing bcc[0]
overlap byte when no data area is present.
However, the exemption is applied unconditionally, regardless of whether
the command actually carries a data area (has_smb2_data_area[]). When a
response with a data area is subject to the +1 exemption, the reported
data can extend one byte beyond the bytes actually received, yet
smb2_check_message() still accepts it. The subsequent decoder then reads
past the end of the receive buffer. This is reachable during NEGOTIATE
and SESSION_SETUP, before the session is established.
The resulting out-of-bounds reads are visible under KASAN when mounting
against a non-conforming server; both the SPNEGO/negTokenInit and the
NTLMSSP challenge decoders are affected:
BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00
Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81
CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
asn1_ber_decoder+0x16a7/0x1b00
decode_negTokenInit+0x19/0x30
SMB2_negotiate+0x31d9/0x4c90
cifs_negotiate_protocol+0x1f2/0x3f0
cifs_get_smb_ses+0x93f/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 85:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 0 bytes to the right of
allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)
which belongs to the cache cifs_small_rq of size 448
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50
Read of size 329 at addr ffff88800726c678 by task mount.cifs/89
CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x36/0x50
decode_ntlmssp_challenge+0x457/0x680
SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0
SMB2_sess_setup+0x219/0x4f0
cifs_setup_session+0x248/0xaf0
cifs_get_smb_ses+0xf79/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 93:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 120 bytes inside of
allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)
which belongs to the cache cifs_small_rq of size 448
Restrict the +1 exemption to responses that have no data area, so that
it still covers the bcc[0] omission it was meant for. When a data area
is present, the +1 discrepancy instead means the reported data length
overruns the received buffer, so the response must be rejected.
Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
Cc: stable@vger.kernel.org
Signed-off-by: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2misc.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -18,6 +18,8 @@
#include "nterr.h"
#include "cached_dir.h"
+static unsigned int __smb2_calc_size(void *buf, bool *have_data);
+
static int
check_smb2_hdr(struct smb2_hdr *shdr, __u64 mid)
{
@@ -143,6 +145,7 @@ smb2_check_message(char *buf, unsigned i
int command;
__u32 calc_len; /* calculated length */
__u64 mid;
+ bool have_data;
/* If server is a channel, select the primary channel */
pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
@@ -226,7 +229,8 @@ smb2_check_message(char *buf, unsigned i
}
}
- calc_len = smb2_calc_size(buf);
+ have_data = false;
+ calc_len = __smb2_calc_size(buf, &have_data);
/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might
* be 0, and not a real miscalculation */
@@ -245,8 +249,13 @@ smb2_check_message(char *buf, unsigned i
/* Windows 7 server returns 24 bytes more */
if (calc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE)
return 0;
- /* server can return one byte more due to implied bcc[0] */
- if (calc_len == len + 1)
+ /*
+ * Server can return one byte more due to implied bcc[0].
+ * Allow it only when there is no data area; if data_length > 0
+ * the +1 gap indicates an overreported data length rather than
+ * the bcc[0] omission.
+ */
+ if (calc_len == len + 1 && !have_data)
return 0;
/*
@@ -407,14 +416,17 @@ smb2_get_data_area_len(int *off, int *le
/*
* Calculate the size of the SMB message based on the fixed header
* portion, the number of word parameters and the data portion of the message.
+ * If have_data is non-NULL, it is set to true when a non-empty data area was
+ * found (data_length > 0), allowing callers to distinguish the implied bcc[0]
+ * case (no data area) from an overreported data length.
*/
-unsigned int
-smb2_calc_size(void *buf)
+static unsigned int
+__smb2_calc_size(void *buf, bool *have_data)
{
struct smb2_pdu *pdu = buf;
struct smb2_hdr *shdr = &pdu->hdr;
int offset; /* the offset from the beginning of SMB to data area */
- int data_length; /* the length of the variable length data area */
+ int data_length = 0; /* the length of the variable length data area */
/* Structure Size has already been checked to make sure it is 64 */
int len = le16_to_cpu(shdr->StructureSize);
@@ -447,9 +459,17 @@ smb2_calc_size(void *buf)
}
calc_size_exit:
cifs_dbg(FYI, "SMB2 len %d\n", len);
+ if (have_data)
+ *have_data = (data_length > 0);
return len;
}
+unsigned int
+smb2_calc_size(void *buf)
+{
+ return __smb2_calc_size(buf, NULL);
+}
+
/* Note: caller must free return buffer */
__le16 *
cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0142/1266] staging: vme_user: fix location monitor leak in fake bridge
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0141/1266] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0143/1266] staging: vme_user: fix location monitor leak in tsi148 bridge Greg Kroah-Hartman
` (856 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Martyn Welch, Hao-Qun Huang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit e8422d89e8af41d87f0e9db564be8e2634f4c602 upstream.
fake_init() allocates a location monitor resource and links it into
fake_bridge->lm_resources. The init error path frees this list, but
fake_exit() only frees the slave and master resource lists. Loading
and unloading the module therefore triggers a kmemleak warning:
unreferenced object 0xffff8b8b82aebe40 (size 64):
comm "init", pid 1, jiffies 4294894572
backtrace (crc c1e013ef):
kmemleak_alloc+0x4e/0x90
__kmalloc_cache_noprof+0x338/0x430
0xffffffffc0602246
do_one_initcall+0x4f/0x320
do_init_module+0x68/0x270
load_module+0x2a3b/0x2d90
Free the lm_resources list in fake_exit() as well, before fake_bridge
is freed.
Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Cc: stable <stable@kernel.org>
Cc: Martyn Welch <martyn@welchs.me.uk>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704065817.403111-1-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/vme_user/vme_fake.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1244,6 +1244,7 @@ static void __exit fake_exit(void)
{
struct list_head *pos = NULL;
struct list_head *tmplist;
+ struct vme_lm_resource *lm;
struct vme_master_resource *master_image;
struct vme_slave_resource *slave_image;
int i;
@@ -1274,6 +1275,13 @@ static void __exit fake_exit(void)
fake_crcsr_exit(fake_bridge);
/* resources are stored in link list */
+ list_for_each_safe(pos, tmplist, &fake_bridge->lm_resources) {
+ lm = list_entry(pos, struct vme_lm_resource, list);
+ list_del(pos);
+ kfree(lm);
+ }
+
+ /* resources are stored in link list */
list_for_each_safe(pos, tmplist, &fake_bridge->slave_resources) {
slave_image = list_entry(pos, struct vme_slave_resource, list);
list_del(pos);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0143/1266] staging: vme_user: fix location monitor leak in tsi148 bridge
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0142/1266] staging: vme_user: fix location monitor leak in fake bridge Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0144/1266] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
` (855 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Martyn Welch, Hao-Qun Huang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 151edde741f8bc7f2931c5f44ab376d32b0c8beb upstream.
tsi148_probe() allocates a location monitor resource and links it into
tsi148_bridge->lm_resources. The probe error path frees this list, but
tsi148_remove() only frees the dma, slave and master resource lists, so
the location monitor resource is leaked on device unbind or module
unload.
Free the lm_resources list in tsi148_remove() as well, before
tsi148_bridge is freed.
Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Cc: stable <stable@kernel.org>
Cc: Martyn Welch <martyn@welchs.me.uk>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704065817.403111-2-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/vme_user/vme_tsi148.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/vme_user/vme_tsi148.c
+++ b/drivers/staging/vme_user/vme_tsi148.c
@@ -2538,6 +2538,7 @@ static void tsi148_remove(struct pci_dev
{
struct list_head *pos = NULL;
struct list_head *tmplist;
+ struct vme_lm_resource *lm;
struct vme_master_resource *master_image;
struct vme_slave_resource *slave_image;
struct vme_dma_resource *dma_ctrlr;
@@ -2595,6 +2596,13 @@ static void tsi148_remove(struct pci_dev
tsi148_crcsr_exit(tsi148_bridge, pdev);
/* resources are stored in link list */
+ list_for_each_safe(pos, tmplist, &tsi148_bridge->lm_resources) {
+ lm = list_entry(pos, struct vme_lm_resource, list);
+ list_del(pos);
+ kfree(lm);
+ }
+
+ /* resources are stored in link list */
list_for_each_safe(pos, tmplist, &tsi148_bridge->dma_resources) {
dma_ctrlr = list_entry(pos, struct vme_dma_resource, list);
list_del(pos);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0144/1266] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0143/1266] staging: vme_user: fix location monitor leak in tsi148 bridge Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0145/1266] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
` (854 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit c32fe4c4918c9aa49f61359e3b42619c4d8686de upstream.
If the driver's stripe information is invalid it can result in an integer
underflow. Add a range check to avoid this kind of error.
This patch fixes the following smatch error:
drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe() warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit into 65535 'acc->stripe.bds_out_stripes[1]->offset'
Cc: stable@vger.kernel.org
Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program ccs")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/staging/media/ipu3/ipu3-css-params.c
+++ b/drivers/staging/media/ipu3/ipu3-css-params.c
@@ -1770,6 +1770,8 @@ static int imgu_css_cfg_acc_stripe(struc
acc->stripe.bds_out_stripes[0].width =
ALIGN(css_pipe->rect[IPU3_CSS_RECT_BDS].width, f);
} else {
+ u32 offset;
+
/* Image processing is divided into two stripes */
acc->stripe.bds_out_stripes[0].width =
acc->stripe.bds_out_stripes[1].width =
@@ -1788,8 +1790,10 @@ static int imgu_css_cfg_acc_stripe(struc
acc->stripe.bds_out_stripes[1].width += f;
}
/* Overlap between stripes is IPU3_UAPI_ISP_VEC_ELEMS * 4 */
- acc->stripe.bds_out_stripes[1].offset =
- acc->stripe.bds_out_stripes[0].width - 2 * f;
+ offset = acc->stripe.bds_out_stripes[0].width - 2 * f;
+ if (offset > 65535)
+ return -EINVAL;
+ acc->stripe.bds_out_stripes[1].offset = offset;
}
acc->stripe.effective_stripes[0].height =
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0145/1266] staging: media: atomisp: reduce load_primary_binaries() stack usage
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0144/1266] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0146/1266] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
` (853 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Andy Shevchenko,
Sakari Ailus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit f4d51e55dd47ef467fbe37d8575e20eee41b092d upstream.
The load_primary_binaries() function is overly complex and has som large
variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN
setting:
drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':
drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Half of the stack usage is for the prim_descr[] array, but only one
member of the array is used at any given time.
Reduce the stack usage by turning the array into a single structure.
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -5224,7 +5224,6 @@ static int load_primary_binaries(
struct ia_css_capture_settings *mycs;
unsigned int i;
bool need_extra_yuv_scaler = false;
- struct ia_css_binary_descr prim_descr[MAX_NUM_PRIMARY_STAGES];
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
@@ -5394,15 +5393,16 @@ static int load_primary_binaries(
/* Primary */
for (i = 0; i < mycs->num_primary_stage; i++) {
+ struct ia_css_binary_descr prim_descr;
struct ia_css_frame_info *local_vf_info = NULL;
if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0] &&
(i == mycs->num_primary_stage - 1))
local_vf_info = &vf_info;
- ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr[i],
+ ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr,
&prim_in_info, &prim_out_info,
local_vf_info, i);
- err = ia_css_binary_find(&prim_descr[i], &mycs->primary_binary[i]);
+ err = ia_css_binary_find(&prim_descr, &mycs->primary_binary[i]);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0146/1266] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0145/1266] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0147/1266] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
` (852 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Alexandru Hossu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit 5a752a616e756844388a1a45404db9fc29fec655 upstream.
supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-4-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -1457,6 +1457,10 @@ static int rtw_cfg80211_set_wpa_ie(struc
pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
if (pwpa && wpa_ielen > 0) {
+ if (wpa_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa_ie(pwpa, wpa_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1466,6 +1470,10 @@ static int rtw_cfg80211_set_wpa_ie(struc
pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
if (pwpa2 && wpa2_ielen > 0) {
+ if (wpa2_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0147/1266] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0146/1266] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0148/1266] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Greg Kroah-Hartman
` (851 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexandru Hossu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit a1fc19d61f661d47204f095b593de507884849f7 upstream.
OnAuth() has two bugs in the shared-key authentication path.
When the Privacy bit is set, rtw_wep_decrypt() is called without
verifying that the frame is long enough to contain a valid WEP IV and
ICV. Inside rtw_wep_decrypt(), length is computed as:
length = len - WLAN_HDR_A3_LEN - iv_len
and then passed as (length - 4) to crc32_le(). If len is less than
WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative
and, after the implicit cast to size_t, causes crc32_le() to read far
beyond the frame buffer. Add a minimum length check before accessing
the IV field and calling the decryption path.
When processing a seq=3 response, rtw_get_ie() stores the Challenge
Text IE length in ie_len, but the subsequent memcmp() always reads 128
bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of
exactly 128 bytes; reject any IE whose length field differs, matching
the check already applied to OnAuthClient().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004605.1039209-1-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -695,6 +695,9 @@ unsigned int OnAuth(struct adapter *pada
if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
return _FAIL;
+ if (len < WLAN_HDR_A3_LEN)
+ return _FAIL;
+
sa = GetAddr2Ptr(pframe);
auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -706,6 +709,9 @@ unsigned int OnAuth(struct adapter *pada
prxattrib->hdrlen = WLAN_HDR_A3_LEN;
prxattrib->encrypt = _WEP40_;
+ if (len < WLAN_HDR_A3_LEN + 8)
+ return _FAIL;
+
iv = pframe+prxattrib->hdrlen;
prxattrib->key_index = ((iv[3]>>6)&0x3);
@@ -810,7 +816,7 @@ unsigned int OnAuth(struct adapter *pada
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
- if (!p || ie_len <= 0) {
+ if (!p || ie_len != 128) {
status = WLAN_STATUS_CHALLENGE_FAIL;
goto auth_fail;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0148/1266] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0147/1266] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0149/1266] staging: rtl8723bs: fix OOB read in update_beacon_info() " Greg Kroah-Hartman
` (850 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexandru Hossu, Luka Gejak
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit f9654207e92283e0acac5d64fe5f8835383b5a23 upstream.
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260522004531.1038924-6-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -1425,7 +1425,11 @@ unsigned int OnAssocRsp(struct adapter *
/* to handle HT, WMM, rate adaptive, update MAC reg */
/* for not to handle the synchronous IO in the tasklet */
for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
+ if (i + sizeof(*pIE) > pkt_len)
+ break;
pIE = (struct ndis_80211_var_ie *)(pframe + i);
+ if (i + sizeof(*pIE) + pIE->length > pkt_len)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0149/1266] staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0148/1266] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0150/1266] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
` (849 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Alexandru Hossu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit ed51de4a86e173c3b0ef78e039c2e49e08b11f16 upstream.
The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1332,7 +1332,11 @@ void update_beacon_info(struct adapter *
len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
for (i = 0; i < len;) {
+ if (i + sizeof(*pIE) > len)
+ break;
pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+ if (i + sizeof(*pIE) + pIE->length > len)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
@@ -1357,7 +1361,7 @@ void update_beacon_info(struct adapter *
break;
}
- i += (pIE->length + 2);
+ i += sizeof(*pIE) + pIE->length;
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0150/1266] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0149/1266] staging: rtl8723bs: fix OOB read in update_beacon_info() " Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0151/1266] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Greg Kroah-Hartman
` (848 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Alexandru Hossu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit ef61d628dfad38fead1fd2e08979ae9126d011d5 upstream.
Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the
association request. If the stored IE data ends with only an
element_id byte and no length byte, pIE->length is read one byte
past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has
the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -2966,7 +2966,11 @@ void issue_assocreq(struct adapter *pada
/* vendor specific IE, such as WPA, WMM, WPS */
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
+ if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+ break;
pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
+ if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
@@ -5371,7 +5375,11 @@ u8 join_cmd_hdl(struct adapter *padapter
/* sizeof(struct ndis_802_11_fix_ie) */
for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
+ if (i + sizeof(*pIE) > pnetwork->ie_length)
+ break;
pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);
+ if (i + sizeof(*pIE) + pIE->length > pnetwork->ie_length)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0151/1266] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0150/1266] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0152/1266] staging: rtl8723bs: fix OOB write in HT_caps_handler() Greg Kroah-Hartman
` (847 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexandru Hossu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit 3bf39f711ff27c64be8680a8938bcc5001982e81 upstream.
The loop in is_ap_in_tkip() iterates over IEs without verifying that
enough bytes remain before dereferencing the IE header or its payload:
- pIE->element_id and pIE->length are read without checking that
i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the
buffer causes an OOB read.
- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12,
which requires pIE->length >= 16. For WLAN_EID_RSN it compares
pIE->data + 8, requiring pIE->length >= 12. Neither requirement
is checked.
Add the missing IE header and payload bounds checks and guard each
data access with an explicit pIE->length minimum, matching the
pattern established in update_beacon_info().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-7-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1377,15 +1377,23 @@ unsigned int is_ap_in_tkip(struct adapte
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
+ if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+ break;
+ if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+ break;
+
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
- if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) && (!memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4)))
+ if (pIE->length >= 16 &&
+ !memcmp(pIE->data, RTW_WPA_OUI, 4) &&
+ !memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4))
return true;
break;
case WLAN_EID_RSN:
- if (!memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
+ if (pIE->length >= 12 &&
+ !memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
return true;
break;
@@ -1393,7 +1401,7 @@ unsigned int is_ap_in_tkip(struct adapte
break;
}
- i += (pIE->length + 2);
+ i += sizeof(*pIE) + pIE->length;
}
return false;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0152/1266] staging: rtl8723bs: fix OOB write in HT_caps_handler()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0151/1266] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0153/1266] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
` (846 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexandru Hossu, Luka Gejak
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
commit f8001e1a516ba3b495728c65b61f799cbfad6bd0 upstream.
HT_caps_handler() iterates pIE->length bytes and writes into
HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct
HT_caps_element). Because pIE->length is a raw u8 from an over-the-air
802.11 AssocResponse frame and is never validated, a malicious AP can
set it up to 255, causing up to 229 bytes of out-of-bounds writes into
adjacent fields of struct mlme_ext_info.
Truncate the iteration count to the size of HT_caps.u.HT_cap using
umin() so that data from a longer-than-expected IE is silently ignored
rather than written out of bounds, preserving interoperability with APs
that pad the element. An early return on oversized IEs was considered
but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1
assignment that precedes the loop, silently disabling HT mode for APs
that append extra bytes to the HT Capabilities IE.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260522004531.1038924-5-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -979,7 +979,8 @@ void HT_caps_handler(struct adapter *pad
pmlmeinfo->HT_caps_enable = 1;
- for (i = 0; i < (pIE->length); i++) {
+ for (i = 0; i < umin(pIE->length,
+ sizeof(pmlmeinfo->HT_caps.u.HT_cap)); i++) {
if (i != 2) {
/* Commented by Albert 2010/07/12 */
/* Got the endian issue here. */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0153/1266] crypto: amlogic - avoid double cleanup in meson_crypto_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0152/1266] staging: rtl8723bs: fix OOB write in HT_caps_handler() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0154/1266] ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Greg Kroah-Hartman
` (845 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zilin Guan, Dawei Feng, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 6d827ade51a24e18d81afb9f32756d339520a14c upstream.
When meson_allocate_chanlist() fails after a partial allocation, it already
unwinds the allocated chanlist state through its local error path.
meson_crypto_probe() then jump to error_flow and calls
meson_free_chanlist() again, causing the same per-flow resources to be torn
down twice. In the reproduced failure path, the second teardown
re-entered crypto_engine_exit() on an already destroyed worker and KASAN
reported a slab-use-after-free in kthread_destroy_worker().
Prevent double-free by handling partial allocation failures locally within
meson_allocate_chanlist() and skipping the outer cleanup path.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available.
The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,
using the reproducer under tools/testing/meson_crypto_probe. The reproducer
forces the second dma_alloc_attrs() call in the gxl-crypto probe path to
return NULL, making meson_allocate_chanlist() fail after partial
initialization. On the unpatched kernel this reliably triggered a
slab-use-after-free. With this fix applied, the same reproducer no longer
emits any KASAN report and the probe fails cleanly with -ENOMEM.
==================================================================
BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0
Read of size 8 at addr ff1100010c057a68 by task insmod/265
CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0xa0
print_report+0xcb/0x5e0
? __virt_addr_valid+0x21d/0x3f0
? kthread_destroy_worker+0xb2/0xd0
? kthread_destroy_worker+0xb2/0xd0
kasan_report+0xca/0x100
? kthread_destroy_worker+0xb2/0xd0
kthread_destroy_worker+0xb2/0xd0
meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]
platform_probe+0x99/0x140
really_probe+0x1c6/0x6a0
? __pfx___device_attach_driver+0x10/0x10
__driver_probe_device+0x248/0x310
? acpi_driver_match_device+0xb0/0x100
driver_probe_device+0x48/0x210
? __pfx___device_attach_driver+0x10/0x10
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x104/0x190
? __pfx_bus_for_each_drv+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
__device_attach+0x19d/0x3b0
? __pfx___device_attach+0x10/0x10
? do_raw_spin_unlock+0x53/0x220
device_initial_probe+0x78/0xa0
bus_probe_device+0x5b/0x130
device_add+0xcfd/0x1430
? __pfx_device_add+0x10/0x10
? insert_resource+0x34/0x50
? lock_release+0xc9/0x290
platform_device_add+0x24e/0x590
? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]
meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]
do_one_initcall+0xc0/0x450
? __pfx_do_one_initcall+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
? __create_object+0x59/0x80
? kasan_unpoison+0x27/0x60
do_init_module+0x27b/0x7d0
? __pfx_do_init_module+0x10/0x10
? kasan_quarantine_put+0x84/0x1d0
? kfree+0x32c/0x510
? load_module+0x561e/0x5ff0
load_module+0x54fe/0x5ff0
? __pfx_load_module+0x10/0x10
? security_file_permission+0x20/0x40
? kernel_read_file+0x23d/0x6e0
? mmap_region+0x235/0x4a0
? __pfx_kernel_read_file+0x10/0x10
? __file_has_perm+0x2c0/0x3e0
init_module_from_file+0x158/0x180
? __pfx_init_module_from_file+0x10/0x10
? __lock_acquire+0x45a/0x1ba0
? idempotent_init_module+0x315/0x610
? lock_release+0xc9/0x290
? lockdep_init_map_type+0x4b/0x220
? do_raw_spin_unlock+0x53/0x220
idempotent_init_module+0x330/0x610
? __pfx_idempotent_init_module+0x10/0x10
? __pfx_cred_has_capability.isra.0+0x10/0x10
? ksys_mmap_pgoff+0x385/0x520
__x64_sys_finit_module+0xbe/0x120
do_syscall_64+0x115/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7d6d31690d
Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f3 b4 0f 00 f7 d8 >
RSP: 002b:00007fffc027ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055f7b81967c0 RCX: 00007f7d6d31690d
RDX: 0000000000000000 RSI: 000055f79a0d6cd2 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 000055f79a0d6cd2
R13: 000055f7b8196790 R14: 000055f79a0d5888 R15: 000055f7b81968e0
</TASK>
Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -293,8 +293,8 @@ static int meson_crypto_probe(struct pla
return 0;
error_alg:
meson_unregister_algs(mc);
-error_flow:
meson_free_chanlist(mc, MAXFLOW - 1);
+error_flow:
clk_disable_unprepare(mc->busclk);
return err;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0154/1266] ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0153/1266] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0155/1266] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
` (844 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 10f293a07f9e10e988b0ae44e2e99c631f5a68e0 upstream.
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on
double SMB2_CANCEL") made smb2_cancel() skip a work whose state is
KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But
KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same
freeing producer path is reached for CLOSED too:
SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets
the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()
worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s
the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes
the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the
cancelled branch, skips release_async_work(). The work stays on
conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock
pointing at the freed file_lock.
A subsequent SMB2_CANCEL for the same AsyncId then passes the
KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so
smb2_cancel() fires cancel_fn again over the freed file_lock -- the same
use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:
BUG: KASAN: slab-use-after-free in __locks_delete_block
__locks_delete_block
locks_delete_block
ksmbd_vfs_posix_lock_unblock
smb2_remove_blocked_lock
smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn
handle_ksmbd_work
Allocated by ...: locks_alloc_lock <- smb2_lock
Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit)
... cache file_lock_cache of size 192
Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with
KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is
silent on that kernel, so the splat is attributable to the CLOSE trigger.
Only an ACTIVE deferred work may have its cancel_fn fired: both terminal
states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees
the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE
so any non-active work is skipped.
Fixes: f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL")
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7254,14 +7254,14 @@ int smb2_cancel(struct ksmbd_work *work)
continue;
/*
- * A cancelled deferred byte-range lock frees its
- * file_lock and takes the smb2_lock() early-exit that
- * skips release_async_work(), so the work stays on
- * conn->async_requests with a live cancel_fn pointing
- * at the freed file_lock. Re-firing it on a second
- * SMB2_CANCEL is a use-after-free.
+ * Only an ACTIVE deferred work may have its cancel_fn
+ * fired. A CANCELLED or CLOSED work already took the
+ * smb2_lock() non-ACTIVE early-exit that frees the
+ * file_lock and skips release_async_work(), so it is
+ * still on conn->async_requests with a live cancel_fn
+ * pointing at the freed file_lock.
*/
- if (iter->state == KSMBD_WORK_CANCELLED)
+ if (iter->state != KSMBD_WORK_ACTIVE)
break;
ksmbd_debug(SMB,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0155/1266] net: af_key: initialize alg_key_len for IPComp states
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0154/1266] ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0156/1266] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
` (843 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijing Yin, Sabrina Dubroca,
Steffen Klassert
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <yzjaurora@gmail.com>
commit d129c3177d7b1138fd5066fcc63a698b3ba415b0 upstream.
pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by
allocating x->calg and copying only the algorithm name:
x->calg = kmalloc_obj(*x->calg);
if (!x->calg) {
err = -ENOMEM;
goto out;
}
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
Unlike the authentication (x->aalg) and encryption (x->ealg) branches of
the same function, the compression branch never initializes
calg->alg_key_len. IPComp carries no key and the allocation only
reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field
is left containing uninitialized slab data.
calg->alg_key_len is later used as a length by xfrm_algo_clone() when an
IPComp state is cloned during XFRM_MSG_MIGRATE:
xfrm_state_migrate()
xfrm_state_clone_and_setup()
x->calg = xfrm_algo_clone(orig->calg);
kmemdup(orig, xfrm_alg_len(orig));
where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With
a non-zero garbage alg_key_len, kmemdup() reads past the end of the
68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating
it triggers (net-next, KASAN, init_on_alloc=0):
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60
Read of size 4164 at addr ff11000025a74980 by task diag2/9287
CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1
Call Trace:
<TASK>
dump_stack_lvl+0x10e/0x1f0
print_report+0xf7/0x600
kasan_report+0xe4/0x120
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x44/0x60
xfrm_state_migrate+0x70a/0x1da0
xfrm_migrate+0x753/0x18a0
xfrm_do_migrate+0xb47/0xf10
xfrm_user_rcv_msg+0x411/0xb50
netlink_rcv_skb+0x158/0x420
xfrm_netlink_rcv+0x71/0x90
netlink_unicast+0x584/0x850
netlink_sendmsg+0x8b0/0xdc0
____sys_sendmsg+0x9f7/0xb90
___sys_sendmsg+0x134/0x1d0
__sys_sendmsg+0x16d/0x220
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 9287:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
pfkey_add+0x2652/0x2ea0
pfkey_process+0x6d0/0x830
pfkey_sendmsg+0x42c/0x850
__sys_sendto+0x461/0x4b0
__x64_sys_sendto+0xe0/0x1c0
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ff11000025a74980
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
allocated 68-byte region [ff11000025a74980, ff11000025a749c4)
Depending on the uninitialized value the same field can instead request
an oversized kmemdup() allocation and make the migration clone fail.
The XFRM netlink path is not affected: verify_one_alg() rejects an
XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via
XFRM_MSG_NEWSA is always self-consistent.
Initialize calg->alg_key_len to 0, matching the aalg/ealg branches.
Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Cc: stable@vger.kernel.org
Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1218,6 +1218,7 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
strcpy(x->calg->alg_name, a->name);
+ x->calg->alg_key_len = 0;
x->props.calgo = sa->sadb_sa_encrypt;
} else {
int keysize = 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0156/1266] audit: Fix data races of skb_queue_len() readers on audit_queue
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0155/1266] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0157/1266] Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Greg Kroah-Hartman
` (842 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Wang, Ricardo Robaina,
Paul Moore
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Wang <wangchi@kylinos.cn>
commit c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7 upstream.
Multiple readers access audit_queue.qlen via skb_queue_len() without
holding the queue lock or using READ_ONCE(), while kauditd writes to
this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE()
protected by a spinlock. This constitutes data races.
All affected skb_queue_len(&audit_queue) call sites:
- kauditd_thread() wait_event_freezable() condition
- audit_receive_msg() AUDIT_GET handler (s.backlog assignment)
- audit_receive() backlog check
- audit_log_start() backlog check and pr_warn()
KCSAN reports the following conflicting access pattern (one example):
==================================================================
BUG: KCSAN: data-race in audit_log_start / skb_dequeue
write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:
skb_dequeue+0x70/0xf0
kauditd_send_queue+0x71/0x220
kauditd_thread+0x1cb/0x430
kthread+0x1c2/0x210
ret_from_fork+0x162/0x1a0
ret_from_fork_asm+0x1a/0x30
read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:
audit_log_start+0x2a0/0x6b0
audit_core_dumps+0x64/0xa0
do_coredump+0x14b/0x1260
get_signal+0xeb2/0xf70
arch_do_signal_or_restart+0x41/0x170
exit_to_user_mode_loop+0xa2/0x1c0
do_syscall_64+0x1a3/0x1c0
entry_SYSCALL_64_after_hwframe+0x76/0xe0
value changed: 0x00000001 -> 0x00000000
==================================================================
Resolve the race by switching to lockless helper skb_queue_len_lockless(),
which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE()
write accesses already present on the writer side.
Cc: stable@vger.kernel.org
Fixes: 3197542482df ("audit: rework audit_log_start()")
Signed-off-by: Chi Wang <wangchi@kylinos.cn>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
[PM: line length tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/audit.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -909,7 +909,7 @@ main_queue:
* do the multicast send and rotate records from the
* main queue to the retry/hold queues */
wait_event_freezable(kauditd_wait,
- (skb_queue_len(&audit_queue) ? 1 : 0));
+ (skb_queue_len_lockless(&audit_queue) ? 1 : 0));
}
return 0;
@@ -1244,7 +1244,7 @@ static int audit_receive_msg(struct sk_b
s.rate_limit = audit_rate_limit;
s.backlog_limit = audit_backlog_limit;
s.lost = atomic_read(&audit_lost);
- s.backlog = skb_queue_len(&audit_queue);
+ s.backlog = skb_queue_len_lockless(&audit_queue);
s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL;
s.backlog_wait_time = audit_backlog_wait_time;
s.backlog_wait_time_actual = atomic_read(&audit_backlog_wait_time_actual);
@@ -1585,7 +1585,7 @@ static void audit_receive(struct sk_buff
/* can't block with the ctrl lock, so penalize the sender now */
if (audit_backlog_limit &&
- (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ (skb_queue_len_lockless(&audit_queue) > audit_backlog_limit)) {
DECLARE_WAITQUEUE(wait, current);
/* wake kauditd to try and flush the queue */
@@ -1887,7 +1887,7 @@ struct audit_buffer *audit_log_start(str
long stime = audit_backlog_wait_time;
while (audit_backlog_limit &&
- (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ (skb_queue_len_lockless(&audit_queue) > audit_backlog_limit)) {
/* wake kauditd to try and flush the queue */
wake_up_interruptible(&kauditd_wait);
@@ -1907,7 +1907,7 @@ struct audit_buffer *audit_log_start(str
} else {
if (audit_rate_check() && printk_ratelimit())
pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
- skb_queue_len(&audit_queue),
+ skb_queue_len_lockless(&audit_queue),
audit_backlog_limit);
audit_log_lost("backlog limit exceeded");
return NULL;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0157/1266] Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0156/1266] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0158/1266] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
` (841 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Samuel Page, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <sam@bynar.io>
commit fa85d985f614bc3feb343000f14a1072e99b0df1 upstream.
add_device_complete() runs from the hci_cmd_sync_work kworker, which
holds only hci_req_sync_lock and *not* hci_dev_lock. It calls
hci_conn_params_lookup() and then dereferences the returned object
(params->flags) without taking hci_dev_lock:
params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
le_addr_type(cp->addr.type));
...
device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
cp->addr.type, hdev->conn_flags,
params ? params->flags : 0);
hci_conn_params_lookup() walks hdev->le_conn_params and is documented to
require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE
(remove_device()), which does run under hci_dev_lock, can call
hci_conn_params_free() to list_del() and kfree() the very object the
lookup returned, so the subsequent params->flags read touches freed
memory [0].
Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of
params->flags (and the matching event emission) so the lookup result
cannot be freed by a concurrent remove_device() before it is used,
honouring the locking contract of hci_conn_params_lookup().
[0]: (trailing page/memory-state dump trimmed)
BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671
Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388
CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT
Hardware name: linux,dummy-virt (DT)
Workqueue: hci0 hci_cmd_sync_work
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xb4/0xd4 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x118/0x5d8 mm/kasan/report.c:482
kasan_report+0xb0/0xf4 mm/kasan/report.c:595
__asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378
add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671
hci_cmd_sync_work+0x14c/0x240 net/bluetooth/hci_sync.c:334
process_one_work+0x628/0xd38 kernel/workqueue.c:3289
process_scheduled_works kernel/workqueue.c:3372 [inline]
worker_thread+0x7a8/0xac0 kernel/workqueue.c:3453
kthread+0x39c/0x444 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Allocated by task 3401:
kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57
kasan_save_track+0x20/0x3c mm/kasan/common.c:78
kasan_save_alloc_info+0x40/0x54 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xd4/0xd8 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x1b0/0x458 mm/slub.c:5385
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
hci_conn_params_add+0x10c/0x4b0 net/bluetooth/hci_core.c:2279
hci_conn_params_set net/bluetooth/mgmt.c:5162 [inline]
add_device+0x5b4/0xa54 net/bluetooth/mgmt.c:7755
hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline]
hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0xe0/0x128 net/socket.c:742
sock_write_iter+0x250/0x390 net/socket.c:1195
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x66c/0xab0 fs/read_write.c:688
ksys_write+0x1fc/0x24c fs/read_write.c:740
__do_sys_write fs/read_write.c:751 [inline]
__se_sys_write fs/read_write.c:748 [inline]
__arm64_sys_write+0x70/0xa4 fs/read_write.c:748
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151
el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Freed by task 3740:
kasan_save_stack+0x3c/0x64 mm/kasan/common.c:57
kasan_save_track+0x20/0x3c mm/kasan/common.c:78
kasan_save_free_info+0x4c/0x74 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x88/0xb8 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6170 [inline]
kfree+0x14c/0x458 mm/slub.c:6488
hci_conn_params_free+0x288/0x484 net/bluetooth/hci_core.c:2312
remove_device+0x4b0/0x968 net/bluetooth/mgmt.c:7919
hci_mgmt_cmd net/bluetooth/hci_sock.c:1721 [inline]
hci_sock_sendmsg+0x10b4/0x1dd0 net/bluetooth/hci_sock.c:1841
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0xe0/0x128 net/socket.c:742
sock_write_iter+0x250/0x390 net/socket.c:1195
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x66c/0xab0 fs/read_write.c:688
ksys_write+0x1fc/0x24c fs/read_write.c:740
__do_sys_write fs/read_write.c:751 [inline]
__se_sys_write fs/read_write.c:748 [inline]
__arm64_sys_write+0x70/0xa4 fs/read_write.c:748
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x44/0x5c arch/arm64/kernel/syscall.c:151
el0_svc+0x38/0xac arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Fixes: 1e2e3044c1bc ("Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Samuel Page <sam@bynar.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/mgmt.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7732,6 +7732,8 @@ static void add_device_complete(struct h
if (!err) {
struct hci_conn_params *params;
+ hci_dev_lock(hdev);
+
params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
le_addr_type(cp->addr.type));
@@ -7740,6 +7742,7 @@ static void add_device_complete(struct h
device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
cp->addr.type, hdev->conn_flags,
params ? params->flags : 0);
+ hci_dev_unlock(hdev);
}
mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0158/1266] debugobjects: Plug race against a concurrent OOM disable
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0157/1266] Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0159/1266] fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Greg Kroah-Hartman
` (840 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5e8dda76ca21dae314b6,
Thomas Gleixner
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@kernel.org>
commit b81dde13cc163450dcb402dcc915ef13ba241e01 upstream.
syzbot reported a puzzling splat:
WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20
stub_timer() is installed as timer callback function in
hrtimer_fixup_assert_init(), which is invoked when
debug_object_assert_init() can't find a shadow object. In that case debug
objects emits a warning about it before invoking the fixup.
Though the provided console log lacks this warning and instead has the
following a few seconds before the splat:
ODEBUG: Out of memory. ODEBUG disabled
So the object was looked up in debug_object_assert_init() and the lookup
failed due a concurrent out of memory situation which disabled debug
objects and freed the shadow objects:
debug_object_assert_init()
if (!debug_objects_enabled)
return; obj = alloc();
if (!obj) {
// Out of memory
debug_objects_enabled = false;
free_objects();
obj = lookup_or_alloc();
// The lookup failed because the other side
// removed the objects, so this returns
// an error code as the object in question
// is not statically initialized
if (!IS_ERR_OR_NULL(obj))
return;
if (!obj) {
debug_oom();
return;
}
print(...)
if (!debug_objects_enabled)
return;
fixup(...)
The debug object splat is skipped because debug_objects_enabled is false,
but the fixup callback is invoked unconditionally, which makes the timer
disfunctional.
This is only a problem in debug_object_assert_init() and
debug_object_activate() as both have to handle statically initialized
objects and therefore must handle the error pointer return case
gracefully. All other places only handle the found/not found case and the
NULL pointer return is a signal for OOM. Otherwise they get a valid shadow
object.
Plug the hole by checking whether debug objects are still enabled before
invoking the print and fixup function in those two places.
Fixes: b84d435cc228 ("debugobjects: Extend to assert that an object is initialized")
Reported-by: syzbot+5e8dda76ca21dae314b6@syzkaller.appspotmail.com
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/874iiwlzlb.ffs@fw13
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/debugobjects.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -768,6 +768,14 @@ int debug_object_activate(void *addr, co
}
raw_spin_unlock_irqrestore(&db->lock, flags);
+
+ /*
+ * lookup_object_or_alloc() might have raced with a concurrent
+ * allocation failure which disabled debug objects.
+ */
+ if (!debug_objects_enabled)
+ return 0;
+
debug_print_object(&o, "activate");
switch (o.state) {
@@ -945,6 +953,15 @@ void debug_object_assert_init(void *addr
return;
}
+ /*
+ * lookup_object_or_alloc() might have raced with a concurrent
+ * allocation failure which disabled debug objects. Don't run the fixup
+ * as it might turn a valid object useless. See for example
+ * hrtimer_fixup_assert_init().
+ */
+ if (!debug_objects_enabled)
+ return;
+
/* Object is neither tracked nor static. It's not initialized. */
debug_print_object(&o, "assert_init");
debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0159/1266] fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0158/1266] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0160/1266] NTB: epf: Avoid calling pci_irq_vector() from hardirq context Greg Kroah-Hartman
` (839 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunpeng Tian, Mingda Zhang,
Gongming Wang, Peiyuan Xu, Qinrun Dai, Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunpeng Tian <shionthanatos@gmail.com>
commit 57382ec6ac63b63dce2789e835fded28b698ae79 upstream.
In the analysis pass of $LogFile journal replay, log_replay() copies
LCNs from each action log record into an existing Dirty Page Table
(DPT) entry without bounding the destination index. A crafted NTFS
image with DPT entry lcns_follow=1 and an action log record with
lcns_follow=2 produces a kernel slab out-of-bounds write at mount
time:
BUG: KASAN: slab-out-of-bounds in log_replay+0x654c/0xdb60
Write of size 8 at addr ffff8880095e1040 by task mount
Two attacker-controlled fields can drive j+i past the allocated
page_lcns[] array:
1. dp->lcns_follow (capacity) can be smaller than lrh->lcns_follow.
2. lrh->target_vcn may be smaller than dp->vcn, making the u64
subtraction wrap to a huge size_t.
Validate target VCN delta and per-record LCN count against the
DPT entry capacity, bail via the existing out: cleanup label with
-EINVAL.
This mirrors the bounds-check pattern added in commit b2bc7c44ed17
("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot")
and commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in
journal-replay file record check").
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Peiyuan Xu <paulbucket12@gmail.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yunpeng Tian <shionthanatos@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -4549,11 +4549,21 @@ copy_lcns:
* whole routine a loop, case Lcns do not fit below.
*/
t16 = le16_to_cpu(lrh->lcns_follow);
- for (i = 0; i < t16; i++) {
- size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
- le64_to_cpu(dp->vcn));
- dp->page_lcns[j + i] = lrh->page_lcns[i];
- }
+ t32 = le32_to_cpu(dp->lcns_follow);
+ if (le64_to_cpu(lrh->target_vcn) < le64_to_cpu(dp->vcn)) {
+ err = -EINVAL;
+ goto out;
+ }
+
+ for (i = 0; i < t16; i++) {
+ size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
+ le64_to_cpu(dp->vcn));
+ if (j >= t32 || i >= t32 - j) {
+ err = -EINVAL;
+ goto out;
+ }
+ dp->page_lcns[j + i] = lrh->page_lcns[i];
+ }
goto next_log_record_analyze;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0160/1266] NTB: epf: Avoid calling pci_irq_vector() from hardirq context
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0159/1266] fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0161/1266] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
` (838 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Manivannan Sadhasivam,
Bjorn Helgaas, Dave Jiang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit 4dcddc1c794d1c65eda68f1f8dd04a0fecc0870f upstream.
ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive
the vector number. pci_irq_vector() calls msi_get_virq() that takes a
mutex and can therefore trigger "scheduling while atomic" splats:
BUG: scheduling while atomic: kworker/u33:0/55/0x00010001
...
Call trace:
...
schedule+0x38/0x110
schedule_preempt_disabled+0x28/0x50
__mutex_lock.constprop.0+0x848/0x908
__mutex_lock_slowpath+0x18/0x30
mutex_lock+0x4c/0x60
msi_domain_get_virq+0xe8/0x138
pci_irq_vector+0x2c/0x60
ntb_epf_vec_isr+0x28/0x120 [ntb_hw_epf]
__handle_irq_event_percpu+0x70/0x3a8
handle_irq_event+0x48/0x100
handle_edge_irq+0x100/0x1c8
...
Cache the Linux IRQ number for vector 0 when vectors are allocated and
use it as a base in the ISR. Running the ISR in a threaded IRQ handler
would also avoid the problem, but that would be unnecessary here.
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Cc: stable@vger.kernel.org # v5.12+
Link: https://patch.msgid.link/20260304083028.1391068-3-den@valinux.co.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -92,6 +92,7 @@ struct ntb_epf_dev {
int db_val;
u64 db_valid_mask;
+ int irq_base;
};
#define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
@@ -318,7 +319,7 @@ static irqreturn_t ntb_epf_vec_isr(int i
struct ntb_epf_dev *ndev = dev;
int irq_no;
- irq_no = irq - pci_irq_vector(ndev->ntb.pdev, 0);
+ irq_no = irq - ndev->irq_base;
ndev->db_val = irq_no + 1;
if (irq_no == 0)
@@ -350,6 +351,7 @@ static int ntb_epf_init_isr(struct ntb_e
argument &= ~MSIX_ENABLE;
}
+ ndev->irq_base = pci_irq_vector(pdev, 0);
for (i = 0; i < irq; i++) {
ret = request_irq(pci_irq_vector(pdev, i), ntb_epf_vec_isr,
0, "ntb_epf", ndev);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0161/1266] gpio: eic-sprd: use raw_spinlock_t in the irq startup path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0160/1266] NTB: epf: Avoid calling pci_irq_vector() from hardirq context Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0162/1266] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
` (837 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao,
Sebastian Andrzej Siewior, Bartosz Golaszewski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 90f0109019e6817eb40a486671b7722d1544ae29 upstream.
sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
state through sprd_eic_update(), which takes sprd_eic->lock with
spin_lock_irqsave(). The callback can be reached from irq_startup()
while setting up a requested IRQ. That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and
used the original spin_lock_irqsave(&sprd_eic->lock) edge. Lockdep
reported:
BUG: sleeping function called from invalid context
hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]
sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]
__setup_irq.constprop.0+0xd/0x30 [vuln_msv]
Convert the Spreadtrum EIC controller lock to raw_spinlock_t. The
locked section only serializes MMIO register updates and does not contain
sleepable operations, so keeping it non-sleeping is appropriate for the
irqchip callbacks.
Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260617154035.1199948-3-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-eic-sprd.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -93,7 +93,7 @@ struct sprd_eic {
struct gpio_chip chip;
void __iomem *base[SPRD_EIC_MAX_BANK];
enum sprd_eic_type type;
- spinlock_t lock;
+ raw_spinlock_t lock;
int irq;
};
@@ -145,7 +145,7 @@ static void sprd_eic_update(struct gpio_
unsigned long flags;
u32 tmp;
- spin_lock_irqsave(&sprd_eic->lock, flags);
+ raw_spin_lock_irqsave(&sprd_eic->lock, flags);
tmp = readl_relaxed(base + reg);
if (val)
@@ -154,7 +154,7 @@ static void sprd_eic_update(struct gpio_
tmp &= ~BIT(SPRD_EIC_BIT(offset));
writel_relaxed(tmp, base + reg);
- spin_unlock_irqrestore(&sprd_eic->lock, flags);
+ raw_spin_unlock_irqrestore(&sprd_eic->lock, flags);
}
static int sprd_eic_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
@@ -618,7 +618,7 @@ static int sprd_eic_probe(struct platfor
if (!sprd_eic)
return -ENOMEM;
- spin_lock_init(&sprd_eic->lock);
+ raw_spin_lock_init(&sprd_eic->lock);
sprd_eic->type = pdata->type;
sprd_eic->irq = platform_get_irq(pdev, 0);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0162/1266] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0161/1266] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
@ 2026-07-21 15:09 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0163/1266] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
` (836 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jens Axboe
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 29bef9934b2521f787bb15dd1985d4c0d12ae02a upstream.
commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work
run loop") fixed the obvious case where io_worker_handle_work() took one
exit-bit snapshot before draining pending work, but the fix stops one
level too early.
io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work
run loop, yet it still snapshots that bit once before processing a whole
dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT
after the first linked item has started, the remaining linked items can
still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue
running after exit has begun.
Move the check further inside, so it covers linked items too. Note: this
is a syzbot special as it loves setting up tons of slow linked work on
weird devices like msr that take forever to read, and immediately close
the ring. Exit then takes a long time.
Fixes: 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260527172203.2043962-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -556,7 +556,6 @@ static void io_worker_handle_work(struct
struct io_wq *wq = worker->wq;
do {
- bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
struct io_wq_work *work;
/*
@@ -592,6 +591,7 @@ static void io_worker_handle_work(struct
/* handle a whole dependent link */
do {
+ bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
struct io_wq_work *next_hashed, *linked;
unsigned int hash = io_get_work_hash(work);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0163/1266] ipv4: igmp: remove multicast group from hash table on device destruction
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-07-21 15:09 ` [PATCH 6.6 0162/1266] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0164/1266] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
` (835 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuyang Huang, Kuniyuki Iwashima,
Ido Schimmel, Paolo Abeni
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuyang Huang <yuyanghuang@google.com>
commit 7993211bde166471dffac074dc965489f86531f8 upstream.
When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc_hash).
Since the device remains published in dev->ip_ptr until after
ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc_hash using
ip_mc_hash_remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0
Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace:
<IRQ>
dump_stack_lvl+0x67/0x90
print_report+0x175/0x7c0
kasan_report+0x147/0x180
ip_check_mc_rcu+0x149/0x3f0
udp_v4_early_demux+0x36d/0x12d0
ip_rcv_finish_core+0xb8b/0x1390
ip_rcv_finish+0x54/0x120
NF_HOOK+0x213/0x2b0
__netif_receive_skb+0x126/0x340
process_backlog+0x4f2/0xf00
__napi_poll+0x92/0x2c0
net_rx_action+0x583/0xc60
handle_softirqs+0x236/0x7f0
do_softirq+0x57/0x80
</IRQ>
Allocated by task 2239:
kasan_save_track+0x3e/0x80
__kasan_kmalloc+0x72/0x90
____ip_mc_inc_group+0x31a/0xa40
__ip_mc_join_group+0x334/0x3f0
do_ip_setsockopt+0x16fa/0x2010
ip_setsockopt+0x3f/0x90
do_sock_setsockopt+0x1ad/0x300
Freed by task 0:
kasan_save_track+0x3e/0x80
kasan_save_free_info+0x40/0x50
__kasan_slab_free+0x3a/0x60
__rcu_free_sheaf_prepare+0xd4/0x220
rcu_free_sheaf+0x36/0x190
rcu_core+0x8d9/0x12f0
handle_softirqs+0x236/0x7f0
Fixes: e9897071350b ("igmp: hash a hash table to speedup ip_check_mc_rcu()")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1816,6 +1816,7 @@ void ip_mc_destroy_dev(struct in_device
#endif
while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
+ ip_mc_hash_remove(in_dev, i);
in_dev->mc_list = i->next_rcu;
in_dev->mc_count--;
ip_mc_clear_src(i);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0164/1266] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0163/1266] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0165/1266] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
` (834 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Zhengchuan Liang, Xin Liu,
Eric Dumazet, Wyatt Feng, Ren Wei, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit efb8763d7bbb40cff4cc55a6b62c3095a038149c upstream.
Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP
socket state. The sysctl is stored as an `int` but copied into the
`u32` `tp->reordering` field for new sockets, so negative writes wrap
to large values.
With `tcp_mtu_probing=2`, the wrapped value can overflow the
`tcp_mtu_probe()` size calculation and drive the MTU probing path into
an out-of-bounds read. Route `tcp_reordering` writes through
`proc_dointvec_minmax()` and require it to be at least 1. Also require
`tcp_max_reordering` to be at least 1 so the configured maximum cannot
become negative either.
When registering the table for a non-init network namespace, relocate
`extra2` pointers that refer into `init_net.ipv4` so the
`tcp_reordering` upper bound follows that namespace's
`tcp_max_reordering`.
Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.
This keeps the send queue and window checks from being bypassed through
signed integer overflow.
Fixes: 91cc17c0e5e5 ("[TCP]: MTUprobe: receiver window & data available checks fixed")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/1a5b7e1ef4d70fbad8c8ee0b82d8405f3c964a3d.1781395200.git.bronzed_45_vested@icloud.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/sysctl_net_ipv4.c | 10 ++++++++--
net/ipv4/tcp_output.c | 4 ++--
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -966,7 +966,9 @@ static struct ctl_table ipv4_net_table[]
.data = &init_net.ipv4.sysctl_tcp_reordering,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ONE,
+ .extra2 = &init_net.ipv4.sysctl_tcp_max_reordering,
},
{
.procname = "tcp_retries1",
@@ -1185,7 +1187,8 @@ static struct ctl_table ipv4_net_table[]
.data = &init_net.ipv4.sysctl_tcp_max_reordering,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ONE,
},
{
.procname = "tcp_dsack",
@@ -1533,6 +1536,9 @@ static __net_init int ipv4_sysctl_init_n
*/
table[i].mode &= ~0222;
}
+ if (table[i].extra2 >= (void *)&init_net.ipv4 &&
+ table[i].extra2 < (void *)(&init_net.ipv4 + 1))
+ table[i].extra2 += (void *)net - (void *)&init_net;
}
}
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2412,7 +2412,7 @@ static int tcp_mtu_probe(struct sock *sk
struct sk_buff *skb, *nskb, *next;
struct net *net = sock_net(sk);
int probe_size;
- int size_needed;
+ u64 size_needed;
int copy, len;
int mss_now;
int interval;
@@ -2436,7 +2436,7 @@ static int tcp_mtu_probe(struct sock *sk
mss_now = tcp_current_mss(sk);
probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
icsk->icsk_mtup.search_low) >> 1);
- size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
+ size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache;
interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
/* When misfortune happens, we are reprobing actively,
* and then reprobe timer has expired. We stick with current
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0165/1266] mfd: cros_ec: Delay dev_set_drvdata() until probe success
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0164/1266] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0166/1266] mm: shrinker: fix NULL pointer dereference in debugfs Greg Kroah-Hartman
` (833 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Andrei Kuchynski,
Benson Leung, Lee Jones
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <akuchynski@chromium.org>
commit 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a upstream.
If ec_device_probe() fails, cros_ec_class_release releases memory for the
cros_ec_dev structure. However, because the drvdata was already set,
sub-drivers like cros_ec_typec can still retrieve the stale pointer via the
platform device. This leads to a use-after-free when cros_ec_typec attempts
to access &typec->ec->ec->dev on a device that has already been released.
Move dev_set_drvdata() to ensure that the pointer is only made available
once all initialization steps have succeeded.
sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'
Call trace:
sysfs_do_create_link_sd+0x94/0xdc
sysfs_create_link+0x30/0x44
device_add_class_symlinks+0x90/0x13c
device_add+0xf0/0x50c
ec_device_probe+0x150/0x4f0
platform_probe+0xa0/0xe0
...
BUG: KASAN: invalid-access in __memcpy+0x44/0x230
Write at addr f5ffff809e2d33ac by task kworker/u32:5/125
Pointer tag: [f5], memory tag: [fe]
Tainted : [W]=WARN, [O]=OOT_MODULE
Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__memcpy+0x44/0x230
cros_ec_check_features+0x60/0xcc [cros_ec_proto]
cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]
platform_probe+0xa0/0xe0
Cc: stable@vger.kernel.org
Fixes: 1c1d152cc5ac ("platform/chrome: cros_ec_dev - utilize new cdev_device_add helper function")
Co-developed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://patch.msgid.link/20260427131721.1165078-1-akuchynski@chromium.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/cros_ec_dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -145,7 +145,6 @@ static int ec_device_probe(struct platfo
if (!ec)
return retval;
- dev_set_drvdata(dev, ec);
ec->ec_dev = dev_get_drvdata(dev->parent);
ec->dev = dev;
ec->cmd_offset = ec_platform->cmd_offset;
@@ -187,6 +186,8 @@ static int ec_device_probe(struct platfo
if (retval)
goto failed;
+ dev_set_drvdata(dev, ec);
+
/* check whether this EC is a sensor hub. */
if (cros_ec_get_sensor_count(ec) > 0) {
retval = mfd_add_hotplug_devices(ec->dev,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0166/1266] mm: shrinker: fix NULL pointer dereference in debugfs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0165/1266] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0167/1266] netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Greg Kroah-Hartman
` (832 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Zheng, Muchun Song, Dave Chinner,
Roman Gushchin, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Zheng <zhengqi.arch@bytedance.com>
commit e30453c61e185e914fde83c650e268067b140218 upstream.
shrinker_debugfs_add() creates both "count" and "scan" debugfs files
unconditionally.
That assumes every shrinker implements both count_objects() and
scan_objects(), which is not guaranteed. For example, the xen-backend
shrinker sets count_objects() but leaves scan_objects() NULL, so writing
to its scan file calls through a NULL function pointer and panics the
kernel:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
Call Trace:
<TASK>
shrinker_debugfs_scan_write+0x12e/0x270
full_proxy_write+0x5f/0x90
vfs_write+0xde/0x420
? filp_flush+0x75/0x90
? filp_close+0x1d/0x30
? do_dup2+0xb8/0x120
ksys_write+0x68/0xf0
? filp_flush+0x75/0x90
do_syscall_64+0xb3/0x5b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The count path has the same issue in principle if a shrinker omits
count_objects().
To fix it, only create "count" and "scan" debugfs files when the
corresponding callbacks are present.
Link: https://lore.kernel.org/20260617090052.27325-1-qi.zheng@linux.dev
Fixes: bbf535fd6f06 ("mm: shrinkers: add scan interface for shrinker debugfs")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shrinker_debug.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/mm/shrinker_debug.c
+++ b/mm/shrinker_debug.c
@@ -198,10 +198,12 @@ int shrinker_debugfs_add(struct shrinker
}
shrinker->debugfs_entry = entry;
- debugfs_create_file("count", 0440, entry, shrinker,
- &shrinker_debugfs_count_fops);
- debugfs_create_file("scan", 0220, entry, shrinker,
- &shrinker_debugfs_scan_fops);
+ if (shrinker->count_objects)
+ debugfs_create_file("count", 0440, entry, shrinker,
+ &shrinker_debugfs_count_fops);
+ if (shrinker->scan_objects)
+ debugfs_create_file("scan", 0220, entry, shrinker,
+ &shrinker_debugfs_scan_fops);
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0167/1266] netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0166/1266] mm: shrinker: fix NULL pointer dereference in debugfs Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0168/1266] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
` (831 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pratham Gupta, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratham Gupta <pratham36gupta@gmail.com>
commit a7f57320bbbc67e347bf5fff4b4a9bab980d5956 upstream.
Commit 02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation")
introduced exp->net so RCU-only expectation paths no longer need to
dereference exp->master for netns lookups.
Commit 3db5647984de ("netfilter: nf_conntrack_expect: skip expectations in other netns via proc")
updated the proc path accordingly, but ctnetlink_exp_dump_table() still
compares against nf_ct_net(exp->master).
Use nf_ct_exp_net(exp) here as well so the netlink dump path matches
the rest of the March 2026 expectation netns/RCU cleanup.
Fixes: 02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation")
Cc: stable@vger.kernel.org
Signed-off-by: Pratham Gupta <pratham36gupta@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3148,7 +3148,7 @@ restart:
if (l3proto && exp->tuple.src.l3num != l3proto)
continue;
- if (!net_eq(nf_ct_net(exp->master), net))
+ if (!net_eq(nf_ct_exp_net(exp), net))
continue;
if (cb->args[1]) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0168/1266] netfilter: ebtables: module names must be null-terminated
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0167/1266] netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0169/1266] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
` (830 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 084d23f818321390509e9738a0b08bbf46df6425 upstream.
We need to explicitly check the length, else we may pass non-null
terminated string to request_module().
Cc: stable@vger.kernel.org
Fixes: bcf493428840 ("netfilter: ebtables: Fix extension lookup with identical name")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -402,6 +402,9 @@ ebt_check_match(struct ebt_entry_match *
left - sizeof(struct ebt_entry_match) < m->match_size)
return -EINVAL;
+ if (strnlen(m->u.name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+ return -EINVAL;
+
match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision);
if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
if (!IS_ERR(match))
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0169/1266] netfilter: ebtables: terminate table name before find_table_lock()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0168/1266] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0170/1266] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Greg Kroah-Hartman
` (829 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit a622d2e9608c9dff47fc2e5759ac7aa3a836b45d upstream.
update_counters() and compat_update_counters() forward a user-supplied
32-byte table name to find_table_lock() without NUL-terminating it. On a
lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",
"ebtable_", name), and vsnprintf() reads past the name field and the
stack object until it hits a zero byte.
BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)
Read of size 1 at addr ffff8880119dfb20 by task exploit/147
Call Trace:
...
string (lib/vsprintf.c:648 lib/vsprintf.c:730)
vsnprintf (lib/vsprintf.c:2945)
__request_module (kernel/module/kmod.c:150)
do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)
update_counters (net/bridge/netfilter/ebtables.c:1440)
do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)
nf_setsockopt (net/netfilter/nf_sockopt.c:101)
ip_setsockopt (net/ipv4/ip_sockglue.c:1424)
raw_setsockopt (net/ipv4/raw.c:847)
__sys_setsockopt (net/socket.c:2393)
...
compat_do_replace() shares the same unterminated name via
compat_copy_ebt_replace_from_user(); terminate it there too so all
find_table_lock() callers behave alike. The other callers already
terminate the name after the copy.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1433,6 +1433,8 @@ static int update_counters(struct net *n
if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
return -EFAULT;
+ hlp.name[sizeof(hlp.name) - 1] = '\0';
+
if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
return -EINVAL;
@@ -2272,6 +2274,8 @@ static int compat_copy_ebt_replace_from_
memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
+ repl->name[sizeof(repl->name) - 1] = '\0';
+
/* starting with hook_entry, 32 vs. 64 bit structures are different */
for (i = 0; i < NF_BR_NUMHOOKS; i++)
repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
@@ -2394,6 +2398,8 @@ static int compat_update_counters(struct
if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
return -EFAULT;
+ hlp.name[sizeof(hlp.name) - 1] = '\0';
+
/* try real handler in case userland supplied needed padding */
if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
return update_counters(net, arg, len);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0170/1266] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0169/1266] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0171/1266] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
` (828 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Sean Wang,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit a257407e2bbbb099ed427719a50563f67fa366d8 upstream.
Every once in a while we see a hung btmtksdio_flush() task:
INFO: task kworker/u17:0:189 blocked for more than 122 seconds.
__cancel_work_timer+0x3f4/0x460
cancel_work_sync+0x1c/0x2c
btmtksdio_flush+0x2c/0x40
hci_dev_open_sync+0x10c4/0x2190
[..]
It all boils down to incorrect time_is_before_jiffies() usage in
btmtksdio_txrx_work(). The btmtksdio_txrx_work() loop is expected
to be terminated if running for longer than 5*HZ. However the
timeout check is twisted: time_is_before_jiffies(old_jiffies + 5*HZ)
evaluates to true when old_jiffies + 5*HZ is in the past i.e. when a
timeout has occurred. Using OR with time_is_before_jiffies(txrx_timeout)
means that:
- before the 5-second timeout: the condition is `int_status || false`,
so it loops as long as there are pending interrupts.
- after the 5-second timeout: the condition becomes `int_status || true`,
which is always true.
When the loop becomes infinite btmtksdio_txrx_work() loop never
terminates and never releases the SDIO host.
Fix loop termination condition to actually enforce a 5*HZ timeout.
Fixes: 26270bc189ea4 ("Bluetooth: btmtksdio: move interrupt service to work")
Cc: stable@vger.kernel.org
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btmtksdio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -606,7 +606,7 @@ static void btmtksdio_txrx_work(struct w
if (btmtksdio_rx_packet(bdev, rx_size) < 0)
bdev->hdev->stat.err_rx++;
}
- } while (int_status || time_is_before_jiffies(txrx_timeout));
+ } while (int_status && time_is_after_jiffies(txrx_timeout));
/* Enable interrupt */
sdio_writel(bdev->func, C_INT_EN_SET, MTK_REG_CHLPCR, 0);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0171/1266] Bluetooth: bnep: pin L2CAP connection during netdev registration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0170/1266] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0172/1266] Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Greg Kroah-Hartman
` (827 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+fed5dce4553262f3b35c,
Yousef Alhouseen, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit bb067a99a0356196c0b89a95721985485ebce5a5 upstream.
bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.
Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.
Fixes: 65f53e9802db ("Bluetooth: Access BNEP session addresses through L2CAP channel")
Reported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fed5dce4553262f3b35c
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/bnep/core.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -562,14 +562,18 @@ static int bnep_session(void *arg)
return 0;
}
-static struct device *bnep_get_device(struct bnep_session *session)
+static struct l2cap_conn *bnep_get_conn(struct bnep_session *session)
{
- struct l2cap_conn *conn = l2cap_pi(session->sock->sk)->chan->conn;
+ struct l2cap_chan *chan = l2cap_pi(session->sock->sk)->chan;
+ struct l2cap_conn *conn;
- if (!conn || !conn->hcon)
- return NULL;
+ l2cap_chan_lock(chan);
+ conn = chan->conn;
+ if (conn)
+ l2cap_conn_get(conn);
+ l2cap_chan_unlock(chan);
- return &conn->hcon->dev;
+ return conn;
}
static struct device_type bnep_type = {
@@ -581,6 +585,7 @@ int bnep_add_connection(struct bnep_conn
u32 valid_flags = BIT(BNEP_SETUP_RESPONSE);
struct net_device *dev;
struct bnep_session *s, *ss;
+ struct l2cap_conn *conn = NULL;
u8 dst[ETH_ALEN], src[ETH_ALEN];
int err;
@@ -640,10 +645,18 @@ int bnep_add_connection(struct bnep_conn
bnep_set_default_proto_filter(s);
#endif
- SET_NETDEV_DEV(dev, bnep_get_device(s));
+ conn = bnep_get_conn(s);
+ if (!conn) {
+ err = -ENOTCONN;
+ goto failed;
+ }
+
+ SET_NETDEV_DEV(dev, &conn->hcon->dev);
SET_NETDEV_DEVTYPE(dev, &bnep_type);
err = register_netdev(dev);
+ l2cap_conn_put(conn);
+ conn = NULL;
if (err)
goto failed;
@@ -665,6 +678,8 @@ int bnep_add_connection(struct bnep_conn
return 0;
failed:
+ if (conn)
+ l2cap_conn_put(conn);
up_write(&bnep_session_sem);
free_netdev(dev);
return err;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0172/1266] Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0171/1266] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0173/1266] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
` (826 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neeraj Sanjay Kale, Maoyi Xie,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit badff6c3bed8923a1257a853f137d447976eec30 upstream.
During the v3 firmware download the controller sends a v3_data_req with a
32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower
bound of the offset and then sends firmware from that offset.
nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
nxpdev->fw_dnld_v3_offset, len);
Nothing checks that fw_dnld_v3_offset + len stays within nxpdev->fw->size,
so a controller that asks for an offset or length past the firmware image
makes the driver read past the end of nxpdev->fw->data and send that
memory back over UART.
nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent
check to the v3 path, reject the request when it falls outside the firmware
image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at
free_skb stays consistent.
Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
Suggested-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Reviewed-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btnxpuart.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1030,6 +1030,12 @@ static int nxp_recv_fw_req_v3(struct hci
}
nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
+ if (nxpdev->fw_dnld_v3_offset >= nxpdev->fw->size ||
+ len > nxpdev->fw->size - nxpdev->fw_dnld_v3_offset) {
+ bt_dev_err(hdev, "FW download out of bounds, ignoring request");
+ len = 0;
+ goto free_skb;
+ }
serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
nxpdev->fw_dnld_v3_offset, len);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0173/1266] Bluetooth: fix UAF in bt_accept_dequeue()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0172/1266] Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0174/1266] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
` (825 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+674ff7e4d7fdfd572afc,
Yousef Alhouseen, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit 4bd0b274054f2679f28b70222b607bb0afc3ab9a upstream.
bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.
Fixes: ab1513597c6c ("Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()")
Reported-by: syzbot+674ff7e4d7fdfd572afc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=674ff7e4d7fdfd572afc
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/af_bluetooth.c | 17 +++--------------
net/bluetooth/l2cap_sock.c | 4 ++--
2 files changed, 5 insertions(+), 16 deletions(-)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -305,7 +305,7 @@ struct sock *bt_accept_dequeue(struct so
restart:
for (sk = bt_accept_get(parent, NULL); sk; sk = next) {
- /* Prevent early freeing of sk due to unlink and sock_kill */
+ /* The reference from bt_accept_get() keeps sk alive. */
lock_sock(sk);
/* Check sk has not already been unlinked via
@@ -321,13 +321,11 @@ restart:
next = bt_accept_get(parent, sk);
- /* sk is safely in the parent list so reduce reference count */
- sock_put(sk);
-
/* FIXME: Is this check still needed */
if (sk->sk_state == BT_CLOSED) {
bt_accept_unlink(sk);
release_sock(sk);
+ sock_put(sk);
continue;
}
@@ -337,16 +335,6 @@ restart:
if (newsock)
sock_graft(sk, newsock);
- /* Hand the caller a reference taken while sk is
- * still locked. bt_accept_unlink() just dropped
- * the accept-queue reference; without this hold a
- * concurrent teardown (e.g. l2cap_conn_del() ->
- * l2cap_sock_kill()) could free sk between
- * release_sock() and the caller using it. Every
- * caller drops this with sock_put() when done.
- */
- sock_hold(sk);
-
release_sock(sk);
if (next)
sock_put(next);
@@ -354,6 +342,7 @@ restart:
}
release_sock(sk);
+ sock_put(sk);
}
return NULL;
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1448,8 +1448,8 @@ static void l2cap_sock_cleanup_listen(st
/* Close not yet accepted channels.
*
- * bt_accept_dequeue() now returns sk with an extra reference held
- * (taken while sk was still locked) so a concurrent l2cap_conn_del()
+ * bt_accept_dequeue() returns sk with its temporary queue-walk
+ * reference held, so a concurrent l2cap_conn_del()
* -> l2cap_sock_kill() cannot free sk under us.
*
* cleanup_listen() runs under the parent sk lock, so unlike
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0174/1266] Bluetooth: L2CAP: validate option length before reading conf opt value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0173/1266] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0175/1266] fs/ntfs3: fsync files by syncing parent inodes Greg Kroah-Hartman
` (824 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 687617555cedfb74c9e3cb85d759b908dcb17856 upstream.
l2cap_get_conf_opt() derives the option length from the
attacker-controlled opt->len field and immediately dereferences
opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a
raw pointer for the default case) before any caller has confirmed
that opt->len bytes are present in the buffer. The callers
(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and
l2cap_conf_rfc_get()) only detect a malformed option afterwards, once
the running length has gone negative, by which point the
out-of-bounds read has already executed.
An existing post-hoc length check keeps the garbage value from being
consumed, so this is not a data leak in the current control flow. It
is still a validate-after-use ordering bug: up to 4 bytes are read
past the end of the buffer before it is known to contain them, and it
is fragile to future changes in the callers.
Fix it at the source. Pass the end of the buffer into
l2cap_get_conf_opt() and refuse to touch opt->val unless the full
option (header + value) fits. Each caller computes an end pointer
once before the loop and checks the return value directly instead of
inferring the error from a negative length.
Fixes: 7c9cbd0b5e38 ("Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3002,13 +3002,24 @@ fail:
return NULL;
}
-static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
- unsigned long *val)
+static inline int l2cap_get_conf_opt(void **ptr, void *end, int *type,
+ int *olen, unsigned long *val)
{
struct l2cap_conf_opt *opt = *ptr;
int len;
+ /* opt->len is attacker-controlled. Validate that the full option
+ * (header + value) actually fits in the buffer before touching
+ * opt->val, otherwise the switch below reads past the end of the
+ * caller's buffer.
+ */
+ if (end - *ptr < L2CAP_CONF_OPT_SIZE)
+ return -EINVAL;
+
len = L2CAP_CONF_OPT_SIZE + opt->len;
+ if (end - *ptr < len)
+ return -EINVAL;
+
*ptr += len;
*type = opt->type;
@@ -3376,6 +3387,7 @@ static int l2cap_parse_conf_req(struct l
void *ptr = rsp->data;
void *endptr = data + data_size;
void *req = chan->conf_req;
+ void *req_end = req + chan->conf_len;
int len = chan->conf_len;
int type, hint, olen;
unsigned long val;
@@ -3389,9 +3401,11 @@ static int l2cap_parse_conf_req(struct l
BT_DBG("chan %p", chan);
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&req, req_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
hint = type & L2CAP_CONF_HINT;
type &= L2CAP_CONF_MASK;
@@ -3619,6 +3633,7 @@ static int l2cap_parse_conf_rsp(struct l
struct l2cap_conf_req *req = data;
void *ptr = req->data;
void *endptr = data + size;
+ void *rsp_end = rsp + len;
int type, olen;
unsigned long val;
struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
@@ -3627,9 +3642,11 @@ static int l2cap_parse_conf_rsp(struct l
BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
switch (type) {
case L2CAP_CONF_MTU:
@@ -3878,6 +3895,7 @@ static void l2cap_conf_rfc_get(struct l2
{
int type, olen;
unsigned long val;
+ void *rsp_end = rsp + len;
/* Use sane default values in case a misbehaving remote device
* did not send an RFC or extended window size option.
*/
@@ -3896,9 +3914,11 @@ static void l2cap_conf_rfc_get(struct l2
return;
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
switch (type) {
case L2CAP_CONF_RFC:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0175/1266] fs/ntfs3: fsync files by syncing parent inodes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0174/1266] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0176/1266] fs/ntfs3: handle attr_set_size() errors when truncating files Greg Kroah-Hartman
` (823 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit dcd9d6a47199565d83d61a11bbf91fa2ade4d676 ]
Some xfstests expect fsync() on a file or directory to also persist
directory metadata up the parent chain. Using generic_file_fsync() is not
sufficient for ntfs, because parent directories are not explicitly
written out.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: d7ea8495fd30 ("fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/dir.c | 2 +-
fs/ntfs3/file.c | 38 +++++++++++++++++++++++++++++++++-
fs/ntfs3/frecord.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++
fs/ntfs3/ntfs_fs.h | 2 ++
4 files changed, 91 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index 894fd44164b48a..4bf851273e3324 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -623,7 +623,7 @@ const struct file_operations ntfs_dir_operations = {
.llseek = generic_file_llseek,
.read = generic_read_dir,
.iterate_shared = ntfs_readdir,
- .fsync = generic_file_fsync,
+ .fsync = ntfs_file_fsync,
.open = ntfs_file_open,
};
// clang-format on
diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index 212737a816d7af..89e35825c5c49d 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1224,6 +1224,42 @@ int ntfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
return err;
}
+/*
+ * ntfs_file_fsync - file_operations::fsync
+ */
+int ntfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+{
+ struct inode *inode = file_inode(file);
+ struct super_block *sb = inode->i_sb;
+ struct ntfs_sb_info *sbi = sb->s_fs_info;
+ int err, ret;
+
+ if (unlikely(ntfs3_forced_shutdown(sb)))
+ return -EIO;
+
+ ret = file_write_and_wait_range(file, start, end);
+ if (ret)
+ return ret;
+
+ ret = write_inode_now(inode, !datasync);
+
+ if (!ret) {
+ ret = ni_write_parents(ntfs_i(inode), !datasync);
+ }
+
+ if (!ret) {
+ ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
+ ntfs_update_mftmirr(sbi, false);
+ }
+
+ err = sync_blockdev(sb->s_bdev);
+ if (unlikely(err && !ret))
+ ret = err;
+ if (!ret)
+ ret = blkdev_issue_flush(sb->s_bdev);
+ return ret;
+}
+
// clang-format off
const struct inode_operations ntfs_file_inode_operations = {
.getattr = ntfs_getattr,
@@ -1245,7 +1281,7 @@ const struct file_operations ntfs_file_operations = {
.splice_read = ntfs_file_splice_read,
.mmap = ntfs_file_mmap,
.open = ntfs_file_open,
- .fsync = generic_file_fsync,
+ .fsync = ntfs_file_fsync,
.splice_write = iter_file_splice_write,
.fallocate = ntfs_fallocate,
.release = ntfs_file_release,
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 06b1d82b599759..c265710d25b425 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -3145,6 +3145,57 @@ bool ni_is_dirty(struct inode *inode)
return false;
}
+/*
+ * ni_write_parents
+ *
+ * Helper function for ntfs_file_fsync.
+ */
+int ni_write_parents(struct ntfs_inode *ni, int sync)
+{
+ int err = 0;
+ struct ATTRIB *attr = NULL;
+ struct ATTR_LIST_ENTRY *le = NULL;
+ struct ntfs_sb_info *sbi = ni->mi.sbi;
+ struct super_block *sb = sbi->sb;
+
+ while ((attr = ni_find_attr(ni, attr, &le, ATTR_NAME, NULL, 0, NULL,
+ NULL))) {
+ struct inode *dir;
+ struct ATTR_FILE_NAME *fname;
+
+ fname = resident_data_ex(attr, SIZEOF_ATTRIBUTE_FILENAME);
+ if (!fname)
+ continue;
+
+ /* Check simple case when parent inode equals current inode. */
+ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) {
+ if (MFT_REC_ROOT != ni->vfs_inode.i_ino) {
+ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
+ err = -EINVAL;
+ }
+ continue;
+ }
+
+ dir = ntfs_iget5(sb, &fname->home, NULL);
+ if (IS_ERR(dir)) {
+ ntfs_inode_warn(
+ &ni->vfs_inode,
+ "failed to open parent directory r=%lx to write",
+ (long)ino_get(&fname->home));
+ continue;
+ }
+
+ if (!is_bad_inode(dir)) {
+ int err2 = write_inode_now(dir, sync);
+ if (!err)
+ err = err2;
+ }
+ iput(dir);
+ }
+
+ return err;
+}
+
/*
* ni_update_parent
*
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 31f57ee9a1a9b4..e534095078e89f 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -503,6 +503,7 @@ int ntfs3_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
int ntfs_file_open(struct inode *inode, struct file *file);
int ntfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
__u64 start, __u64 len);
+int ntfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync);
extern const struct inode_operations ntfs_special_inode_operations;
extern const struct inode_operations ntfs_file_inode_operations;
extern const struct file_operations ntfs_file_operations;
@@ -580,6 +581,7 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
struct ntfs_inode *ni, struct NTFS_DE *de, struct NTFS_DE *new_de);
bool ni_is_dirty(struct inode *inode);
+int ni_write_parents(struct ntfs_inode *ni, int sync);
/* Globals from fslog.c */
bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0176/1266] fs/ntfs3: handle attr_set_size() errors when truncating files
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0175/1266] fs/ntfs3: fsync files by syncing parent inodes Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0177/1266] fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Greg Kroah-Hartman
` (822 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 576248a34b927e93b2fd3fff7df735ba73ad7d01 ]
If attr_set_size() fails while truncating down, the error is silently
ignored and the inode may be left in an inconsistent state.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: d7ea8495fd30 ("fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/file.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index 89e35825c5c49d..3eee810c69e2f7 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -371,8 +371,8 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
{
struct super_block *sb = inode->i_sb;
struct ntfs_inode *ni = ntfs_i(inode);
- int err, dirty = 0;
u64 new_valid;
+ int err;
if (!S_ISREG(inode->i_mode))
return 0;
@@ -388,7 +388,6 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
}
new_valid = ntfs_up_block(sb, min_t(u64, ni->i_valid, new_size));
-
truncate_setsize(inode, new_size);
ni_lock(ni);
@@ -402,20 +401,19 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
ni->i_valid = new_valid;
ni_unlock(ni);
+ if (unlikely(err))
+ return err;
ni->std_fa |= FILE_ATTRIBUTE_ARCHIVE;
inode->i_mtime = inode_set_ctime_current(inode);
if (!IS_DIRSYNC(inode)) {
- dirty = 1;
+ mark_inode_dirty(inode);
} else {
err = ntfs_sync_inode(inode);
if (err)
return err;
}
- if (dirty)
- mark_inode_dirty(inode);
-
/*ntfs_flush_inodes(inode->i_sb, inode, NULL);*/
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0177/1266] fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0176/1266] fs/ntfs3: handle attr_set_size() errors when truncating files Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0178/1266] fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Greg Kroah-Hartman
` (821 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 356fa248168be90109b66f32a61b8eaedc98424a ]
Handle ntfs_read_folio() early when the folio offset is beyond i_valid
by zero-filling the folio and marking it uptodate. This avoids needless
I/O and locking, improves read performance.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Stable-dep-of: d7ea8495fd30 ("fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()")
[ sashal: dropped the is_bad_ni() guard, 6.6 lacks 519b078998ce6e
("fs/ntfs3: Exclude call make_bad_inode for live nodes.") which
introduces that helper; pre-patch 6.6 had no such check either ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 787e15ba0ca406..fff604cd952793 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -715,6 +715,14 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
struct address_space *mapping = page->mapping;
struct inode *inode = mapping->host;
struct ntfs_inode *ni = ntfs_i(inode);
+ loff_t vbo = folio_pos(folio);
+
+ if (ni->i_valid <= vbo) {
+ folio_zero_range(folio, 0, folio_size(folio));
+ folio_mark_uptodate(folio);
+ folio_unlock(folio);
+ return 0;
+ }
if (is_resident(ni)) {
ni_lock(ni);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0178/1266] fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0177/1266] fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0179/1266] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Greg Kroah-Hartman
` (820 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c1e9aedbd913fadad617,
Deepanshu Kartikey, Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
[ Upstream commit d7ea8495fd307b58f8867acd81a1b40075b1d3ba ]
When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.
The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).
Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.
The following scenario triggers the bug:
attr_data_get_block_locked()
vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment
load runs for vcn segment <- vcn0 segment not loaded!
attr_allocate_clusters() <- allocation succeeds
run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN
WARN_ON(1) <- bug fires here!
Reported-by: syzbot+c1e9aedbd913fadad617@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c1e9aedbd913fadad617
Fixes: c380b52f6c57 ("fs/ntfs3: Change new sparse cluster processing")
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 8f033e30e0d799..a590c541861332 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1045,6 +1045,20 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn,
if (err)
goto out;
}
+
+ if (vcn0 < svcn || evcn1 <= vcn0) {
+ struct ATTRIB *attr2;
+
+ attr2 = ni_find_attr(ni, attr_b, &le_b, ATTR_DATA, NULL,
+ 0, &vcn0, &mi);
+ if (!attr2) {
+ err = -EINVAL;
+ goto out;
+ }
+ err = attr_load_runs(attr2, ni, run, NULL);
+ if (err)
+ goto out;
+ }
}
if (vcn + to_alloc > asize)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0179/1266] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0178/1266] fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0180/1266] smb/client: Fix error code in smb2_aead_req_alloc() Greg Kroah-Hartman
` (819 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Suzuki K Poulose
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit 98495b5a4d77dd22e106f462b76e1093a55b29a7 upstream.
When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls
smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring
buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is
handle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages
normalization is only applied after the first loop iteration.
This leaves the initial page index underived from the buffer size, which
can result in an out-of-bounds write past dst_pages[] when head exceeds
the AUX buffer size.
Normalize head modulo the AUX buffer size before deriving the page index
and offset, mirroring tmc_etr_sync_perf_buffer().
Fixes: 06f5c2926aaa ("drivers/coresight: Add UltraSoc System Memory Buffer driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/SYBPR01MB788156B3380A36835DB22290AF102@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/ultrasoc-smb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hwtracing/coresight/ultrasoc-smb.c
+++ b/drivers/hwtracing/coresight/ultrasoc-smb.c
@@ -361,6 +361,7 @@ static void smb_sync_perf_buffer(struct
unsigned long to_copy;
long pg_idx, pg_offset;
+ head %= (unsigned long)buf->nr_pages << PAGE_SHIFT;
pg_idx = head >> PAGE_SHIFT;
pg_offset = head & (PAGE_SIZE - 1);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0180/1266] smb/client: Fix error code in smb2_aead_req_alloc()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0179/1266] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0181/1266] ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Greg Kroah-Hartman
` (818 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Dan Carpenter, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
commit 61f28012e5650c619223decdb7970e0d3162e949 upstream.
The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work.
We would have to do something similar to the previous line where it's
cast to int and then long. However, it's simpler to store the return in
an int ret variable.
This bug would eventually result in a crash when dereference the invalid
error pointer.
Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Cc: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2ops.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4182,11 +4182,13 @@ static void *smb2_aead_req_alloc(struct
unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
unsigned int iv_size = crypto_aead_ivsize(tfm);
unsigned int len;
+ int ret;
u8 *p;
- *num_sgs = cifs_get_num_sgs(rqst, num_rqst, sig);
- if (IS_ERR_VALUE((long)(int)*num_sgs))
- return ERR_PTR(*num_sgs);
+ ret = cifs_get_num_sgs(rqst, num_rqst, sig);
+ if (ret < 0)
+ return ERR_PTR(ret);
+ *num_sgs = ret;
len = iv_size;
len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0181/1266] ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0180/1266] smb/client: Fix error code in smb2_aead_req_alloc() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0182/1266] ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Greg Kroah-Hartman
` (817 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 388e4139db27a9e3612c9d356b826f5b1ff6a9e3 upstream.
The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the
destination file's data via vfs_clone_file_range() with neither the
share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle
fp->daccess check that the other write-bearing arms carry. A client can
overwrite destination data on a read-only share, or from a handle opened
with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).
FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via
the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;
require FILE_WRITE_DATA since this writes data.
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8482,6 +8482,17 @@ int smb2_ioctl(struct ksmbd_work *work)
goto dup_ext_out;
}
+ if (!test_tree_conn_flag(work->tcon,
+ KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+ ret = -EACCES;
+ goto dup_ext_out;
+ }
+
+ if (!(fp_out->daccess & FILE_WRITE_DATA_LE)) {
+ ret = -EACCES;
+ goto dup_ext_out;
+ }
+
src_off = le64_to_cpu(dup_ext->SourceFileOffset);
dst_off = le64_to_cpu(dup_ext->TargetFileOffset);
length = le64_to_cpu(dup_ext->ByteCount);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0182/1266] ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0181/1266] ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0183/1266] ksmbd: serialize QUERY_DIRECTORY requests per file Greg Kroah-Hartman
` (816 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 3320ba068198adc144c89d6661b805acce01735b upstream.
FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after
checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no
per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES
still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of
FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it
O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only
the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with
KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle
zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to
(6/6; a FILE_READ_DATA-only handle was correctly denied).
This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL
permission bypass by adding a permission check for FSCTL_SET_SPARSE").
Because SET_ZERO_DATA writes data (not an attribute), require
FILE_WRITE_DATA.
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8407,6 +8407,12 @@ int smb2_ioctl(struct ksmbd_work *work)
goto out;
}
+ if (!(fp->daccess & FILE_WRITE_DATA_LE)) {
+ ksmbd_fd_put(work, fp);
+ ret = -EACCES;
+ goto out;
+ }
+
ret = ksmbd_vfs_zero_data(work, fp, off, len);
ksmbd_fd_put(work, fp);
if (ret < 0)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0183/1266] ksmbd: serialize QUERY_DIRECTORY requests per file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0182/1266] ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0184/1266] ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Greg Kroah-Hartman
` (815 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French,
zdi-disclosures
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit be6d26bf27499977c746abc163659915082348d8 upstream.
smb2_query_dir() stores a pointer to its stack-allocated private data in
the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the
same file handle can overwrite this pointer while an iterate_dir() callback
is still using it, resulting in a stack use-after-free.
Add a per-file mutex and hold it while accessing the shared directory
enumeration state. The lock covers scan restart, dot entry state,
readdir_data setup and iteration, and response construction. This prevents
another request from replacing readdir_data.private before the current
request has finished using it and also serializes the shared file position.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-30527
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 4 ++++
fs/smb/server/vfs_cache.c | 1 +
fs/smb/server/vfs_cache.h | 2 ++
3 files changed, 7 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4445,6 +4445,8 @@ int smb2_query_dir(struct ksmbd_work *wo
ksmbd_debug(SMB, "Search pattern is %s\n", srch_ptr);
}
+ mutex_lock(&dir_fp->readdir_lock);
+
if (srch_flag & SMB2_REOPEN || srch_flag & SMB2_RESTART_SCANS) {
ksmbd_debug(SMB, "Restart directory scan\n");
generic_file_llseek(dir_fp->filp, 0, SEEK_SET);
@@ -4549,6 +4551,7 @@ no_buf_len:
goto err_out;
}
+ mutex_unlock(&dir_fp->readdir_lock);
kfree(srch_ptr);
ksmbd_fd_put(work, dir_fp);
ksmbd_revert_fsids(work);
@@ -4556,6 +4559,7 @@ no_buf_len:
err_out:
pr_err("error while processing smb2 query dir rc = %d\n", rc);
+ mutex_unlock(&dir_fp->readdir_lock);
kfree(srch_ptr);
err_out2:
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -686,6 +686,7 @@ struct ksmbd_file *ksmbd_open_fd(struct
INIT_LIST_HEAD(&fp->node);
INIT_LIST_HEAD(&fp->lock_list);
spin_lock_init(&fp->f_lock);
+ mutex_init(&fp->readdir_lock);
atomic_set(&fp->refcount, 1);
fp->filp = filp;
--- a/fs/smb/server/vfs_cache.h
+++ b/fs/smb/server/vfs_cache.h
@@ -8,6 +8,7 @@
#include <linux/file.h>
#include <linux/fs.h>
+#include <linux/mutex.h>
#include <linux/rwsem.h>
#include <linux/spinlock.h>
#include <linux/idr.h>
@@ -112,6 +113,7 @@ struct ksmbd_file {
/* if ls is happening on directory, below is valid*/
struct ksmbd_readdir_data readdir_data;
+ struct mutex readdir_lock;
int dot_dotdot[2];
unsigned int f_state;
bool reserve_lease_break;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0184/1266] ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0183/1266] ksmbd: serialize QUERY_DIRECTORY requests per file Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0185/1266] ksmbd: require source read access for duplicate extents Greg Kroah-Hartman
` (814 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Davide Ornaghi, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Ornaghi <d.ornaghi97@gmail.com>
commit d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e upstream.
When a blocking byte-range lock request is deferred in the
FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into
the connection's async_requests list via setup_async_work(). The cancel
callback smb2_remove_blocked_lock() holds a reference to the flock.
If the lock waiter is subsequently woken up but the work state is no
longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the
cleanup path calls locks_free_lock(flock) without dequeuing the work from
the async_requests list. Concurrently, smb2_cancel() walks the list
under conn->request_lock and invokes the cancel callback, which then
dereferences the already freed 'flock'. This leads to a slab-use-after-free
inside __wake_up_common.
Fix this by restructuring the cleanup logic after the worker returns
from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and
release_async_work(work) to the top of the cleanup block. This guarantees
that the async work is completely dequeued and serialized under
conn->request_lock before locks_free_lock(flock) is called, rendering
the flock unreachable for any concurrent smb2_cancel().
Cc: stable@vger.kernel.org
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 34 ++++++++++++++++------------------
1 file changed, 16 insertions(+), 18 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7667,29 +7667,27 @@ skip:
list_del(&work->fp_entry);
spin_unlock(&fp->f_lock);
- if (work->state != KSMBD_WORK_ACTIVE) {
- list_del(&smb_lock->llist);
- locks_free_lock(flock);
+ list_del(&smb_lock->llist);
+ release_async_work(work);
+
+ if (work->state == KSMBD_WORK_ACTIVE)
+ goto retry;
- if (work->state == KSMBD_WORK_CANCELLED) {
- rsp->hdr.Status =
- STATUS_CANCELLED;
- kfree(smb_lock);
- smb2_send_interim_resp(work,
- STATUS_CANCELLED);
- work->send_no_response = 1;
- goto out;
- }
+ locks_free_lock(flock);
- rsp->hdr.Status =
- STATUS_RANGE_NOT_LOCKED;
+ if (work->state == KSMBD_WORK_CANCELLED) {
+ rsp->hdr.Status = STATUS_CANCELLED;
kfree(smb_lock);
- goto out2;
+ smb2_send_interim_resp(work,
+ STATUS_CANCELLED);
+ work->send_no_response = 1;
+ goto out;
}
- list_del(&smb_lock->llist);
- release_async_work(work);
- goto retry;
+ rsp->hdr.Status =
+ STATUS_RANGE_NOT_LOCKED;
+ kfree(smb_lock);
+ goto out2;
} else if (!rc) {
list_add(&smb_lock->llist, &rollback_list);
spin_lock(&work->conn->llist_lock);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0185/1266] ksmbd: require source read access for duplicate extents
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0184/1266] ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0186/1266] ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Greg Kroah-Hartman
` (813 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Musaab Khan, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit cedff600f1642aa982178503552f0d007bc829c8 upstream.
FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to
vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB
access mask granted to the source handle. A handle opened with attribute
access can consequently be used to copy file contents into an
attacker-readable destination.
Require FILE_READ_DATA on the source handle before either VFS operation,
matching other ksmbd data-copy paths.
Cc: stable@vger.kernel.org
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8500,6 +8500,10 @@ int smb2_ioctl(struct ksmbd_work *work)
ret = -EACCES;
goto dup_ext_out;
}
+ if (!(fp_in->daccess & FILE_READ_DATA_LE)) {
+ ret = -EACCES;
+ goto dup_ext_out;
+ }
src_off = le64_to_cpu(dup_ext->SourceFileOffset);
dst_off = le64_to_cpu(dup_ext->TargetFileOffset);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0186/1266] ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0185/1266] ksmbd: require source read access for duplicate extents Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0187/1266] ksmbd: run set info with opener credentials Greg Kroah-Hartman
` (812 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 44df157a1183a7f746caa970c169255da5ac61f8 upstream.
commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a
permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to
fsctl_set_sparse and noted that "similar handle-level checks exist in other
functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of
the missing ones, and the most security-relevant: smb2_set_info_sec() calls
set_info_sec() with no per-handle access check.
set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it
rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via
set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and
rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().
Every other persistent-mutation arm of the sibling handler
smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA /
FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —
which mutates the access control itself — is the only one with no gate.
A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no
FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType
SMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself
access the handle's daccess never carried. Unlike the FSCTL data arms this
is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —
the missing fp->daccess check is the entire gate.
Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so
require at least one of those on the handle before re-permissioning the
file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6555,6 +6555,9 @@ static int smb2_set_info_sec(struct ksmb
fp->saccess |= FILE_SHARE_DELETE_LE;
+ if (!(fp->daccess & (FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE)))
+ return -EACCES;
+
return set_info_sec(fp->conn, fp->tcon, &fp->filp->f_path, pntsd,
buf_len, false, true);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0187/1266] ksmbd: run set info with opener credentials
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0186/1266] ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0188/1266] ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Greg Kroah-Hartman
` (811 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Musaab Khan, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit b383bcad3d2fe634b26efbce53e22bbb5753a520 upstream.
SMB2 SET_INFO handlers call path-based VFS helpers after checking the
access mask granted to the SMB handle. Those helpers perform their owner,
inode permission and LSM checks using the current ksmbd worker credentials.
Run the complete SET_INFO dispatch with the credentials captured when the
handle was opened. This also removes the separate security information
credential setup and keeps all SET_INFO classes under one credential scope.
Direct override_creds() is used because it can nest with the request
credential overrides already used by rename and link helpers.
Cc: stable@vger.kernel.org
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6570,6 +6570,7 @@ static int smb2_set_info_sec(struct ksmb
*/
int smb2_set_info(struct ksmbd_work *work)
{
+ const struct cred *saved_cred;
struct smb2_set_info_req *req;
struct smb2_set_info_rsp *rsp;
struct ksmbd_file *fp = NULL;
@@ -6611,6 +6612,7 @@ int smb2_set_info(struct ksmbd_work *wor
goto err_out;
}
+ saved_cred = override_creds(fp->filp->f_cred);
switch (req->InfoType) {
case SMB2_O_INFO_FILE:
ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
@@ -6618,19 +6620,15 @@ int smb2_set_info(struct ksmbd_work *wor
break;
case SMB2_O_INFO_SECURITY:
ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n");
- if (ksmbd_override_fsids(work)) {
- rc = -ENOMEM;
- goto err_out;
- }
rc = smb2_set_info_sec(fp,
le32_to_cpu(req->AdditionalInformation),
(char *)req + le16_to_cpu(req->BufferOffset),
le32_to_cpu(req->BufferLength));
- ksmbd_revert_fsids(work);
break;
default:
rc = -EOPNOTSUPP;
}
+ revert_creds(saved_cred);
if (rc < 0)
goto err_out;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0188/1266] ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0187/1266] ksmbd: run set info with opener credentials Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0189/1266] ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Greg Kroah-Hartman
` (810 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 20c8442dc1003f9f7bb522d3dcd81d09ea59a79e upstream.
find_file_posix_info() in smb2_query_info() returns file metadata (owner
uid, group gid, mode, inode, size, allocation size, hard-link count and all
four timestamps) but performs no per-handle access check. Every sibling
query handler gates on the handle's granted access first --
get_file_basic_info(), get_file_all_info(), get_file_network_open_info()
and get_file_attribute_tag_info() all reject a handle lacking
FILE_READ_ATTRIBUTES_LE with -EACCES. The POSIX handler is gated only by
the connection-scoped tcon->posix_extensions flag, which is not a
per-handle authorization, so a handle opened with only FILE_WRITE_DATA is
correctly denied FileBasicInformation yet is allowed the strict-superset
POSIX info. Mirror the FILE_READ_ATTRIBUTES_LE gate the sibling info
handlers already use.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5290,6 +5290,12 @@ static int find_file_posix_info(struct s
int out_buf_len = sizeof(struct smb311_posix_qinfo) + 32;
int ret;
+ if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
+ pr_err("no right to read the attributes : 0x%x\n",
+ fp->daccess);
+ return -EACCES;
+ }
+
ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
AT_STATX_SYNC_AS_STAT);
if (ret)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0189/1266] ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0188/1266] ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0190/1266] ksmbd: use opener credentials for delete-on-close Greg Kroah-Hartman
` (809 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
commit 13f3942f2bf45856bb751faed2f0c4618f41ca20 upstream.
The FILE_LINK_INFORMATION arm of smb2_set_info_file() calls
smb2_create_link() with no per-handle fp->daccess check. On the
ReplaceIfExists path smb2_create_link() unlinks an existing file at the
target name (ksmbd_vfs_remove_file) and creates a hardlink
(ksmbd_vfs_link); neither helper checks daccess. A handle opened with
FILE_READ_DATA only (no FILE_DELETE, no FILE_WRITE_DATA) can therefore
delete an arbitrary file in the share and plant a hardlink over its name.
The sibling delete/move arms in the same switch already gate:
FILE_RENAME_INFORMATION and FILE_DISPOSITION_INFORMATION both require
FILE_DELETE_LE; FILE_FULL_EA_INFORMATION requires FILE_WRITE_EA_LE. Gate
the link arm the same way as its closest analogue (rename), since it
mutates the namespace and, on replace, deletes an existing entry.
This is a sibling of commit cc57232cae23 ("ksmbd: fix FSCTL permission
bypass by adding a permission check for FSCTL_SET_SPARSE").
Cc: stable@vger.kernel.org
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/smb2pdu.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6504,6 +6504,11 @@ static int smb2_set_info_file(struct ksm
}
case FILE_LINK_INFORMATION:
{
+ if (!(fp->daccess & FILE_DELETE_LE)) {
+ pr_err("no right to delete : 0x%x\n", fp->daccess);
+ return -EACCES;
+ }
+
if (buf_len < sizeof(struct smb2_file_link_info))
return -EINVAL;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0190/1266] ksmbd: use opener credentials for delete-on-close
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0189/1266] ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0191/1266] smb: client: fix query directory replay double-free Greg Kroah-Hartman
` (808 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Musaab Khan, Namjae Jeon,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
commit 52e2f21911158ec961cd5aae19c56460db382af0 upstream.
Delete-on-close can be completed by deferred or durable handle teardown,
where no request work is available. Both the base-file unlink and the ADS
xattr removal consequently run with the ksmbd worker credentials and can
bypass filesystem permission checks.
Run both operations with the credentials captured in struct file when the
handle was opened. This preserves the authenticated user's fsuid, fsgid,
supplementary groups and capability restrictions at final close.
Cc: stable@vger.kernel.org
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/vfs.c | 7 +++++--
fs/smb/server/vfs_cache.c | 4 ++++
2 files changed, 9 insertions(+), 2 deletions(-)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1084,13 +1084,15 @@ int ksmbd_vfs_remove_xattr(struct mnt_id
int ksmbd_vfs_unlink(struct file *filp)
{
+ const struct cred *saved_cred;
int err = 0;
struct dentry *dir, *dentry = filp->f_path.dentry;
struct mnt_idmap *idmap = file_mnt_idmap(filp);
+ saved_cred = override_creds(filp->f_cred);
err = mnt_want_write(filp->f_path.mnt);
if (err)
- return err;
+ goto out_revert;
dir = dget_parent(dentry);
err = ksmbd_vfs_lock_parent(dir, dentry);
@@ -1110,7 +1112,8 @@ int ksmbd_vfs_unlink(struct file *filp)
out:
dput(dir);
mnt_drop_write(filp->f_path.mnt);
-
+out_revert:
+ revert_creds(saved_cred);
return err;
}
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -292,10 +292,14 @@ static void __ksmbd_inode_close(struct k
up_write(&ci->m_lock);
if (remove_stream_xattr) {
+ const struct cred *saved_cred;
+
+ saved_cred = override_creds(filp->f_cred);
err = ksmbd_vfs_remove_xattr(file_mnt_idmap(filp),
&filp->f_path,
fp->stream.name,
true);
+ revert_creds(saved_cred);
if (err)
pr_err("remove xattr failed : %s\n",
fp->stream.name);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0191/1266] smb: client: fix query directory replay double-free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0190/1266] ksmbd: use opener credentials for delete-on-close Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0192/1266] smb: client: fix query_info() " Greg Kroah-Hartman
` (807 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit 9647492b5e41954be59d5157eddbcd4cdc1656f7 upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -5814,6 +5814,8 @@ SMB311_posix_qfs_info(const unsigned int
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0192/1266] smb: client: fix query_info() replay double-free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0191/1266] smb: client: fix query directory replay double-free Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0193/1266] smb: client: fix double-free in SMB2_ioctl() replay Greg Kroah-Hartman
` (806 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit 2a88561d66eb855813cf004a0abe648bbb17de5e upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_info_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3833,6 +3833,8 @@ query_info(const unsigned int xid, struc
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
allocated = false;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0193/1266] smb: client: fix double-free in SMB2_ioctl() replay
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0192/1266] smb: client: fix query_info() " Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0194/1266] smb: client: fix change notify replay double-free Greg Kroah-Hartman
` (805 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9 upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_ioctl_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3437,6 +3437,8 @@ SMB2_ioctl(const unsigned int xid, struc
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0194/1266] smb: client: fix change notify replay double-free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0193/1266] smb: client: fix double-free in SMB2_ioctl() replay Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0195/1266] smb: client: fix double-free in SMB2_flush() replay Greg Kroah-Hartman
` (804 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit 145f820dcbb2cced374f2532f8a61a44dce4a615 upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_notify_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4024,6 +4024,8 @@ SMB2_change_notify(const unsigned int xi
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0195/1266] smb: client: fix double-free in SMB2_flush() replay
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0194/1266] smb: client: fix change notify replay double-free Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0196/1266] smb: client: fix double-free in SMB2_open() replay Greg Kroah-Hartman
` (803 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Zhengchuan Liang, Xin Liu,
Henrique Carvalho, Zhao Zhang, Ren Wei, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Zhang <zzhan461@ucr.edu>
commit 4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a upstream.
SMB2_flush() keeps its response buffer bookkeeping across replay
attempts. If a replayable flush response is received and the retry then
fails before cifs_send_recv() stores a replacement response, flush_exit
will free the stale response pointer a second time.
Reinitialize resp_buftype and rsp_iov at the top of the replay loop so
cleanup only acts on response state produced by the current attempt.
This fixes a double-free without changing replay handling for successful
requests.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Zhao Zhang <zzhan461@ucr.edu>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4350,6 +4350,8 @@ SMB2_flush(const unsigned int xid, struc
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0196/1266] smb: client: fix double-free in SMB2_open() replay
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0195/1266] smb: client: fix double-free in SMB2_flush() replay Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0197/1266] smb: client: fix double-free in SMB2_close() replay Greg Kroah-Hartman
` (802 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit b55e182f2324bc6a604c21a47aa6c448f719a532 upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_open_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3208,6 +3208,8 @@ SMB2_open(const unsigned int xid, struct
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
server = cifs_pick_channel(ses);
oparms->replay = !!(retries);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0197/1266] smb: client: fix double-free in SMB2_close() replay
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0196/1266] smb: client: fix double-free in SMB2_open() replay Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0198/1266] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
` (801 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Henrique Carvalho, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrique Carvalho <henrique.carvalho@suse.com>
commit f96e1cdcb63ed3321142ff2fcdf784e32cda8fee upstream.
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_close_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -3629,6 +3629,8 @@ __SMB2_close(const unsigned int xid, str
replay_again:
/* reinitialize for possible replay */
+ resp_buftype = CIFS_NO_BUFFER;
+ memset(&rsp_iov, 0, sizeof(rsp_iov));
flags = 0;
query_attrs = false;
server = cifs_pick_channel(ses);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0198/1266] smb: client: Fix next buffer leak in receive_encrypted_standard()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0197/1266] smb: client: fix double-free in SMB2_close() replay Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0199/1266] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
` (800 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 1c6267a1d5cf4c73b656f8181b310cbbb3e4767b upstream.
receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.
Move the MAX_COMPOUND check before allocating next_buffer.
Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2ops.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4942,6 +4942,12 @@ receive_encrypted_standard(struct TCP_Se
one_more:
shdr = (struct smb2_hdr *)buf;
next_cmd = le32_to_cpu(shdr->NextCommand);
+
+ if (*num_mids >= MAX_COMPOUND) {
+ cifs_server_dbg(VFS, "too many PDUs in compound\n");
+ return -1;
+ }
+
if (next_cmd) {
if (WARN_ON_ONCE(next_cmd > pdu_length))
return -1;
@@ -4965,10 +4971,6 @@ one_more:
mid_entry->resp_buf_size = server->pdu_size;
}
- if (*num_mids >= MAX_COMPOUND) {
- cifs_server_dbg(VFS, "too many PDUs in compound\n");
- return -1;
- }
bufs[*num_mids] = buf;
mids[(*num_mids)++] = mid_entry;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0199/1266] smb: client: use unaligned reads in parse_posix_ctxt()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0198/1266] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0200/1266] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
` (799 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zihan Xi, Ren Wei, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <xizh2024@lzu.edu.cn>
commit b86467cd2691192ad4809a5a6e922fc24b8e9839 upstream.
The server controls create-context DataOffset, so the POSIX context data
pointer may be misaligned on strict-alignment architectures. Use
get_unaligned_le32() when reading nlink, reparse_tag, and mode.
Fixes: 69dda3059e7a ("cifs: add SMB2_open() arg to return POSIX data")
Cc: stable@vger.kernel.org
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2307,9 +2307,9 @@ parse_posix_ctxt(struct create_context *
memset(posix, 0, sizeof(*posix));
- posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0));
- posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4));
- posix->mode = le32_to_cpu(*(__le32 *)(beg + 8));
+ posix->nlink = get_unaligned_le32(beg);
+ posix->reparse_tag = get_unaligned_le32(beg + 4);
+ posix->mode = get_unaligned_le32(beg + 8);
sid = beg + 12;
sid_len = posix_info_sid_size(sid, end);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0200/1266] smb: client: harden POSIX SID length parsing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0199/1266] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0201/1266] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
` (798 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Xin Liu, Zihan Xi, Ren Wei, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <xizh2024@lzu.edu.cn>
commit 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 upstream.
posix_info_sid_size() reads sid[1] to obtain the subauthority count,
but its existing boundary check still accepts buffers with only one
remaining byte. Require two bytes before reading sid[1] so all client
paths that reuse the helper reject truncated POSIX SIDs safely.
Fixes: 349e13ad30b4 ("cifs: add smb2 POSIX info level")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -5130,7 +5130,7 @@ int posix_info_sid_size(const void *beg,
size_t subauth;
int total;
- if (beg + 1 > end)
+ if (beg + 2 > end)
return -1;
subauth = *(u8 *)(beg+1);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0201/1266] smb: client: mask server-provided mode to 07777 in modefromsid
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0200/1266] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0202/1266] OPP: of: Fix potential memory leak in opp_parse_supplies() Greg Kroah-Hartman
` (797 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Norbert Manthey, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Manthey <nmanthey@amazon.de>
commit e3d9c7160d483fc8f9e225aafad8ecbbc43f3151 upstream.
When modefromsid is active, parse_dacl() applies the server-provided
sub_auth[2] value from the NFS mode SID to cf_mode without masking to
07777. Apply the correct masking, same as in the read path.
Fixes: e2f8fbfb8d09c ("cifs: get mode bits from special sid on stat")
Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
Assisted-by: Kiro:claude-opus-4.6
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsacl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/smb/client/cifsacl.c
+++ b/fs/smb/client/cifsacl.c
@@ -890,7 +890,7 @@ static void parse_dacl(struct smb_acl *p
*/
fattr->cf_mode &= ~07777;
fattr->cf_mode |=
- le32_to_cpu(ppace[i]->sid.sub_auth[2]);
+ le32_to_cpu(ppace[i]->sid.sub_auth[2]) & 07777;
break;
} else {
if (compare_sids(&(ppace[i]->sid), pownersid) == 0) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0202/1266] OPP: of: Fix potential memory leak in opp_parse_supplies()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0201/1266] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0203/1266] firmware_loader: fix device reference leak in firmware_upload_register() Greg Kroah-Hartman
` (796 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Viresh Kumar
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 69f888381d2ecbe18ed9f112c096f8fd3623db98 upstream.
The memory allocated for microvolt, microamp and microwatt is not freed
in one of the paths in opp_parse_supplies() which returns directly.
Fix that by adding a goto to the error unwind ladder.
Fixes: 2eedf62e66c2 ("OPP: decouple dt properties in opp_parse_supplies()")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/opp/of.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -710,7 +710,7 @@ static int opp_parse_supplies(struct dev
*/
if (unlikely(opp_table->regulator_count == -1)) {
opp_table->regulator_count = 0;
- return 0;
+ goto free_microwatt;
}
for (i = 0, j = 0; i < opp_table->regulator_count; i++) {
@@ -733,6 +733,7 @@ static int opp_parse_supplies(struct dev
opp->supplies[i].u_watt = microwatt[i];
}
+free_microwatt:
kfree(microwatt);
free_microamp:
kfree(microamp);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0203/1266] firmware_loader: fix device reference leak in firmware_upload_register()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0202/1266] OPP: of: Fix potential memory leak in opp_parse_supplies() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0204/1266] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
` (795 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Danilo Krummrich
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 896df22ee57648b0c505bd76ddbc6b2341834696 upstream.
firmware_upload_register()
-> fw_create_instance()
-> device_initialize()
After fw_create_instance() succeeds, the lifetime of the embedded struct
device is expected to be managed through the device core reference
counting, since fw_create_instance() has already called
device_initialize().
In firmware_upload_register(), if alloc_lookup_fw_priv() fails after
fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees
fw_sysfs directly instead of releasing the device reference with
put_device(). This may leave the reference count of the embedded struct
device unbalanced, resulting in a refcount leak.
The issue was identified by a static analysis tool I developed and
confirmed by manual review. Fix this by using put_device(fw_dev) in the
failure path and letting fw_dev_release() handle the final cleanup,
instead of freeing the instance directly from the error path.
Fixes: 97730bbb242c ("firmware_loader: Add firmware-upload support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260505091231.607089-1-lgs201920130244@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/firmware_loader/sysfs_upload.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/base/firmware_loader/sysfs_upload.c
+++ b/drivers/base/firmware_loader/sysfs_upload.c
@@ -340,7 +340,6 @@ firmware_upload_register(struct module *
goto free_fw_upload_priv;
}
fw_upload->priv = fw_sysfs;
- fw_sysfs->fw_upload_priv = fw_upload_priv;
fw_dev = &fw_sysfs->dev;
ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, NULL, 0, 0,
@@ -348,10 +347,12 @@ firmware_upload_register(struct module *
if (ret != 0) {
if (ret > 0)
ret = -EINVAL;
- goto free_fw_sysfs;
+ put_device(fw_dev);
+ goto free_fw_upload_priv;
}
fw_priv->is_paged_buf = true;
fw_sysfs->fw_priv = fw_priv;
+ fw_sysfs->fw_upload_priv = fw_upload_priv;
ret = device_add(fw_dev);
if (ret) {
@@ -362,9 +363,6 @@ firmware_upload_register(struct module *
return fw_upload;
-free_fw_sysfs:
- kfree(fw_sysfs);
-
free_fw_upload_priv:
kfree(fw_upload_priv);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0204/1266] cpufreq: intel_pstate: Sync policy->cur during CPU offline
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0203/1266] firmware_loader: fix device reference leak in firmware_upload_register() Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0205/1266] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
` (794 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada, Fushuai Wang,
Rafael J. Wysocki
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <wangfushuai@baidu.com>
commit bcbdaa1086c25a8a5d48e04e1b82fdfb0682b681 upstream.
When a CPU goes offline with HWP disabled, intel_pstate_set_min_pstate()
sets the MSR_IA32_PERF_CTL to minimum frequency to prevent SMT siblings
from being restricted. However, the policy->cur value was not updated,
leaving it at the previous value.
When the CPU comes back online, governor->limits() checks if target_freq
equals policy->cur and skips the frequency adjustment if they match. Since
policy->cur still holds the previous value, the governor does not call
cpufreq_driver->target to update MSR_IA32_PERF_CTL.
Fix this by synchronizing policy->cur with the hardware state when setting
minimum pstate during CPU offline.
Fixes: bb18008f8086 ("intel_pstate: Set core to min P state during core offline")
Cc: stable@vger.kernel.org # 3.15+
Suggested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
[ rjw: Subject refinement ]
Link: https://patch.msgid.link/20260520032119.30615-1-fushuai.wang@linux.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/intel_pstate.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2666,10 +2666,12 @@ static int intel_cpufreq_cpu_offline(str
* from getting to lower performance levels, so force the minimum
* performance on CPU offline to prevent that from happening.
*/
- if (hwp_active)
+ if (hwp_active) {
intel_pstate_hwp_offline(cpu);
- else
+ } else {
intel_pstate_set_min_pstate(cpu);
+ policy->cur = cpu->pstate.min_freq;
+ }
intel_pstate_exit_perf_limits(policy);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0205/1266] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0204/1266] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0206/1266] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
` (793 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Steven Rostedt,
Peter Zijlstra (Intel)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit dd29c017aed628076e915fe4cdfb5392fd4c5cab upstream.
RT migration is done aggressively. When a CPU schedules out a high
priority RT task for a lower priority task, it will look to see if there's
any RT tasks that are waiting to run on another CPU that is of higher
priority than the task this CPU is about to run. If it finds one, it will
pull that task over to the CPU and allow it to run there instead.
Normally, this pulling is done by looking at the RT overloaded mask (rto)
which contains all the CPUs in the scheduler domain with RT tasks that are
waiting to run due to a higher priority RT task currently running on their
CPU. The CPU that is about to schedule a lower priority task will grab the
rq lock of the overloaded CPU and move the RT task from that CPU's runqueue
to the local one and schedule the higher priority RT task.
This caused issues when a lot of CPUs would schedule a lower priority task
at the same time. They would all try to grab the same runqueue lock of
the CPU with the overloaded RT tasks. Only the first CPU that got in will
get that task. All the others would wait until they got the runqueue lock
and see there's nothing to pull and do nothing. On systems with lots of
CPUs, this caused a large latency (up to 500us) which is beyond what
PREEMPT_RT is to allow.
The solution to that was to create an RT_PUSH_IPI logic. When any CPU
wanted to pull a task, instead of grabbing the runqueue lock of the
overloaded CPU, it would start by sending an IPI to the overloaded CPU,
and that IPI handler would have the CPU with the waiting RT task do a push
instead. Then that handler would send an IPI to the next CPU with
overloaded RT tasks, and so on. Note, after the first CPU starts this
process, if another CPU wanted to do a pull, it would see that the process
has already begun and would only increment a counter to have the IPIs
continue again.
The RT_PUSH_IPI solved the latency problem with PREEMPT_RT but could cause
a new issue with non PREEMPT_RT. Namely, softirqs run in a threaded
context on PREEMPT_RT but they can run in an interrupt context in non-RT.
If an IPI lands on a CPU that has just woken up multiple RT tasks and the
current CPU is running a non RT or a low priority RT task, instead of
doing a push, it would simply do a schedule on that CPU. But if a softirq
was also executing on this CPU, the schedule would need to wait until the
softirq finished. Until then, the CPU would still be considered overloaded
as there are RT tasks still waiting to run on it.
A live lock occurred on a workload that was doing heavy networking traffic
on a large machine where the softirqs would run 500us out of 750us. And it
would also be waking up RT tasks, causing the RT pull logic to be
constantly executed.
When a softirq triggered on a CPU with RT tasks queued but not running
yet, and the other CPUs would see this CPU as being overloaded, they would
send an IPI over to it. The CPU would notice that the waiting RT tasks are
of higher priority than the currently running task and simply schedule
that CPU instead. But because the softirq was executing, before it could
schedule, it would receive another IPI to do the same. The amount of IPIs
would slow down the currently running softirq so much that before it could
return back to task context, it would execute another softirq never
allowing the CPU to schedule. This live locked that CPU.
As RT_PUSH_IPI was created to help PREEMPT_RT, make it default off if
PREEMPT_RT is not enabled.
Fixes: b6366f048e0c ("sched/rt: Use IPI to trigger RT task push migration instead of pulling")
Closes: https://lore.kernel.org/all/20260506235716.2530720-1-tj@kernel.org/
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260515103740.25ccbed8@gandalf.local.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/features.h | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -68,8 +68,16 @@ SCHED_FEAT(WARN_DOUBLE_CLOCK, false)
* rq lock and possibly create a large contention, sending an
* IPI to that CPU and let that CPU push the RT task to where
* it should go may be a better scenario.
+ *
+ * This is best for PREEMPT_RT, but for non-RT it can cause issues
+ * when preemption is disabled for long periods of time. Have
+ * it only default enabled for PREEMPT_RT.
*/
+# ifdef CONFIG_PREEMPT_RT
SCHED_FEAT(RT_PUSH_IPI, true)
+# else
+SCHED_FEAT(RT_PUSH_IPI, false)
+# endif
#endif
SCHED_FEAT(RT_RUNTIME_SHARE, false)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0206/1266] cpufreq: Fix hotplug-suspend race during reboot
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0205/1266] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0207/1266] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
` (792 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tianxiang Chen, Zhongqiu Han,
Rafael J. Wysocki
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianxiang Chen <nanmu@xiaomi.com>
commit a9029dd55696c651ee46912afa2a166fa456bb3e upstream.
During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.
This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:
Unable to handle kernel NULL pointer dereference
Call Trace:
do_kernel_fault+0x28/0x3c
cpufreq_suspend+0xdc/0x160
device_shutdown+0x18/0x200
kernel_restart+0x40/0x80
arm64_sys_reboot+0x1b0/0x200
Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.
Fixes: 65650b35133f ("cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown")
Signed-off-by: Tianxiang Chen <nanmu@xiaomi.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260408141914.35281-1-nanmu@xiaomi.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1970,6 +1970,7 @@ void cpufreq_suspend(void)
if (!cpufreq_driver)
return;
+ cpus_read_lock();
if (!has_target() && !cpufreq_driver->suspend)
goto suspend;
@@ -1989,6 +1990,7 @@ void cpufreq_suspend(void)
suspend:
cpufreq_suspended = true;
+ cpus_read_unlock();
}
/**
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0207/1266] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0206/1266] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0208/1266] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
` (791 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Zhongqiu Han,
Rafael J. Wysocki
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
commit 266d3dd8b757b48a576e90f018b51f7b7563cc32 upstream.
pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).
Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.
Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260416144621.93964-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/pcc-cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acp
}
kfree(output.pointer);
+ output.pointer = NULL;
+ output.length = ACPI_ALLOCATE_BUFFER;
capabilities[0] = 0x0;
capabilities[1] = 0x1;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0208/1266] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0207/1266] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0209/1266] clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Greg Kroah-Hartman
` (790 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, WenTao Liang, Thomas Gleixner,
Frederic Weisbecker
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 87bd2ad568e15b90d5f7d4bcd70342d05dad649c upstream.
In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.
Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/posix-cpu-timers.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1535,6 +1535,7 @@ static int do_cpu_nanosleep(const clocki
spin_lock_irq(&timer.it_lock);
error = posix_cpu_timer_set(&timer, flags, &it, NULL);
if (error) {
+ posix_cpu_timer_del(&timer);
spin_unlock_irq(&timer.it_lock);
return error;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0209/1266] clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0208/1266] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0210/1266] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
` (789 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kartik Rajput, Daniel Lezcano,
Jon Hunter
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kartik Rajput <kkartik@nvidia.com>
commit ca57bf46e7a94f8c53d05c376df9fcfdcb482100 upstream.
Tegra SoCs support multiple watchdogs; currently only one (WDT0) is
used. When multiple watchdogs are registered, tegra186_wdt_enable()
overwrites the TKEIE(x) register, discarding any existing watchdog
interrupt enable bits. As a result, enabling one watchdog inadvertently
disables interrupts for the others.
Fix this by preserving the existing TKEIE(x) value and updating it
using a read-modify-write sequence.
Fixes: 42cee19a9f83 ("clocksource: Add Tegra186 timers support")
Cc: stable@vger.kernel.org
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260507154557.2082697-2-kkartik@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/timer-tegra186.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/clocksource/timer-tegra186.c
+++ b/drivers/clocksource/timer-tegra186.c
@@ -144,7 +144,8 @@ static void tegra186_wdt_enable(struct t
u32 value;
/* unmask hardware IRQ, this may have been lost across powergate */
- value = TKEIE_WDT_MASK(wdt->index, 1);
+ value = readl(tegra->regs + TKEIE(wdt->tmr->hwirq));
+ value |= TKEIE_WDT_MASK(wdt->index, 1);
writel(value, tegra->regs + TKEIE(wdt->tmr->hwirq));
/* clear interrupt */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0210/1266] X.509: Fix validation of ASN.1 certificate header
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0209/1266] clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0211/1266] tools/mm/slabinfo: Fix trace disable logic inversion Greg Kroah-Hartman
` (788 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Lukas Wunner,
Ignat Korchagin, Alistair Francis, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 3b626ba431c4501512ad07549310685e07fe4706 upstream.
x509_load_certificate_list() seeks to enforce that a certificate starts
with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
and less than 65535 bytes).
But it only enforces that *either* of those two byte values are present,
instead of checking for the *conjunction* of the two values. Fix it.
Fixes: 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.7+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/asymmetric_keys/x509_loader.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/asymmetric_keys/x509_loader.c
+++ b/crypto/asymmetric_keys/x509_loader.c
@@ -20,7 +20,7 @@ int x509_load_certificate_list(const u8
*/
if (end - p < 4)
goto dodgy_cert;
- if (p[0] != 0x30 &&
+ if (p[0] != 0x30 ||
p[1] != 0x82)
goto dodgy_cert;
plen = (p[2] << 8) | p[3];
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0211/1266] tools/mm/slabinfo: Fix trace disable logic inversion
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0210/1266] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0212/1266] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
` (787 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, Xuewen Wang,
Vlastimil Babka (SUSE)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuewen Wang <wangxuewen@kylinos.cn>
commit 235ab68d67eadbef1fdbfb771f21f5bacc77a2ae upstream.
The disable trace path in slab_debug() had a logic error where it would
set trace=1 instead of trace=0. This made trace functionality permanently
enabled once turned on for any slab cache.
Fixes: a87615b8f9e2 ("SLUB: slabinfo upgrade")
Cc: stable@vger.kernel.org
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
WARNING: From:/Signed-off-by: email address mismatch: 'From: wangxuewen <18810879172@163.com>' != 'Signed-off-by: wangxuewen <wangxuewen@kylinos.cn>'
Link: https://patch.msgid.link/20260518062159.80664-2-wangxuewen@kylinos.cn
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/mm/slabinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/mm/slabinfo.c
+++ b/tools/mm/slabinfo.c
@@ -795,7 +795,7 @@ static void slab_debug(struct slabinfo *
fprintf(stderr, "%s can only enable trace for one slab at a time\n", s->name);
}
if (!tracing && s->trace)
- set_obj(s, "trace", 1);
+ set_obj(s, "trace", 0);
}
static void totals(void)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0212/1266] tools/mm/slabinfo: fix total_objects attribute name
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0211/1266] tools/mm/slabinfo: Fix trace disable logic inversion Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0213/1266] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
` (786 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, SeongJae Park,
Vlastimil Babka (SUSE)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 892a7864730775c3dbee2a39e9ead4fa8d4256e7 upstream.
SLUB exports the total_objects sysfs attribute, but slabinfo tries to read
objects_total. As a result, the lookup fails and the field remains zero.
Use the correct attribute name and rename the corresponding structure
member to match.
Fixes: 205ab99dd103 ("slub: Update statistics handling for variable order slabs")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Link: https://patch.msgid.link/96556748872BB47E+20260612071359.649946-1-chenyichong@uniontech.com
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/mm/slabinfo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/tools/mm/slabinfo.c
+++ b/tools/mm/slabinfo.c
@@ -33,7 +33,7 @@ struct slabinfo {
unsigned int hwcache_align, object_size, objs_per_slab;
unsigned int sanity_checks, slab_size, store_user, trace;
int order, poison, reclaim_account, red_zone;
- unsigned long partial, objects, slabs, objects_partial, objects_total;
+ unsigned long partial, objects, slabs, objects_partial, total_objects;
unsigned long alloc_fastpath, alloc_slowpath;
unsigned long free_fastpath, free_slowpath;
unsigned long free_frozen, free_add_partial, free_remove_partial;
@@ -1256,7 +1256,7 @@ static void read_slab_dir(void)
slab->object_size = get_obj("object_size");
slab->objects = get_obj("objects");
slab->objects_partial = get_obj("objects_partial");
- slab->objects_total = get_obj("objects_total");
+ slab->total_objects = get_obj("total_objects");
slab->objs_per_slab = get_obj("objs_per_slab");
slab->order = get_obj("order");
slab->partial = get_obj("partial");
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0213/1266] HID: wacom: stop hardware after post-start probe failures
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0212/1266] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0214/1266] HID: letsketch: fix UAF on inrange_timer at driver unbind Greg Kroah-Hartman
` (785 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Dmitry Torokhov, Jiri Kosina
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit ec2612b8ad9e642596db011dd8b6568ef1edeaa1 upstream.
wacom_parse_and_register() starts HID hardware before registering inputs
and initializing pad LEDs/remotes. Those later steps can fail, but their
error paths currently release Wacom resources without stopping the HID
hardware.
Route post-hid_hw_start() failures through hid_hw_stop() before
releasing driver resources.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: c1d6708bf0d3 ("HID: wacom: Do not register input devices until after hid_hw_start")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2422,16 +2422,16 @@ static int wacom_parse_and_register(stru
error = wacom_register_inputs(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
if (wacom->wacom_wac.features.device_type & WACOM_DEVICETYPE_PAD) {
error = wacom_initialize_leds(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
error = wacom_initialize_remotes(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
}
if (!wireless) {
@@ -2445,14 +2445,14 @@ static int wacom_parse_and_register(stru
cancel_delayed_work_sync(&wacom->init_work);
_wacom_query_tablet_data(wacom);
error = -ENODEV;
- goto fail_quirks;
+ goto fail_hw_stop;
}
if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) {
error = hid_hw_open(hdev);
if (error) {
hid_err(hdev, "hw open failed\n");
- goto fail_quirks;
+ goto fail_hw_stop;
}
}
@@ -2461,7 +2461,7 @@ static int wacom_parse_and_register(stru
return 0;
-fail_quirks:
+fail_hw_stop:
hid_hw_stop(hdev);
fail:
wacom_release_resources(wacom);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0214/1266] HID: letsketch: fix UAF on inrange_timer at driver unbind
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0213/1266] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0215/1266] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
` (784 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Manish Khadka, Jiri Kosina
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Khadka <maskmemanish@gmail.com>
commit 46c8beeccd8ab2c863827254a85ea877654a3534 upstream.
letsketch_driver does not provide a .remove callback, but
letsketch_probe() arms a per-device timer:
timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);
The timer is re-armed from letsketch_raw_event() with a 100 ms
timeout on every pen-in-range report, and its callback dereferences
data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.
letsketch_data is allocated with devm_kzalloc(), and its input_dev
fields are devm-allocated via letsketch_setup_input_tablet(). On
device unbind (USB unplug or rmmod), the HID core runs its default
teardown and devm cleanup frees both letsketch_data and the input
devices. Because no .remove callback exists, nothing drains the
timer first: if raw_event armed it within ~100 ms of the unbind,
the pending timer fires on freed memory. This is a UAF read of
data and of data->input_tablet, followed by input_report_key() /
input_sync() into the freed input_dev.
The same problem can occur on the probe error path: if
hid_hw_start() enabled I/O on an always-poll-quirk device and then
failed, raw_event may have armed the timer before devm releases
data.
Fix by adding a .remove callback that calls hid_hw_stop() first.
hid_hw_stop() synchronously kills the URBs that deliver raw_event(),
so once it returns no path can re-arm the timer. timer_shutdown_sync()
then drains any in-flight callback and permanently disables further
mod_timer() calls. Apply the same timer_shutdown_sync() in the probe
error path so the timer is guaranteed not to outlive data.
Fixes: 33a5c2793451 ("HID: Add new Letsketch tablet driver")
Cc: stable@vger.kernel.org
Signed-off-by: Manish Khadka <maskmemanish@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-letsketch.c | 36 +++++++++++++++++++++++++++++++++---
1 file changed, 33 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-letsketch.c
+++ b/drivers/hid/hid-letsketch.c
@@ -295,13 +295,42 @@ static int letsketch_probe(struct hid_de
ret = letsketch_setup_input_tablet(data);
if (ret)
- return ret;
+ goto err_shutdown_timer;
ret = letsketch_setup_input_tablet_pad(data);
if (ret)
- return ret;
+ goto err_shutdown_timer;
- return hid_hw_start(hdev, HID_CONNECT_HIDRAW);
+ ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
+ if (ret)
+ goto err_shutdown_timer;
+
+ return 0;
+
+err_shutdown_timer:
+ /*
+ * Drain any pending callback and permanently disable the timer
+ * before devm releases data: if hid_hw_start() enabled I/O on an
+ * always-poll-quirk device and then failed, raw_event may have
+ * armed the timer already.
+ */
+ timer_shutdown_sync(&data->inrange_timer);
+ return ret;
+}
+
+static void letsketch_remove(struct hid_device *hdev)
+{
+ struct letsketch_data *data = hid_get_drvdata(hdev);
+
+ /*
+ * hid_hw_stop() synchronously kills the URBs that deliver
+ * raw_event(), so once it returns no path can re-arm
+ * inrange_timer. timer_shutdown_sync() then drains any
+ * in-flight callback and permanently disables further
+ * mod_timer() calls before devm releases data.
+ */
+ hid_hw_stop(hdev);
+ timer_shutdown_sync(&data->inrange_timer);
}
static const struct hid_device_id letsketch_devices[] = {
@@ -314,6 +343,7 @@ static struct hid_driver letsketch_drive
.name = "letsketch",
.id_table = letsketch_devices,
.probe = letsketch_probe,
+ .remove = letsketch_remove,
.raw_event = letsketch_raw_event,
};
module_hid_driver(letsketch_driver);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0215/1266] HID: lg-g15: cancel pending work on remove to fix a use-after-free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0214/1266] HID: letsketch: fix UAF on inrange_timer at driver unbind Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0216/1266] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
` (783 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Maoyi Xie,
Hans de Goede, Jiri Kosina
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 7705b4140d188ce22656f6e541ae7ef834c7e11a upstream.
lg_g15_data is allocated with devm and holds a work item. The report
handlers schedule that work straight from device input.
lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,
and lg_g510_leds_event() does it too. The worker dereferences the
lg_g15_data back through container_of.
The driver had no remove callback and never cancelled the work. So if a
report scheduled the work and the keyboard was then unplugged, devres
freed lg_g15_data while the work was still pending or running, and the
worker touched freed memory. This is a use-after-free. It is reachable
as a race on device unplug.
Add a remove callback that cancels the work before devres frees the
state. g15->work is only initialized for the models that schedule it
(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the
cancel on g15->work.func to avoid cancelling a work that was never set
up. The g15 NULL test mirrors the one already in lg_g15_raw_event().
Fixes: 97b741aba918 ("HID: lg-g15: Add keyboard and LCD backlight control")
Cc: stable@vger.kernel.org
Suggested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lg-g15.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/hid/hid-lg-g15.c
+++ b/drivers/hid/hid-lg-g15.c
@@ -945,11 +945,27 @@ static const struct hid_device_id lg_g15
};
MODULE_DEVICE_TABLE(hid, lg_g15_devices);
+static void lg_g15_remove(struct hid_device *hdev)
+{
+ struct lg_g15_data *g15 = hid_get_drvdata(hdev);
+
+ /*
+ * g15->work is only initialized for the models that schedule it
+ * (G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so only
+ * cancel it when it was set up.
+ */
+ if (g15 && g15->work.func)
+ cancel_work_sync(&g15->work);
+
+ hid_hw_stop(hdev);
+}
+
static struct hid_driver lg_g15_driver = {
.name = "lg-g15",
.id_table = lg_g15_devices,
.raw_event = lg_g15_raw_event,
.probe = lg_g15_probe,
+ .remove = lg_g15_remove,
};
module_hid_driver(lg_g15_driver);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0216/1266] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0215/1266] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0217/1266] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
` (782 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada, Zhang Lixu,
Jiri Kosina, Andy Shevchenko, Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit f784fcea450617055d2d12eec5b2f6e0e38bf878 upstream.
sensor_hub_input_attr_get_raw_value() is limited to returning a single
32-bit value, which is insufficient for sensors that report data larger
than 32 bits, such as a quaternion with four s16 elements.
Add sensor_hub_input_attr_read_values() that accepts a caller-provided
buffer and accumulates incoming data until the buffer is full. The two
paths are distinguished in sensor_hub_raw_event() by pending.max_raw_size
being non-zero, preserving backward compatibility.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Co-developed-by: Zhang Lixu <lixu.zhang@intel.com>
Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 77 +++++++++++++++++++++++++++++++++++++----
include/linux/hid-sensor-hub.h | 25 +++++++++++++
2 files changed, 96 insertions(+), 6 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -286,6 +286,54 @@ done_proc:
}
EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
+int sensor_hub_input_attr_read_values(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id, u32 attr_usage_id,
+ u32 report_id,
+ enum sensor_hub_read_flags flag,
+ u32 buffer_size, u8 *buffer)
+{
+ struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
+ struct hid_report *report;
+ unsigned long flags;
+ long cycles;
+ int ret;
+
+ report = sensor_hub_report(report_id, hsdev->hdev, HID_INPUT_REPORT);
+ if (!report)
+ return -EINVAL;
+
+ mutex_lock(hsdev->mutex_ptr);
+ if (flag == SENSOR_HUB_SYNC) {
+ memset(&hsdev->pending, 0, sizeof(hsdev->pending));
+ init_completion(&hsdev->pending.ready);
+ hsdev->pending.usage_id = usage_id;
+ hsdev->pending.attr_usage_id = attr_usage_id;
+ hsdev->pending.max_raw_size = buffer_size;
+ hsdev->pending.raw_data = buffer;
+
+ spin_lock_irqsave(&data->lock, flags);
+ hsdev->pending.status = true;
+ spin_unlock_irqrestore(&data->lock, flags);
+ }
+ mutex_lock(&data->mutex);
+ hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
+ mutex_unlock(&data->mutex);
+ ret = 0;
+ if (flag == SENSOR_HUB_SYNC) {
+ cycles = wait_for_completion_interruptible_timeout(&hsdev->pending.ready,
+ HZ * 5);
+ if (cycles == 0)
+ ret = -ETIMEDOUT;
+ else if (cycles < 0)
+ ret = cycles;
+
+ hsdev->pending.status = false;
+ }
+ mutex_unlock(hsdev->mutex_ptr);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(sensor_hub_input_attr_read_values);
int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
u32 usage_id,
@@ -480,6 +528,8 @@ static int sensor_hub_raw_event(struct h
struct hid_collection *collection = NULL;
void *priv = NULL;
struct hid_sensor_hub_device *hsdev = NULL;
+ u32 copy_size;
+ u32 avail;
hid_dbg(hdev, "sensor_hub_raw_event report id:0x%x size:%d type:%d\n",
report->id, size, report->type);
@@ -520,12 +570,27 @@ static int sensor_hub_raw_event(struct h
hsdev->pending.attr_usage_id ==
report->field[i]->logical)) {
hid_dbg(hdev, "data was pending ...\n");
- hsdev->pending.raw_data = kmemdup(ptr, sz, GFP_ATOMIC);
- if (hsdev->pending.raw_data)
- hsdev->pending.raw_size = sz;
- else
- hsdev->pending.raw_size = 0;
- complete(&hsdev->pending.ready);
+ if (hsdev->pending.max_raw_size) {
+ if (hsdev->pending.index < hsdev->pending.max_raw_size) {
+ avail = hsdev->pending.max_raw_size - hsdev->pending.index;
+ copy_size = clamp(sz, 0U, avail);
+
+ memcpy(hsdev->pending.raw_data + hsdev->pending.index,
+ ptr, copy_size);
+ hsdev->pending.index += copy_size;
+ if (hsdev->pending.index >= hsdev->pending.max_raw_size) {
+ hsdev->pending.raw_size = hsdev->pending.index;
+ complete(&hsdev->pending.ready);
+ }
+ }
+ } else {
+ hsdev->pending.raw_data = kmemdup(ptr, sz, GFP_ATOMIC);
+ if (hsdev->pending.raw_data)
+ hsdev->pending.raw_size = sz;
+ else
+ hsdev->pending.raw_size = 0;
+ complete(&hsdev->pending.ready);
+ }
}
if (callback->capture_sample) {
if (report->field[i]->logical)
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -43,6 +43,8 @@ struct hid_sensor_hub_attribute_info {
* @attr_usage_id: Usage Id of a field, E.g. X-AXIS for a gyro.
* @raw_size: Response size for a read request.
* @raw_data: Place holder for received response.
+ * @index: Current write index into raw_data for multi-byte reads.
+ * @max_raw_size: Total buffer size for multi-byte reads; 0 for single-value reads.
*/
struct sensor_hub_pending {
bool status;
@@ -51,6 +53,8 @@ struct sensor_hub_pending {
u32 attr_usage_id;
int raw_size;
u8 *raw_data;
+ u32 index;
+ u32 max_raw_size;
};
/**
@@ -183,6 +187,27 @@ int sensor_hub_input_attr_get_raw_value(
);
/**
+ * sensor_hub_input_attr_read_values() - Synchronous multi-byte read request
+ * @hsdev: Hub device instance.
+ * @usage_id: Attribute usage id of parent physical device as per spec
+ * @attr_usage_id: Attribute usage id as per spec
+ * @report_id: Report id to look for
+ * @flag: Synchronous or asynchronous read
+ * @buffer_size: Size of the buffer in bytes
+ * @buffer: Buffer to store the read data
+ *
+ * Issues a synchronous or asynchronous read request for an input attribute,
+ * accumulating data into the provided buffer until it is full.
+ * Return: 0 on success, -ETIMEDOUT if the device did not respond, or a
+ * negative error code.
+ */
+int sensor_hub_input_attr_read_values(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id, u32 attr_usage_id,
+ u32 report_id,
+ enum sensor_hub_read_flags flag,
+ u32 buffer_size, u8 *buffer);
+
+/**
* sensor_hub_set_feature() - Feature set request
* @hsdev: Hub device instance.
* @report_id: Report id to look for
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0217/1266] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0216/1266] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0218/1266] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
` (781 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+217eb327242d08197efb,
Tristan Madani, Viacheslav Dubeyko
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
commit d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf upstream.
hfs_bnode_read() can return early without writing to the output buffer
when is_bnode_offset_valid() fails or when check_and_correct_requested_
length() corrects the length to zero. Callers such as hfs_bnode_read_
u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.
Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks. This
ensures all callers in both hfs and hfsplus get a deterministic zero
value regardless of which early-return path is taken.
Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Tested-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260505111300.3592757-3-tristmd@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfs/bnode.c | 2 ++
fs/hfsplus/bnode.c | 2 ++
2 files changed, 4 insertions(+)
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -64,6 +64,8 @@ void hfs_bnode_read(struct hfs_bnode *no
int bytes_read;
int bytes_to_read;
+ memset(buf, 0, len);
+
if (!is_bnode_offset_valid(node, off))
return;
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -25,6 +25,8 @@ void hfs_bnode_read(struct hfs_bnode *no
struct page **pagep;
int l;
+ memset(buf, 0, len);
+
if (!is_bnode_offset_valid(node, off))
return;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0218/1266] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0217/1266] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0219/1266] media: mtk-jpeg: cancel workqueue on release for supported platforms only Greg Kroah-Hartman
` (780 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+62f0f99d2f2bb8e3bbd7,
Deepanshu Kartikey, Ryusuke Konishi, Viacheslav Dubeyko
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9 upstream.
Syzbot reported a hung task in nilfs_transaction_begin() where multiple
tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds
waiting to acquire ns_segctor_sem for read:
INFO: task syz.0.17:5918 blocked for more than 143 seconds.
Call Trace:
schedule+0x164/0x360
rwsem_down_read_slowpath+0x6d9/0x940
down_read+0x99/0x2e0
nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221
nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921
notify_change+0xc1a/0xf40
chmod_common+0x273/0x4a0
do_fchmodat+0x12d/0x230
The writer holding ns_segctor_sem was a concurrent
NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting
per-element warnings from nilfs_sufile_updatev():
__nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78
nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186
nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]
nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]
nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]
nilfs_segctor_do_construct+0x1f55/0x76c0
nilfs_clean_segments+0x3bd/0xa50
nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]
nilfs_ioctl+0x261f/0x2780
The root cause is that user-supplied segment numbers are not validated
before nilfs_clean_segments() begins doing work; the range check on
each segnum is performed deep inside the call chain by
nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry
while still holding the segctor lock and the sufile mi_sem. Under load
(repeated invocations across multiple mounts saturating the global
printk path), the cumulative printk latency keeps ns_segctor_sem held
long enough to trip the hung_task watchdog, blocking concurrent
operations such as chmod() that need ns_segctor_sem for read.
Fix by validating the contents of kbufs[4] in nilfs_clean_segments()
immediately after acquiring ns_segctor_sem via nilfs_transaction_lock().
Holding ns_segctor_sem serializes the check against
nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation
uses a consistent value. Out-of-range segment numbers are rejected
with -EINVAL before any segment-cleaning work begins, so the bad
entries never reach the per-element diagnostic path inside
nilfs_sufile_updatev().
Reported-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=62f0f99d2f2bb8e3bbd7
Tested-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Fixes: 071cb4b81987 ("nilfs2: eliminate removal list of segments")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/segment.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2504,12 +2504,33 @@ int nilfs_clean_segments(struct super_bl
struct nilfs_sc_info *sci = nilfs->ns_writer;
struct nilfs_transaction_info ti;
int err;
+ size_t i, nfreesegs = argv[4].v_nmembs;
+ __u64 *segnumv = kbufs[4];
if (unlikely(!sci))
return -EROFS;
nilfs_transaction_lock(sb, &ti, 1);
+ /*
+ * Validate segment numbers under ns_segctor_sem (held for write
+ * by nilfs_transaction_lock above) so the check is serialized
+ * against nilfs_ioctl_resize(), which can modify ns_nsegments.
+ * Rejecting bad input here, before any segment-cleaning work
+ * begins, avoids the per-element diagnostic path inside
+ * nilfs_sufile_updatev() that would otherwise run under this
+ * same lock and stall concurrent readers.
+ */
+ for (i = 0; i < nfreesegs; i++) {
+ if (segnumv[i] >= nilfs->ns_nsegments) {
+ nilfs_err(sb,
+ "Segment number %llu to be freed is out of range",
+ (unsigned long long)segnumv[i]);
+ err = -EINVAL;
+ goto bail_unlock;
+ }
+ }
+
err = nilfs_mdt_save_to_shadow_map(nilfs->ns_dat);
if (unlikely(err))
goto out_unlock;
@@ -2550,6 +2571,7 @@ int nilfs_clean_segments(struct super_bl
sci->sc_freesegs = NULL;
sci->sc_nfreesegs = 0;
nilfs_mdt_clear_shadow_map(nilfs->ns_dat);
+ bail_unlock:
nilfs_transaction_unlock(sb);
return err;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0219/1266] media: mtk-jpeg: cancel workqueue on release for supported platforms only
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0218/1266] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0220/1266] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
` (779 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis-Alexis Eyraud,
Nicolas Dufresne, Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
commit b1845a227fda37b2fe5327df3ca0015d7e290235 upstream.
Since a recent fix the mtk_jpeg_release function cancels any pending
or running work present in the driver workqueue using
cancel_work_sync function.
Currently, only the multicore based variants use this workqueue and they
have the jpeg_worker platform data field initialized with a workqueue
callback function. For the others, this field value remain NULL by
default.
The cancel_work_sync function is unconditionally called in
mtk_jpeg_release function, even for the variants that do not use the
workqueue. This call generates a WARN_ON print in __flush_work because
the workqueue callback function presence check fails in __flush_work
function (used by cancel_work_sync).
So, to avoid these warnings, call cancel_work_sync only if a workqueue
callback is defined in platform data.
Fixes: 34c519feef3e ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work")
Cc: stable@vger.kernel.org
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1214,7 +1214,8 @@ static int mtk_jpeg_release(struct file
struct mtk_jpeg_dev *jpeg = video_drvdata(file);
struct mtk_jpeg_ctx *ctx = mtk_jpeg_fh_to_ctx(file->private_data);
- cancel_work_sync(&ctx->jpeg_work);
+ if (jpeg->variant->jpeg_worker)
+ cancel_work_sync(&ctx->jpeg_work);
mutex_lock(&jpeg->lock);
v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0220/1266] xfs: use null daddr for unset first bad log block
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0219/1266] media: mtk-jpeg: cancel workqueue on release for supported platforms only Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0221/1266] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
` (778 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong,
syzbot+b7dfbed0c6c2b5e9fd34, Yousef Alhouseen, Carlos Maiolino
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit cc9af5e461ea5f6e37738f3f1e41c45a9b7f45d6 upstream.
xlog_do_recovery_pass() may return before setting first_bad. The caller
must distinguish that case from an error at a valid log block, including
block zero after the log wraps.
Initialize first_bad to XFS_BUF_DADDR_NULL and test it explicitly before
treating the error as a torn write.
Fixes: 7088c4136fa1 ("xfs: detect and trim torn writes during log recovery")
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Reported-by: syzbot+b7dfbed0c6c2b5e9fd34@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b7dfbed0c6c2b5e9fd34
Cc: stable@vger.kernel.org # v4.5
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_log_recover.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1028,7 +1028,7 @@ xlog_verify_head(
{
struct xlog_rec_header *tmp_rhead;
char *tmp_buffer;
- xfs_daddr_t first_bad;
+ xfs_daddr_t first_bad = XFS_BUF_DADDR_NULL;
xfs_daddr_t tmp_rhead_blk;
int found;
int error;
@@ -1057,7 +1057,8 @@ xlog_verify_head(
*/
error = xlog_do_recovery_pass(log, *head_blk, tmp_rhead_blk,
XLOG_RECOVER_CRCPASS, &first_bad);
- if ((error == -EFSBADCRC || error == -EFSCORRUPTED) && first_bad) {
+ if ((error == -EFSBADCRC || error == -EFSCORRUPTED) &&
+ first_bad != XFS_BUF_DADDR_NULL) {
/*
* We've hit a potential torn write. Reset the error and warn
* about it.
@@ -3555,4 +3556,3 @@ xlog_recover_cancel(
if (xlog_recovery_needed(log))
xlog_recover_cancel_intents(log);
}
-
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0221/1266] xfs: fix unreachable BIGTIME check in dquot flush validation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0220/1266] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0222/1266] bpf: Reject fragmented frames in devmap Greg Kroah-Hartman
` (777 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Nepomnyashih, Darrick J. Wong,
Allison Henderson, Carlos Maiolino
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <sdl@nppct.ru>
commit 03866d130ed33ab68cc7faaf4bf2c4abef96d42e upstream.
The dqp->q_id == 0 check inside the XFS_DQTYPE_BIGTIME block is
unreachable because root dquots return successfully earlier. Reject root
dquots with XFS_DQTYPE_BIGTIME before that early return, preserving the
intended validation and removing the unreachable condition.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4ea1ff3b4968 ("xfs: widen ondisk quota expiration timestamps to handle y2038+")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Allison Henderson <achender@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_dquot.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1174,6 +1174,14 @@ xfs_qm_dqflush_check(
type != XFS_DQTYPE_PROJ)
return __this_address;
+ /* bigtime flag should never be set on root dquots */
+ if (dqp->q_type & XFS_DQTYPE_BIGTIME) {
+ if (!xfs_has_bigtime(dqp->q_mount))
+ return __this_address;
+ if (dqp->q_id == 0)
+ return __this_address;
+ }
+
if (dqp->q_id == 0)
return NULL;
@@ -1189,14 +1197,6 @@ xfs_qm_dqflush_check(
!dqp->q_rtb.timer)
return __this_address;
- /* bigtime flag should never be set on root dquots */
- if (dqp->q_type & XFS_DQTYPE_BIGTIME) {
- if (!xfs_has_bigtime(dqp->q_mount))
- return __this_address;
- if (dqp->q_id == 0)
- return __this_address;
- }
-
return NULL;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0222/1266] bpf: Reject fragmented frames in devmap
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0221/1266] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
@ 2026-07-21 15:10 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0223/1266] bpf: Restore sysctl new-value from 1 to 0 Greg Kroah-Hartman
` (776 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Zhengchuan Liang,
Xin Liu, Zhao Zhang, Ren Wei, Emil Tsalapatis,
Toke Høiland-Jørgensen, Alexei Starovoitov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Zhang <zzhan461@ucr.edu>
commit aa496720618f1a6054f1c870bf10b4f6c99bf656 upstream.
Devmap broadcast redirects clone the packet for all but the last
destination.
For native XDP, that clone path copies only the linear xdp_frame data,
while fragmented frames keep skb_shared_info in tailroom outside the
linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but
without valid frag metadata, and the later free path can interpret
uninitialized tail data as skb_shared_info, leading to an out-of-bounds
access during frame return.
Reject fragmented native XDP frames in dev_map_enqueue_clone().
Add the same restriction to the generic XDP clone path in
dev_map_redirect_clone(). Generic XDP represents fragmented packets as
nonlinear skbs, and rejecting them here keeps clone-based broadcast
support aligned between native and generic XDP.
Fixes: e624d4ed4aa8 ("xdp: Extend xdp_redirect_map with broadcast support")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Zhao Zhang <zzhan461@ucr.edu>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/21c2d153dd25603d359069a02bf06779b51f6423.1780385378.git.zzhan461@ucr.edu
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/devmap.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -558,6 +558,10 @@ static int dev_map_enqueue_clone(struct
{
struct xdp_frame *nxdpf;
+ /* Frags live outside the linear frame and cannot be cloned safely. */
+ if (unlikely(xdp_frame_has_frags(xdpf)))
+ return -EOPNOTSUPP;
+
nxdpf = xdpf_clone(xdpf);
if (!nxdpf)
return -ENOMEM;
@@ -703,6 +707,9 @@ static int dev_map_redirect_clone(struct
struct sk_buff *nskb;
int err;
+ if (unlikely(skb_is_nonlinear(skb)))
+ return -EOPNOTSUPP;
+
nskb = skb_clone(skb, GFP_ATOMIC);
if (!nskb)
return -ENOMEM;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0223/1266] bpf: Restore sysctl new-value from 1 to 0
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-07-21 15:10 ` [PATCH 6.6 0222/1266] bpf: Reject fragmented frames in devmap Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0224/1266] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
` (775 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Zilin Guan,
Dawei Feng, Jiayuan Chen, Xu Kuohai, Alexei Starovoitov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 2566c3b24219c5b30e35205cba029ff34ff7c78b upstream.
Commit 4e63acdff864 ("bpf: Introduce bpf_sysctl_{get,set}_new_value
helpers") changed the success return value to 0, but failed to update the
corresponding check in __cgroup_bpf_run_filter_sysctl(). Since
bpf_prog_run_array_cg() now returns 0 on success, the legacy ret == 1
condition is never satisfied. As a result, the modified value is ignored,
and bpf_sysctl_set_new_value() fails to replace the write buffer.
Fix this by checking for a return value of 0 instead, so cgroup/sysctl
programs can correctly replace the pending sysctl buffer.
This bug was discovered during a manual code review. Tested via a
cgroup/sysctl BPF reproducer overriding writes to a target sysctl.
Pre-fix, bpf_sysctl_set_new_value("foo") was silently ignored: the write
returned 8192 and the value remained "600". Post-fix, the BPF replacement
buffer properly propagates: the write returns 3 and the value updates to
"foo".
Fixes: f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean")
Cc: stable@vger.kernel.org
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20260603105317.944304-4-dawei.feng@seu.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1775,7 +1775,7 @@ int __cgroup_bpf_run_filter_sysctl(struc
kfree(ctx.cur_val);
- if (ret == 1 && ctx.new_updated) {
+ if (!ret && ctx.new_updated) {
kvfree(*buf);
*buf = ctx.new_val;
*pcount = ctx.new_len;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0224/1266] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0223/1266] bpf: Restore sysctl new-value from 1 to 0 Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0225/1266] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
` (774 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Andrew Lunn,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 47b6bcef6e679593d2e86e04ee72c46a4e2f7139 upstream.
kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *
KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that
skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can
deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or
leave a short trailing remainder on a later loop iteration. Either case
underflows usb_packet_length to about 65530.
That bypasses the usb_packet_length < ether_packet_length truncation path.
The device-supplied ether_packet_length, a le16 up to 65535 read from
header_start[2], then drives a memcmp() and the following skb_trim() and
skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,
which is 14000 bytes. That is an out of bounds read.
Require both the start and end framing headers to be present before
subtracting them, on every loop iteration.
Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/178211531778.2216480.12637613349790980750@maoyixie.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/kalmia.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/net/usb/kalmia.c
+++ b/drivers/net/usb/kalmia.c
@@ -276,6 +276,14 @@ kalmia_rx_fixup(struct usbnet *dev, stru
"Received header: %6phC. Package length: %i\n",
header_start, skb->len - KALMIA_HEADER_LENGTH);
+ /* both framing headers must be present before we subtract
+ * them, otherwise usb_packet_length underflows and the
+ * device-supplied ether_packet_length drives an out of bounds
+ * access below
+ */
+ if (skb->len < 2 * KALMIA_HEADER_LENGTH)
+ return 0;
+
/* subtract start header and end header */
usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
ether_packet_length = get_unaligned_le16(&header_start[2]);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0225/1266] usb: cdc_acm: Add quirk for Uniden BC125AT scanner
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0224/1266] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0226/1266] usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Greg Kroah-Hartman
` (773 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jared Baldridge, stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jared Baldridge <jrb@expunge.us>
commit 6eba58568f6cc3ff8515a00b05e258d8cfb72b72 upstream.
Uniden BC125AT radio scanner has a USB interface which fails to work
with the cdc_acm driver:
usb 1-1: new full-speed USB device number 2 using uhci_hcd
cdc_acm 1-1:1.0: Zero length descriptor references
cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -22
usbcore: registered new interface driver cdc_acm
Adding the NO_UNION_NORMAL quirk for the device fixes the issue:
usb 1-1: new full-speed USB device number 2 using uhci_hcd
cdc_acm 1-1:1.0: ttyACM0: USB ACM device
usbcore: registered new interface driver cdc_acm
`lsusb -v` of the device:
Bus 001 Device 002: ID 1965:0017 Uniden Corporation BC125AT
Negotiated speed: Full Speed (12Mbps)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0 [unknown]
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x1965 Uniden Corporation
idProduct 0x0017 BC125AT
bcdDevice 0.01
iManufacturer 1 Uniden America Corp.
iProduct 2 BC125AT
iSerial 3 0001
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0030
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 10
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
Signed-off-by: Jared Baldridge <jrb@expunge.us>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260530221959.612526-1-jrb@expunge.us
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1810,6 +1810,9 @@ static const struct usb_device_id acm_id
{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
},
+ { USB_DEVICE(0x1965, 0x0017), /* Uniden BC125AT */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
{ USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
},
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0226/1266] usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0225/1266] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0227/1266] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
` (772 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Haoxiang Li, Peter Chen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 3348f444a4ce43dd5c2d1aa41634cb6eff33aa64 upstream.
cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array with
cdnsp_alloc_stream_ctx(). If a later stream ring allocation or stream
mapping update fails, the error path frees the allocated stream rings
and stream_rings array, but leaves stream_ctx_array allocated.
Free the stream context array before falling through to the stream_rings
cleanup path.
Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20260622052627.696373-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdnsp-mem.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/cdns3/cdnsp-mem.c
+++ b/drivers/usb/cdns3/cdnsp-mem.c
@@ -632,6 +632,8 @@ cleanup_rings:
}
}
+ cdnsp_free_stream_ctx(pdev, pep);
+
cleanup_stream_rings:
kfree(pep->stream_info.stream_rings);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0227/1266] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0226/1266] usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0228/1266] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Greg Kroah-Hartman
` (771 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
Rodrigo Lugathe da Conceição Alves, stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
commit bd728c3d9b1cc0bb0fda6a7055c5c8b55d7477b2 upstream.
The VIA Labs, Inc. USB 2.0 hub controller (2109:2817),
found in a KVM switch, fails to enumerate high-power devices during
cold boot and system restart.
Applying the kernel parameter
usbcore.quirks=2109:2817:k
resolves the issue.
Enumeration failure log:
usb 1-1.2.3: device descriptor read/64, error -32
usb 1-1.2.3: Device not responding to setup address.
usb 1-1.2.3: device not accepting address 11, error -71
usb 1-1.2-port3: unable to enumerate USB device
Add USB_QUIRK_NO_LPM for this device.
Signed-off-by: Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260603113626.395612-1-lugathe2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -574,6 +574,9 @@ static const struct usb_device_id usb_qu
/* VLI disk */
{ USB_DEVICE(0x2109, 0x0711), .driver_info = USB_QUIRK_NO_LPM },
+ /* VIA Labs, Inc. USB2.0 Hub */
+ { USB_DEVICE(0x2109, 0x2817), .driver_info = USB_QUIRK_NO_LPM },
+
/* Raydium Touchscreen */
{ USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0228/1266] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0227/1266] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0229/1266] usb: free iso schedules on failed submit Greg Kroah-Hartman
` (770 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, WenTao Liang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 692c354bef03b77b30e57e61934da502c8a12d45 upstream.
If dwc3_meson_g12a_resume() succeeds in calling
reset_control_reset(), an internal triggered_count reference is
acquired. If any later step fails (usb_init, phy_init,
phy_power_on, regulator_enable, or usb_post_init), the function
returns the error without rearming the reset control. This leaks
the reference and leaves the reset control in a triggered state,
causing future reset_control_reset() calls to incorrectly return
early as if already reset.
Add an error path that calls reset_control_rearm() to balance
the reference before returning the error.
Cc: stable <stable@kernel.org>
Fixes: 5b0ba0caaf3a ("usb: dwc3: meson-g12a: refactor usb init")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260611131121.81784-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
@@ -907,35 +907,39 @@ static int __maybe_unused dwc3_meson_g12
ret = priv->drvdata->usb_init(priv);
if (ret)
- return ret;
+ goto err_rearm;
/* Init PHYs */
for (i = 0 ; i < PHY_COUNT ; ++i) {
ret = phy_init(priv->phys[i]);
if (ret)
- return ret;
+ goto err_rearm;
}
/* Set PHY Power */
for (i = 0 ; i < PHY_COUNT ; ++i) {
ret = phy_power_on(priv->phys[i]);
if (ret)
- return ret;
+ goto err_rearm;
}
if (priv->vbus && priv->otg_phy_mode == PHY_MODE_USB_HOST) {
ret = regulator_enable(priv->vbus);
if (ret)
- return ret;
+ goto err_rearm;
}
if (priv->drvdata->usb_post_init) {
ret = priv->drvdata->usb_post_init(priv);
if (ret)
- return ret;
+ goto err_rearm;
}
return 0;
+
+err_rearm:
+ reset_control_rearm(priv->reset);
+ return ret;
}
static const struct dev_pm_ops dwc3_meson_g12a_dev_pm_ops = {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0229/1266] usb: free iso schedules on failed submit
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0228/1266] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0230/1266] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
` (769 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Dawei Feng, Alan Stern
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit b9399d25fbb34a05bbe76eeedd730f62ff2670e9 upstream.
EHCI and FOTG210 isochronous submits build an ehci_iso_sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso_stream_schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb_hcd_link_urb_to_ep()
fails, submit jumps to done_not_linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.
Free the staged schedule from done_not_linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.
Fixes: 8de98402652c ("[PATCH] USB: Fix USB suspend/resume crasher (#2)")
Fixes: e9df41c5c589 ("USB: make HCDs responsible for managing endpoint queues")
Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260630071419.349161-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/fotg210/fotg210-hcd.c | 6 ++++--
drivers/usb/host/ehci-sched.c | 11 +++++++++--
2 files changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/usb/fotg210/fotg210-hcd.c
+++ b/drivers/usb/fotg210/fotg210-hcd.c
@@ -4271,8 +4271,6 @@ static int iso_stream_schedule(struct fo
return 0;
fail:
- iso_sched_free(stream, sched);
- urb->hcpriv = NULL;
return status;
}
@@ -4566,6 +4564,10 @@ static int itd_submit(struct fotg210_hcd
else
usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&fotg210->lock, flags);
done:
return status;
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1624,6 +1624,7 @@ iso_stream_schedule(
status = 1; /* and give it back immediately */
iso_sched_free(stream, sched);
sched = NULL;
+ urb->hcpriv = NULL;
}
}
urb->error_count = skip / period;
@@ -1654,8 +1655,6 @@ iso_stream_schedule(
return status;
fail:
- iso_sched_free(stream, sched);
- urb->hcpriv = NULL;
return status;
}
@@ -1967,6 +1966,10 @@ static int itd_submit(struct ehci_hcd *e
usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
}
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&ehci->lock, flags);
done:
return status;
@@ -2344,6 +2347,10 @@ static int sitd_submit(struct ehci_hcd *
usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
}
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&ehci->lock, flags);
done:
return status;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0230/1266] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0229/1266] usb: free iso schedules on failed submit Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0231/1266] usb: gadget: udc: Fix use-after-free in gadget_match_driver Greg Kroah-Hartman
` (768 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Maoyi Xie
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit f8f680609c2b3ab795ffcd6f21585b6dfc46d395 upstream.
The OTG branch of composite_setup() falls back to the first
configuration when none is selected:
if (cdev->config)
config = cdev->config;
else
config = list_first_entry(&cdev->configs,
struct usb_configuration, list);
if (!config)
goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.
cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.
Use list_first_entry_or_null() so the existing check does its job.
Fixes: 53e6242db8d6 ("usb: gadget: composite: add USB_DT_OTG request handling")
Cc: stable <stable@kernel.org>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260527150832.2943293-1-maoyixie.tju@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1887,9 +1887,10 @@ composite_setup(struct usb_gadget *gadge
if (cdev->config)
config = cdev->config;
else
- config = list_first_entry(
+ config = list_first_entry_or_null(
&cdev->configs,
- struct usb_configuration, list);
+ struct usb_configuration,
+ list);
if (!config)
goto done;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0231/1266] usb: gadget: udc: Fix use-after-free in gadget_match_driver
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0230/1266] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0232/1266] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
` (767 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, stable, Jimmy Hu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hu <hhhuuu@google.com>
commit 67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea upstream.
The udc structure acts as the management structure for the gadget,
but their lifecycles are decoupled. A race condition exists where
usb_del_gadget() frees the udc memory (e.g., via mode-switch work)
while gadget_match_driver() concurrently accesses the freed udc memory
(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a
NULL pointer dereference when the freed memory is zeroed:
[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60
...
[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8
[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140
[39430.931308][ T1171] configfs_write_iter+0xec/0x134
[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode
[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c
[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664
Fix this by ensuring the udc structure remains allocated until the
gadget is released. To achieve this, introduce a new
usb_gadget_release() routine to the core. When the gadget is added,
usb_add_gadget() stores the gadget's release routine in the udc
structure and takes a reference to the udc. When the gadget is
released, usb_gadget_release() drops the reference to the udc and
then calls the gadget's release routine.
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260625073705.803880-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/core.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -31,8 +31,9 @@ static const struct bus_type gadget_bus_
/**
* struct usb_udc - describes one usb device controller
* @driver: the gadget driver pointer. For use by the class code
- * @dev: the child device to the actual controller
* @gadget: the gadget. For use by the class code
+ * @gadget_release: the gadget's release routine
+ * @dev: the child device to the actual controller
* @list: for use by the udc class driver
* @vbus: for udcs who care about vbus status, this value is real vbus status;
* for udcs who do not care about vbus status, this value is always true
@@ -53,6 +54,7 @@ static const struct bus_type gadget_bus_
struct usb_udc {
struct usb_gadget_driver *driver;
struct usb_gadget *gadget;
+ void (*gadget_release)(struct device *dev);
struct device dev;
struct list_head list;
bool vbus;
@@ -1351,6 +1353,17 @@ static void usb_udc_nop_release(struct d
dev_vdbg(dev, "%s\n", __func__);
}
+static void usb_gadget_release(struct device *dev)
+{
+ struct usb_gadget *gadget = dev_to_usb_gadget(dev);
+ struct usb_udc *udc = gadget->udc;
+ /* Cache the gadget's release routine to prevent UAF */
+ void (*release)(struct device *dev) = udc->gadget_release;
+
+ put_device(&udc->dev);
+ release(dev);
+}
+
/**
* usb_initialize_gadget - initialize a gadget and its embedded struct device
* @parent: the parent device to this udc. Usually the controller driver's
@@ -1407,6 +1420,14 @@ int usb_add_gadget(struct usb_gadget *ga
mutex_init(&udc->connect_lock);
udc->started = false;
+ /*
+ * Align decoupled lifecycles: take a UDC reference to ensure it
+ * remains allocated until the gadget is released, requiring an
+ * override of the gadget's release routine to drop it.
+ */
+ udc->gadget_release = gadget->dev.release;
+ gadget->dev.release = usb_gadget_release;
+ get_device(&udc->dev);
mutex_lock(&udc_lock);
list_add_tail(&udc->list, &udc_list);
@@ -1451,6 +1472,12 @@ int usb_add_gadget(struct usb_gadget *ga
mutex_lock(&udc_lock);
list_del(&udc->list);
mutex_unlock(&udc_lock);
+ /*
+ * Revert the override and drop the UDC reference to prevent
+ * leaking the UDC if the gadget was statically allocated.
+ */
+ gadget->dev.release = udc->gadget_release;
+ put_device(&udc->dev);
err_put_udc:
put_device(&udc->dev);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0232/1266] usb: gadget: f_printer: take kref only for successful open
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0231/1266] usb: gadget: udc: Fix use-after-free in gadget_match_driver Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0233/1266] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
` (766 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b upstream.
printer_open() returns -EBUSY when the character device is already
open, but it increments dev->kref regardless of the return value. VFS
does not call ->release() for a failed open, so every rejected second
open permanently leaks one reference.
Move kref_get() into the successful-open branch.
Fixes: e8d5f92b8d30 ("usb: gadget: function: printer: fix use-after-free in __lock_acquire")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/80295742B820DA9B+20260626064617.4090626-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_printer.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -363,12 +363,11 @@ printer_open(struct inode *inode, struct
ret = 0;
/* Change the printer status to show that it's on-line. */
dev->printer_status |= PRINTER_SELECTED;
+ kref_get(&dev->kref);
}
spin_unlock_irqrestore(&dev->lock, flags);
- kref_get(&dev->kref);
-
return ret;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0233/1266] USB: idmouse: fix use-after-free on disconnect race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0232/1266] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0234/1266] USB: ldusb: " Greg Kroah-Hartman
` (765 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ff002c153f9722caece3983cc23dc4d9d4652cb4 upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 54d2bc068fd2 ("USB: fix locking in idmouse")
Cc: stable@vger.kernel.org # 2.6.24
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/idmouse.c | 45 ++++++++++++++++++++++-----------------------
1 file changed, 22 insertions(+), 23 deletions(-)
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -63,6 +63,7 @@ MODULE_DEVICE_TABLE(usb, idmouse_table);
/* structure to hold all of our device specific stuff */
struct usb_idmouse {
+ struct kref kref;
struct usb_device *udev; /* save off the usb device pointer */
struct usb_interface *interface; /* the interface for this device */
@@ -209,8 +210,10 @@ static int idmouse_resume(struct usb_int
return 0;
}
-static inline void idmouse_delete(struct usb_idmouse *dev)
+static inline void idmouse_delete(struct kref *kref)
{
+ struct usb_idmouse *dev = container_of(kref, struct usb_idmouse, kref);
+
kfree(dev->bulk_in_buffer);
kfree(dev);
}
@@ -254,6 +257,8 @@ static int idmouse_open(struct inode *in
/* increment our usage count for the driver */
++dev->open;
+ kref_get(&dev->kref);
+
/* save our object in the file's private structure */
file->private_data = dev;
@@ -277,16 +282,11 @@ static int idmouse_release(struct inode
/* lock our device */
mutex_lock(&dev->lock);
-
--dev->open;
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
- if (!dev->present) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- mutex_unlock(&dev->lock);
- }
return 0;
}
@@ -334,6 +334,7 @@ static int idmouse_probe(struct usb_inte
if (dev == NULL)
return -ENOMEM;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = udev;
dev->interface = interface;
@@ -342,8 +343,7 @@ static int idmouse_probe(struct usb_inte
result = usb_find_bulk_in_endpoint(iface_desc, &endpoint);
if (result) {
dev_err(&interface->dev, "Unable to find bulk-in endpoint.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
dev->orig_bi_size = usb_endpoint_maxp(endpoint);
@@ -351,8 +351,8 @@ static int idmouse_probe(struct usb_inte
dev->bulk_in_endpointAddr = endpoint->bEndpointAddress;
dev->bulk_in_buffer = kmalloc(IMGSIZE + dev->bulk_in_size, GFP_KERNEL);
if (!dev->bulk_in_buffer) {
- idmouse_delete(dev);
- return -ENOMEM;
+ result = -ENOMEM;
+ goto err_put_kref;
}
/* allow device read, write and ioctl */
@@ -364,14 +364,18 @@ static int idmouse_probe(struct usb_inte
if (result) {
/* something prevented us from registering this device */
dev_err(&interface->dev, "Unable to allocate minor number.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
/* be noisy */
dev_info(&interface->dev,"%s now attached\n",DRIVER_DESC);
return 0;
+
+err_put_kref:
+ kref_put(&dev->kref, idmouse_delete);
+
+ return result;
}
static void idmouse_disconnect(struct usb_interface *interface)
@@ -387,14 +391,9 @@ static void idmouse_disconnect(struct us
/* prevent device read, write and ioctl */
dev->present = 0;
- /* if the device is opened, idmouse_release will clean this up */
- if (!dev->open) {
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- /* unlock */
- mutex_unlock(&dev->lock);
- }
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
dev_info(&interface->dev, "disconnected\n");
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0234/1266] USB: ldusb: fix use-after-free on disconnect race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0233/1266] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0235/1266] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
` (764 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Daniel Walker, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 19bdfc7b3c179331eafa423d87e1336f43bbfeb8 upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: ce0d7d3f575f ("usb: ldusb: ld_usb semaphore to mutex")
Cc: stable <stable@kernel.org>
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/ldusb.c | 38 ++++++++++++++++++--------------------
1 file changed, 18 insertions(+), 20 deletions(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -150,6 +150,7 @@ MODULE_PARM_DESC(min_interrupt_out_inter
/* Structure to hold all of our device specific stuff */
struct ld_usb {
+ struct kref kref;
struct mutex mutex; /* locks this structure */
struct usb_interface *intf; /* save off the usb interface pointer */
unsigned long disconnected:1;
@@ -201,8 +202,10 @@ static void ld_usb_abort_transfers(struc
/*
* ld_usb_delete
*/
-static void ld_usb_delete(struct ld_usb *dev)
+static void ld_usb_delete(struct kref *kref)
{
+ struct ld_usb *dev = container_of(kref, struct ld_usb, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -355,6 +358,8 @@ static int ld_usb_open(struct inode *ino
goto unlock_exit;
}
+ kref_get(&dev->kref);
+
/* save device in the file's private structure */
file->private_data = dev;
@@ -381,17 +386,8 @@ static int ld_usb_release(struct inode *
mutex_lock(&dev->mutex);
- if (dev->open_count != 1) {
- retval = -ENODEV;
+ if (dev->disconnected)
goto unlock_exit;
- }
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->mutex);
- /* unlock here as ld_usb_delete frees dev */
- ld_usb_delete(dev);
- goto exit;
- }
/* wait until write transfer is finished */
if (dev->interrupt_out_busy)
@@ -401,7 +397,7 @@ static int ld_usb_release(struct inode *
unlock_exit:
mutex_unlock(&dev->mutex);
-
+ kref_put(&dev->kref, ld_usb_delete);
exit:
return retval;
}
@@ -660,6 +656,8 @@ static int ld_usb_probe(struct usb_inter
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev)
goto exit;
+
+ kref_init(&dev->kref);
mutex_init(&dev->mutex);
spin_lock_init(&dev->rbsl);
dev->intf = intf;
@@ -741,7 +739,7 @@ exit:
return retval;
error:
- ld_usb_delete(dev);
+ kref_put(&dev->kref, ld_usb_delete);
return retval;
}
@@ -769,18 +767,18 @@ static void ld_usb_disconnect(struct usb
mutex_lock(&dev->mutex);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->mutex);
- ld_usb_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->mutex);
}
+ mutex_unlock(&dev->mutex);
+
+ kref_put(&dev->kref, ld_usb_delete);
+
dev_info(&intf->dev, "LD USB Device #%d now disconnected\n",
(minor - USB_LD_MINOR_BASE));
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0235/1266] USB: iowarrior: fix use-after-free on disconnect
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0234/1266] USB: ldusb: " Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0236/1266] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
` (763 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ad2aac2febc3bedf0962, stable,
Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit bc0e4f16c44e50daa0b1ea729934baa3b4815dee upstream.
Submitted write URBs are not stopped on close() and therefore need to be
stopped unconditionally on disconnect() to avoid use-after-free in the
completion handler.
Fixes: b5f8d46867ca ("USB: iowarrior: fix use-after-free after driver unbind")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Reported-by: syzbot+ad2aac2febc3bedf0962@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a0ce39b.170a0220.39a13.0007.GAE@google.com/
Cc: stable <stable@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260523170523.1074563-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -920,13 +920,15 @@ static void iowarrior_disconnect(struct
/* prevent device read, write and ioctl */
dev->present = 0;
+ /* write urbs are not stopped on close() so kill unconditionally */
+ usb_kill_anchored_urbs(&dev->submitted);
+
if (dev->opened) {
/* There is a process that holds a filedescriptor to the device ,
so we only shutdown read-/write-ops going on.
Deleting the device is postponed until close() was called.
*/
usb_kill_urb(dev->int_in_urb);
- usb_kill_anchored_urbs(&dev->submitted);
wake_up_interruptible(&dev->read_wait);
wake_up_interruptible(&dev->write_wait);
mutex_unlock(&dev->mutex);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0236/1266] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0235/1266] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0237/1266] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
` (762 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Erich E. Hoover, stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erich E. Hoover <erich.e.hoover@gmail.com>
commit fc591787785b9709a0bb65a7df3ba2537d611c47 upstream.
The Samsung T5 EVO Portable SSD (04e8:6200) exhibit two forms of
link instability when USB Link Power Management is enabled:
1. The units fail to initialize properly on first detection,
resulting in a lockup in the drive where it must be power cycled
or the kernel will not recognize the presence of the device.
2. If used for sustained operations (small amounts of continuous
data are transferred to the unit) then the unit will "hiccup"
after roughly 8 hours of use and will disconnect and reconnect.
This has a certain probability of triggering the first issue,
but also causes mount points to become invalid since the device
gets issued a new letter.
Signed-off-by: Erich E. Hoover <erich.e.hoover@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260602204508.48856-1-erich.e.hoover@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -297,6 +297,9 @@ static const struct usb_device_id usb_qu
/* CarrolTouch 4500U */
{ USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Samsung T5 EVO Portable SSD */
+ { USB_DEVICE(0x04e8, 0x6200), .driver_info = USB_QUIRK_NO_LPM },
+
/* Samsung Android phone modem - ID conflict with SPH-I500 */
{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0237/1266] USB: legousbtower: fix use-after-free on disconnect race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0236/1266] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0238/1266] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
` (761 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Daniel Walker, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 62fc8eb1b1481051f7bab4aa93d79809053dd09f upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 18bcbcfe9ca2 ("USB: misc: legousbtower: semaphore to mutex")
Cc: stable <stable@kernel.org>
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++------------------
1 file changed, 19 insertions(+), 18 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -185,6 +185,7 @@ MODULE_DEVICE_TABLE(usb, tower_table);
/* Structure to hold all of our device specific stuff */
struct lego_usb_tower {
+ struct kref kref;
struct mutex lock; /* locks this structure */
struct usb_device *udev; /* save off the usb device pointer */
unsigned char minor; /* the starting minor number for this device */
@@ -220,7 +221,6 @@ struct lego_usb_tower {
/* local function prototypes */
static ssize_t tower_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos);
static ssize_t tower_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
-static inline void tower_delete(struct lego_usb_tower *dev);
static int tower_open(struct inode *inode, struct file *file);
static int tower_release(struct inode *inode, struct file *file);
static __poll_t tower_poll(struct file *file, poll_table *wait);
@@ -286,8 +286,10 @@ static inline void lego_usb_tower_debug_
/*
* tower_delete
*/
-static inline void tower_delete(struct lego_usb_tower *dev)
+static inline void tower_delete(struct kref *kref)
{
+ struct lego_usb_tower *dev = container_of(kref, struct lego_usb_tower, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -381,6 +383,8 @@ static int tower_open(struct inode *inod
dev->open_count = 1;
+ kref_get(&dev->kref);
+
unlock_exit:
mutex_unlock(&dev->lock);
@@ -404,14 +408,8 @@ static int tower_release(struct inode *i
mutex_lock(&dev->lock);
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
-
- /* unlock here as tower_delete frees dev */
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- goto exit;
- }
+ if (dev->disconnected)
+ goto out_unlock;
/* wait until write transfer is finished */
if (dev->interrupt_out_busy) {
@@ -425,7 +423,9 @@ static int tower_release(struct inode *i
dev->open_count = 0;
+out_unlock:
mutex_unlock(&dev->lock);
+ kref_put(&dev->kref, tower_delete);
exit:
return retval;
}
@@ -752,6 +752,7 @@ static int tower_probe(struct usb_interf
if (!dev)
goto exit;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = usb_get_dev(udev);
spin_lock_init(&dev->read_buffer_lock);
@@ -828,7 +829,7 @@ exit:
return retval;
error:
- tower_delete(dev);
+ kref_put(&dev->kref, tower_delete);
return retval;
}
@@ -856,18 +857,18 @@ static void tower_disconnect(struct usb_
mutex_lock(&dev->lock);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->lock);
}
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, tower_delete);
+
dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
(minor - LEGO_USB_TOWER_MINOR_BASE));
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0238/1266] usb: sl811-hcd: disable controller wakeup on remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0237/1266] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0239/1266] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
` (760 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 4e8ba83ac4d311992e6a4c21de5dd705010df06e upstream.
sl811h_probe() enables the HCD controller device as a wakeup source after
usb_add_hcd() succeeds, but sl811h_remove() removes the HCD and releases
the driver resources without disabling that wakeup source.
Disable controller wakeup after usb_remove_hcd() and before usb_put_hcd()
so the wakeup source object is detached while the controller device pointer
is still available.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 3c9740a117d4 ("usb: hcd: move controller wakeup setting initialization to individual driver")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260701121625.96815-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/sl811-hcd.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -1590,6 +1590,7 @@ sl811h_remove(struct platform_device *de
remove_debug_file(sl811);
usb_remove_hcd(hcd);
+ device_wakeup_disable(hcd->self.controller);
/* some platforms may use IORESOURCE_IO */
res = platform_get_resource(dev, IORESOURCE_MEM, 1);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0239/1266] USB: storage: include US_FL_NO_SAME in quirks mask
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0238/1266] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0240/1266] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
` (759 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao, Alan Stern
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 2c00e09e3f9f06f8434f5ea2ee6179ce46692ee6 upstream.
usb_stor_adjust_quirks() parses the usb-storage.quirks module
parameter into a new flag set and then applies it with the quirk
mask to override built-in flags.
The mask is meant to cover the flags that can be overridden by
the module parameter. The 'k' quirk character sets US_FL_NO_SAME,
but US_FL_NO_SAME is not included in the mask.
As a result, the module parameter can set US_FL_NO_SAME, but it
cannot clear a built-in US_FL_NO_SAME flag by providing an override
entry that omits 'k'.
Add US_FL_NO_SAME to the mask so that the module parameter can
override it in the same way as the other supported flags.
Fixes: 8010622c86ca ("USB: UAS: introduce a quirk to set no_write_same")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/3BCE5880F9A45C2E+20260602053842.2920137-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -488,7 +488,7 @@ void usb_stor_adjust_quirks(struct usb_d
US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS |
- US_FL_ALWAYS_SYNC);
+ US_FL_ALWAYS_SYNC | US_FL_NO_SAME);
p = quirks;
while (*p) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0240/1266] USB: misc: uss720: unregister parport on probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0239/1266] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0241/1266] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
` (758 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak,
Alex Henrie
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3 upstream.
uss720_probe() registers a parport before reading the 1284 register used
to detect unsupported Belkin F5U002 adapters. If get_1284_register()
fails, the error path drops the driver private data and the USB device
reference, but leaves the parport device registered.
Leaving the port registered is more than a private allocation leak:
parport_register_port() has already reserved a parport number and
registered the parport bus device, while pp->private_data still points at
the private data that the common error path is about to release.
Undo the pre-announce registration in the get_1284_register() failure
branch before jumping to the common private-data cleanup path. Clear
priv->pp first, matching the disconnect path and avoiding a stale pointer
in the private data.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 3295f1b866bf ("usb: misc: uss720: check for incompatible versions of the Belkin F5U002")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Alex Henrie <alexhenrie24@gmail.com>
Link: https://patch.msgid.link/20260706151049.63470-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/uss720.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -732,8 +732,11 @@ static int uss720_probe(struct usb_inter
* here. */
ret = get_1284_register(pp, 0, ®, GFP_KERNEL);
dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
- if (ret < 0)
+ if (ret < 0) {
+ priv->pp = NULL;
+ parport_del_port(pp);
goto probe_abort;
+ }
ret = usb_find_last_int_in_endpoint(interface, &epd);
if (!ret) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0241/1266] usb: mtu3: unmap request DMA on queue failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0240/1266] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0242/1266] USB: serial: keyspan_pda: fix information leak Greg Kroah-Hartman
` (757 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Haoxiang Li
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 0bddda5a11665c210339de76d27ebbd1a2e0b43c upstream.
mtu3_gadget_queue() maps the request before checking whether
the QMU GPD ring can accept another transfer. the request is
returned with -EAGAIN before it is linked on the endpoint
request list if mtu3_prepare_transfer() fails.
Normal completion and dequeue paths unmap requests from
mtu3_req_complete(), but this error path never reaches that
helper, so the DMA mapping is left active. Unmap the request
before returning from the failed queue path.
Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260623093325.2105323-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mtu3/mtu3_gadget.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -304,6 +304,7 @@ static int mtu3_gadget_queue(struct usb_
if (mtu3_prepare_transfer(mep)) {
ret = -EAGAIN;
+ usb_gadget_unmap_request(&mtu->g, req, mep->is_in);
goto error;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0242/1266] USB: serial: keyspan_pda: fix information leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0241/1266] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0243/1266] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
` (756 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 6bfc8d01ac4068eced509f8fc74d0cd205e4dcec upstream.
The write() callback is supposed to return the number of characters
accepted or a negative errno. Since the addition of write fifo support
the keyspan_pda implementation will however return the number characters
submitted to the device if the write urb is not already in use. If this
number is larger than the number of characters passed to write(), the
line discipline continues writing data from beyond the tty write buffer.
Fix the information leak by making sure that keyspan_pda_write_start()
returns zero on success as intended.
Fixes: 034e38e8f687 ("USB: serial: keyspan_pda: add write-fifo support")
Cc: stable@vger.kernel.org # 5.11
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -518,7 +518,7 @@ static int keyspan_pda_write_start(struc
if (count == room)
schedule_work(&priv->unthrottle_work);
- return count;
+ return 0;
}
static void keyspan_pda_write_bulk_callback(struct urb *urb)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0243/1266] USB: serial: option: add Telit Cinterion FE990D50 compositions
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0242/1266] USB: serial: keyspan_pda: fix information leak Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0244/1266] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
` (755 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Porcedda, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <fabio.porcedda@gmail.com>
commit b33ab1dd80f5c1742f49eb6ec7b337c5ffcf3d32 upstream.
Add support for Telit Cinterion FE990D50 compositions:
0x990: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0990 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x991: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 9 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0991 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=(none)
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x992: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 12 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0992 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x993: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 15 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0993 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: stable@vger.kernel.org
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1326,6 +1326,22 @@ static const struct usb_device_id option
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x30), /* Telit FE990D50 (RNDIS) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x30), /* Telit FE990D50 (rmnet) */
+ .driver_info = NCTRL(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x30), /* Telit FE990D50 (MBIM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x30), /* Telit FE990D50 (ECM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x60) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */
.driver_info = NCTRL(0) | RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0244/1266] USB: serial: digi_acceleport: fix broken rx after throttle
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0243/1266] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0245/1266] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
` (754 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 83a3dfc018943b05b6daf3a6f891833e1aabfa1f upstream.
If the port is closed while throttled, the read urb is never resubmitted
and the port will not receive any further data until the device is
reconnected (or the driver is rebound).
Clear the throttle flags and submit the urb if needed when opening the
port.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1073,6 +1073,7 @@ static int digi_open(struct tty_struct *
unsigned char buf[32];
struct digi_port *priv = usb_get_serial_port_data(port);
struct ktermios not_termios;
+ int throttled;
/* be sure the device is started up */
if (digi_startup_device(port->serial) != 0)
@@ -1100,6 +1101,21 @@ static int digi_open(struct tty_struct *
not_termios.c_iflag = ~tty->termios.c_iflag;
digi_set_termios(tty, port, ¬_termios);
}
+
+ spin_lock_irq(&priv->dp_port_lock);
+ throttled = priv->dp_throttle_restart;
+ priv->dp_throttled = 0;
+ priv->dp_throttle_restart = 0;
+ spin_unlock_irq(&priv->dp_port_lock);
+
+ if (throttled) {
+ ret = usb_submit_urb(port->read_urb, GFP_KERNEL);
+ if (ret) {
+ dev_err(&port->dev, "failed to submit read urb: %d\n", ret);
+ return ret;
+ }
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0245/1266] USB: serial: digi_acceleport: fix hard lockup on disconnect
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0244/1266] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0246/1266] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
` (753 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 5c1ea24b53bf3bfb859f0a05573997487975da23 upstream.
If submitting the OOB write urb fails persistently (e.g if the device is
being disconnected) the driver would loop indefinitely with interrupts
disabled.
Check for urb submission errors when sending OOB commands to avoid
hanging if, for example, open(), set_termios() or close() races with a
physical disconnect.
This is issue was flagged by Sashiko when reviewing an unrelated change
to the driver.
Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=1
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -396,12 +396,14 @@ static int digi_write_oob_command(struct
len &= ~3;
memcpy(oob_port->write_urb->transfer_buffer, buf, len);
oob_port->write_urb->transfer_buffer_length = len;
+
ret = usb_submit_urb(oob_port->write_urb, GFP_ATOMIC);
- if (ret == 0) {
- oob_priv->dp_write_urb_in_use = 1;
- count -= len;
- buf += len;
- }
+ if (ret)
+ break;
+
+ oob_priv->dp_write_urb_in_use = 1;
+ count -= len;
+ buf += len;
}
spin_unlock_irqrestore(&oob_priv->dp_port_lock, flags);
if (ret)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0246/1266] USB: serial: digi_acceleport: fix write buffer corruption
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0245/1266] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0247/1266] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
` (752 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65 upstream.
The digi_write_inb_command() is supposed to wait for the write urb to
become available or return an error, but instead it updates the transfer
buffer and tries to resubmit the urb on timeout.
To make things worse, for commands like break control where no timeout
is used, the driver would corrupt the urb immediately due to a broken
jiffies comparison (on 32-bit machines this takes five minutes of uptime
to trigger due to INITIAL_JIFFIES).
Fix this by adding the missing return on timeout and waiting
indefinitely when no timeout has been specified as intended.
This issue was (sort of) flagged by Sashiko when reviewing an unrelated
change to the driver.
Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=11
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -433,20 +433,22 @@ static int digi_write_inb_command(struct
int len;
struct digi_port *priv = usb_get_serial_port_data(port);
unsigned char *data = port->write_urb->transfer_buffer;
+ unsigned long expire;
unsigned long flags;
dev_dbg(&port->dev, "digi_write_inb_command: TOP: port=%d, count=%d\n",
priv->dp_port_num, count);
if (timeout)
- timeout += jiffies;
- else
- timeout = ULONG_MAX;
+ expire = jiffies + timeout;
spin_lock_irqsave(&priv->dp_port_lock, flags);
while (count > 0 && ret == 0) {
- while (priv->dp_write_urb_in_use &&
- time_before(jiffies, timeout)) {
+ while (priv->dp_write_urb_in_use) {
+ if (timeout && time_after(jiffies, expire)) {
+ ret = -ETIMEDOUT;
+ break;
+ }
cond_wait_interruptible_timeout_irqrestore(
&priv->write_wait, DIGI_RETRY_TIMEOUT,
&priv->dp_port_lock, flags);
@@ -455,6 +457,9 @@ static int digi_write_inb_command(struct
spin_lock_irqsave(&priv->dp_port_lock, flags);
}
+ if (ret)
+ break;
+
/* len must be a multiple of 4 and small enough to */
/* guarantee the write will send buffered data first, */
/* so commands are in order with data and not split */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0247/1266] USB: ulpi: fix memory leak on registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0246/1266] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0248/1266] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
` (751 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Heikki Krogerus,
Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8af6812795869a66e9b26044f455b13deecdb69c upstream.
The allocated device name is never freed on early ULPI device
registration failures.
Fix this by initialising the device structure earlier and releasing the
initial reference whenever registration fails.
Fixes: 289fcff4bcdb ("usb: add bus type for USB ULPI")
Cc: stable <stable@kernel.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260608145803.69360-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/common/ulpi.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -281,28 +281,24 @@ static int ulpi_register(struct device *
ulpi->dev.parent = dev; /* needed early for ops */
ulpi->dev.bus = &ulpi_bus;
ulpi->dev.type = &ulpi_dev_type;
+
+ device_initialize(&ulpi->dev);
+
dev_set_name(&ulpi->dev, "%s.ulpi", dev_name(dev));
ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev));
ret = ulpi_of_register(ulpi);
- if (ret) {
- kfree(ulpi);
+ if (ret)
return ret;
- }
ret = ulpi_read_id(ulpi);
- if (ret) {
- of_node_put(ulpi->dev.of_node);
- kfree(ulpi);
+ if (ret)
return ret;
- }
- ret = device_register(&ulpi->dev);
- if (ret) {
- put_device(&ulpi->dev);
+ ret = device_add(&ulpi->dev);
+ if (ret)
return ret;
- }
root = debugfs_create_dir(dev_name(&ulpi->dev), ulpi_root);
debugfs_create_file("regs", 0444, root, ulpi, &ulpi_regs_fops);
@@ -334,9 +330,10 @@ struct ulpi *ulpi_register_interface(str
ulpi->ops = ops;
ret = ulpi_register(dev, ulpi);
- if (ret)
+ if (ret) {
+ put_device(&ulpi->dev);
return ERR_PTR(ret);
-
+ }
return ulpi;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0248/1266] USB: usb-storage: ene_ub6250: restore media-ready check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0247/1266] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0249/1266] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
` (750 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao, Alan Stern
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 5fc3f333c001f1e308bbcdeecdec0d054d24338b upstream.
Commit 1892bf90677a ("USB: usb-storage: Fix use of bitfields for
hardware data in ene_ub6250.c") converted the media status fields from
bitfields to bit masks.
The original ene_transport() test called ene_init() only when neither
media type was ready:
!(sd_ready || ms_ready)
The converted test became:
!sd_ready || ms_ready
This is not equivalent. Restore the original semantics by testing that
both ready bits are clear before calling ene_init().
Fixes: 1892bf90677a ("USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/F42641386E32404F+20260626070607.4119527-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/ene_ub6250.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2306,7 +2306,8 @@ static int ene_transport(struct scsi_cmn
/*US_DEBUG(usb_stor_show_command(us, srb)); */
scsi_set_resid(srb, 0);
- if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready)))
+ if (unlikely(!(info->SD_Status & SD_Ready) &&
+ !(info->MS_Status & MS_Ready)))
result = ene_init(us);
if (result == USB_STOR_XFER_GOOD) {
result = USB_STOR_TRANSPORT_ERROR;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0249/1266] usbip: tools: support SuperSpeedPlus devices
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0248/1266] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0250/1266] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
` (749 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Yichong Chen, Shuah Khan
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 195e667c8719480c320cd48ac0fbf1cb81d6ffe0 upstream.
USB devices running at SuperSpeedPlus report "10000" or "20000" in
their sysfs speed attribute. usbip currently maps only "5000" to
USB_SPEED_SUPER, so a SuperSpeedPlus device is imported as
USB_SPEED_UNKNOWN.
The attach request is then rejected by vhci_hcd:
vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN
Map the SuperSpeedPlus sysfs speed values to USB_SPEED_SUPER_PLUS, use
the SuperSpeed VHCI hub for SuperSpeedPlus devices, and recognize the
gadget current_speed string used by the kernel.
Fixes: b2316645ca5e ("usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices")
Cc: stable <stable@kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://patch.msgid.link/00C828F338E43447+20260617020613.199086-1-chenyichong@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/usb/usbip/libsrc/usbip_common.c | 2 ++
tools/usb/usbip/libsrc/usbip_device_driver.c | 4 ++++
tools/usb/usbip/libsrc/vhci_driver.c | 1 +
3 files changed, 7 insertions(+)
--- a/tools/usb/usbip/libsrc/usbip_common.c
+++ b/tools/usb/usbip/libsrc/usbip_common.c
@@ -29,6 +29,8 @@ static const struct speed_string speed_s
{ USB_SPEED_HIGH, "480", "High Speed(480Mbps)" },
{ USB_SPEED_WIRELESS, "53.3-480", "Wireless"},
{ USB_SPEED_SUPER, "5000", "Super Speed(5000Mbps)" },
+ { USB_SPEED_SUPER_PLUS, "10000", "Super Speed Plus(10000Mbps)" },
+ { USB_SPEED_SUPER_PLUS, "20000", "Super Speed Plus(20000Mbps)" },
{ 0, NULL, NULL }
};
--- a/tools/usb/usbip/libsrc/usbip_device_driver.c
+++ b/tools/usb/usbip/libsrc/usbip_device_driver.c
@@ -57,6 +57,10 @@ static struct {
.speed = USB_SPEED_SUPER,
.name = "super-speed",
},
+ {
+ .speed = USB_SPEED_SUPER_PLUS,
+ .name = "super-speed-plus",
+ },
};
static
--- a/tools/usb/usbip/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
@@ -338,6 +338,7 @@ int usbip_vhci_get_free_port(uint32_t sp
switch (speed) {
case USB_SPEED_SUPER:
+ case USB_SPEED_SUPER_PLUS:
if (vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
continue;
break;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0250/1266] usbip: vudc: fix NULL deref in vep_dequeue()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0249/1266] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0251/1266] usb: typec: anx7411: use devm_pm_runtime_enable() Greg Kroah-Hartman
` (748 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Igor Kotrasinski, Sam Day
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Day <me@samcday.com>
commit c5371e0b91b24159a3ebaa61e70b0980bcf03c0a upstream.
vep_alloc_request() wasn't initializing vrequest->udc, so cancellations
on the FunctionFS AIO path were arriving in vep_dequeue without a valid
UDC reference.
Since vrequest->udc is never actually properly used anywhere, we opt to
remove it, and update vep_dequeue to obtain a reference to the udc with
ep_to_vudc(), consistent with the other vep_ ops.
AFAICT this bug has existed for ~10 years. Seems that nobody has really
stressed the FunctionFS AIO path on usbip's vudc.
I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints
via AIO. Before the fix, running `usbip attach` from the host would
cause the guest to oops with the following backtrace:
Call trace:
vep_dequeue+0x1c/0xe4 (P)
usb_ep_dequeue+0x14/0x20
ffs_aio_cancel+0x24/0x34
__arm64_sys_io_cancel+0xb0/0x124
do_el0_svc+0x68/0x100
el0_svc+0x18/0x5c
el0t_64_sync_handler+0x98/0xdc
el0t_64_sync+0x154/0x158
Assisted-by: opencode:openai/gpt-5.5
Cc: stable <stable@kernel.org>
Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
Reviewed-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Sam Day <me@samcday.com>
Link: https://patch.msgid.link/20260626-usbip-vudc-deque-fix-v3-1-98c2dc4d6a48@samcday.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/usbip/vudc.h | 1 -
drivers/usb/usbip/vudc_dev.c | 4 +---
2 files changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/usbip/vudc.h
+++ b/drivers/usb/usbip/vudc.h
@@ -38,7 +38,6 @@ struct vep {
struct vrequest {
struct usb_request req;
- struct vudc *udc;
struct list_head req_entry; /* Request queue */
};
--- a/drivers/usb/usbip/vudc_dev.c
+++ b/drivers/usb/usbip/vudc_dev.c
@@ -333,7 +333,6 @@ static int vep_queue(struct usb_ep *_ep,
static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
{
struct vep *ep;
- struct vrequest *req;
struct vudc *udc;
struct vrequest *lst;
unsigned long flags;
@@ -343,8 +342,7 @@ static int vep_dequeue(struct usb_ep *_e
return ret;
ep = to_vep(_ep);
- req = to_vrequest(_req);
- udc = req->udc;
+ udc = ep_to_vudc(ep);
if (!udc->driver)
return -ESHUTDOWN;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0251/1266] usb: typec: anx7411: use devm_pm_runtime_enable()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0250/1266] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0252/1266] usb: typec: class: drop PD lookup reference Greg Kroah-Hartman
` (747 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak,
Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 0ef7cc27da8b9e315a4a5a665c68c44206f5e559 upstream.
anx7411_i2c_probe() enables runtime PM before returning successfully, but
anx7411_i2c_remove() tears down the Type-C partner state, workqueue, dummy
I2C device, mux, switch and port without disabling runtime PM.
Use devm_pm_runtime_enable() so runtime PM is disabled automatically on
driver detach. Since devres action registration can fail, route that
failure through the existing probe unwind path.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260701114006.75738-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/anx7411.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/typec/anx7411.c
+++ b/drivers/usb/typec/anx7411.c
@@ -1542,7 +1542,9 @@ static int anx7411_i2c_probe(struct i2c_
if (anx7411_typec_check_connection(plat))
dev_err(dev, "check status\n");
- pm_runtime_enable(dev);
+ ret = devm_pm_runtime_enable(dev);
+ if (ret)
+ goto free_wq;
return 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0252/1266] usb: typec: class: drop PD lookup reference
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0251/1266] usb: typec: anx7411: use devm_pm_runtime_enable() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0253/1266] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
` (746 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Shuangpeng Bai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 43ae2f90b70cda374c487c1639a01d0f14e5d583 upstream.
usb_power_delivery_find() wraps class_find_device_by_name(). That helper
returns a device reference that must be released by the caller.
select_usb_power_delivery_store() only needs this reference while calling
the pd_set callback. Drop it once the callback returns. Otherwise the sysfs
write can pin the selected USB Power Delivery object and prevent it from
being released on unregister.
Fixes: a7cff92f0635 ("usb: typec: USB Power Delivery helpers for ports and partners")
Cc: stable <stable@kernel.org>
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Link: https://patch.msgid.link/20260702191329.2648043-1-shuangpeng.kernel@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/class.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -1277,6 +1277,7 @@ static ssize_t select_usb_power_delivery
return -EINVAL;
ret = port->ops->pd_set(port, pd);
+ put_device(&pd->dev);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0253/1266] usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0252/1266] usb: typec: class: drop PD lookup reference Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0254/1266] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
` (745 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Badhri Jagan Sridharan,
RD Babiera, Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Badhri Jagan Sridharan <badhri@google.com>
commit 7b681dd5fbf60b24a13c14661e5b7735759fb491 upstream.
In svdm_consume_modes(), the SVID value is read from pmdata->svids using
pmdata->svid_index as an array index without bounds validation:
paltmode->svid = pmdata->svids[pmdata->svid_index];
If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results
in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data
is embedded inside struct tcpm_port, indexing past svids reads into
adjacent fields. In particular:
- At index 16, it reads the altmodes count.
- At index 18 and beyond, it reads into altmode_desc[], which contains
partner-supplied SVDM Discovery Modes VDOs.
By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index
to 20, the partner can force paltmode->svid to be loaded with an arbitrary,
partner- chosen SVID, which is then registered via
typec_partner_register_altmode().
Fix this by validating that pmdata->svid_index is non-negative and strictly
less than pmdata->nsvids before accessing the pmdata->svids array inside
svdm_consume_modes().
Assisted-by: Antigravity:gemini-3.5-flash
Fixes: 4ab8c18d4d67 ("usb: typec: Register a device for every mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: RD Babiera <rdbabiera@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260622220803.305750-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -1555,6 +1555,11 @@ static void svdm_consume_modes(struct tc
return;
}
+ if (pmdata->svid_index < 0 || pmdata->svid_index >= pmdata->nsvids) {
+ tcpm_log(port, "Invalid SVID index %d", pmdata->svid_index);
+ return;
+ }
+
for (i = 1; i < cnt; i++) {
paltmode = &pmdata->altmode_desc[pmdata->altmodes];
memset(paltmode, 0, sizeof(*paltmode));
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0254/1266] usb: typec: ucsi: Invert DisplayPort role assignment
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0253/1266] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0255/1266] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
` (744 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Andrei Kuchynski,
Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <akuchynski@chromium.org>
commit d092d7edf8faefa3e27b9fc7f0e7904b06c833a2 upstream.
The existing implementation assigned these flags backwards, configuring
the partner's DisplayPort role to match the port's role instead of
complementing it.
This prevents proper configuration during DP altmode activation, often
causing `pin_assignment` to remain 0 in `dp_altmode_configure()` and
resulting in VDM negotiation failures:
[ 583.328246] typec port1.1: VDM 0xff01a150 failed
Additionally, the fix ensures that the `pin_assignment` sysfs attribute
displays the correct values.
Cc: stable <stable@kernel.org>
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260601142837.3240207-1-akuchynski@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/displayport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -166,12 +166,12 @@ static int ucsi_displayport_status_updat
* that Multi-function is preferred.
*/
if (DP_CAP_CAPABILITY(cap) & DP_CAP_UFP_D) {
- dp->data.status |= DP_STATUS_CON_UFP_D;
+ dp->data.status |= DP_STATUS_CON_DFP_D;
if (DP_CAP_UFP_D_PIN_ASSIGN(cap) & BIT(DP_PIN_ASSIGN_D))
dp->data.status |= DP_STATUS_PREFER_MULTI_FUNC;
} else {
- dp->data.status |= DP_STATUS_CON_DFP_D;
+ dp->data.status |= DP_STATUS_CON_UFP_D;
if (DP_CAP_DFP_D_PIN_ASSIGN(cap) & BIT(DP_PIN_ASSIGN_D))
dp->data.status |= DP_STATUS_PREFER_MULTI_FUNC;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0255/1266] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0254/1266] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0256/1266] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
` (743 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Madhu M, Jameson Thies,
Andrei Kuchynski, Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhu M <madhu.m@intel.com>
commit 735a461d060d4eeb2f9732aba1295bc32a3982e2 upstream.
In the UCSI Specification Revision 3.1 RC1, bits 32-63 of the SET_NEW_CAM
command hold the 32-bit Alternate Mode Specific (AMSpecific) field.
For DisplayPort Alternate Mode, this field must contain the full
32-bit DisplayPort configuration VDO payload that the OPM wants the
connector to operate in, rather than just the pin assignment value.
This AMSpecific value follows the DisplayPort Configurations defined
in the DisplayPort Alt Mode on USB Type-C Specification v2.1a,
Table 5-13: SOP DisplayPort Configurations.
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Madhu M <madhu.m@intel.com>
Reviewed-by: Jameson Thies <jthies@google.com>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260619153311.3526083-1-madhu.m@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/displayport.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -185,13 +185,12 @@ static int ucsi_displayport_status_updat
static int ucsi_displayport_configure(struct ucsi_dp *dp)
{
- u32 pins = DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
u64 command;
if (!dp->override)
return 0;
- command = UCSI_CMD_SET_NEW_CAM(dp->con->num, 1, dp->offset, pins);
+ command = UCSI_CMD_SET_NEW_CAM(dp->con->num, 1, dp->offset, dp->data.conf);
return ucsi_send_command(dp->con->ucsi, command, NULL, 0);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0256/1266] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0255/1266] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0257/1266] usb: typec: ucsi: cancel pending work on system suspend Greg Kroah-Hartman
` (742 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Fan Wu, Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
commit 1f0bdc2884b67de337215079bba166df0cdf4ac5 upstream.
The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),
which on a connector-change event calls ucsi_connector_change() and
schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees
uc->ucsi (kfree) before free_irq() is called, so a handler invocation
already in flight may access the freed object after ucsi_destroy().
CPU 0 (remove) | CPU 1 (threaded IRQ)
ucsi_destroy(uc->ucsi) | ccg_irq_handler()
kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE
Move free_irq() before ucsi_destroy() in the remove path. It is kept
after ucsi_unregister(): ucsi_unregister() cancels connector work whose
handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),
which waits for a completion that is signalled from the IRQ handler, so
the IRQ must stay active until that work has been cancelled.
The probe error path already orders free_irq() before ucsi_destroy().
This bug was found by static analysis.
Fixes: e32fd989ac1c ("usb: typec: ucsi: ccg: Move to the new API")
Cc: stable <stable@kernel.org>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260616132011.103279-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -1440,8 +1440,8 @@ static void ucsi_ccg_remove(struct i2c_c
cancel_work_sync(&uc->work);
pm_runtime_disable(uc->dev);
ucsi_unregister(uc->ucsi);
- ucsi_destroy(uc->ucsi);
free_irq(uc->irq, uc);
+ ucsi_destroy(uc->ucsi);
}
static const struct of_device_id ucsi_ccg_of_match_table[] = {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0257/1266] usb: typec: ucsi: cancel pending work on system suspend
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0256/1266] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0258/1266] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
` (741 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Paul Menzel, Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <pmenzel@molgen.mpg.de>
commit 7c4a234bd31a64a8dbd0140dc812da592c5e0787 upstream.
On a Dell XPS 13 9360 (BIOS 2.21.0), entering system suspend (deep/S3)
races a pending UCSI connector-change worker against the ACPI EC teardown.
The worker evaluates the UCSI _DSM (GET_CONNECTOR_STATUS), whose AML
accesses the Embedded Controller. By that point the ACPI EC has already
been stopped for suspend, so the EC address space handler rejects the
access with AE_BAD_PARAMETER, aborting the AML and failing the connector
query:
[22314.689495] ACPI: EC: interrupt blocked
[22314.711981] ACPI: PM: Preparing to enter system sleep state S3
[22314.743260] ACPI: EC: event blocked
[22314.743265] ACPI: EC: EC stopped
[22314.743267] ACPI: PM: Saving platform NVS memory
[22314.744241] ACPI Error: AE_BAD_PARAMETER, Returned by Handler for [EmbeddedControl] (20260408/evregion-303)
[22314.744432] ACPI Error: Aborting method \_SB.PCI0.LPCB.ECDV.ECW1 due to previous error (AE_BAD_PARAMETER) (20260408/psparse-543)
[22314.744673] ACPI Error: Aborting method \ECWB due to previous error (AE_BAD_PARAMETER) (20260408/psparse-543)
[22314.745201] ACPI Error: Aborting method \_SB.UBTC._DSM due to previous error (AE_BAD_PARAMETER) (20260408/psparse-543)
[22314.745394] ACPI: \_SB_.UBTC: failed to evaluate _DSM c298836f-a47c-e411-ad36-631042b5008f rev:1 func:1 (0x1001)
[22314.745414] ucsi_acpi USBC000:00: ucsi_acpi_dsm: failed to evaluate _DSM 1
[22314.745424] ucsi_acpi USBC000:00: ucsi_handle_connector_change: GET_CONNECTOR_STATUS failed (-5)
ucsi_acpi implements a resume callback but no suspend callback, so nothing
cancels the connector-change work before the firmware/EC is torn down.
Add a `ucsi_suspend()` core helper that cancels the pending init and
connector-change work, and wire it into ucsi_acpi's PM ops. The connector
state is re-read on resume by `ucsi_resume()`, so cancelling the work loses
nothing.
Fixes: 4e3a50293c2b ("usb: typec: ucsi: acpi: Implement resume callback")
Cc: stable <stable@kernel.org>
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
Assisted-by: Claude Opus 4.8
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260703110738.8457-2-pmenzel@molgen.mpg.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi.c | 20 ++++++++++++++++++++
drivers/usb/typec/ucsi/ucsi.h | 1 +
drivers/usb/typec/ucsi/ucsi_acpi.c | 10 +++++++++-
3 files changed, 30 insertions(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -1533,6 +1533,26 @@ static void ucsi_resume_work(struct work
}
}
+int ucsi_suspend(struct ucsi *ucsi)
+{
+ int i;
+
+ /*
+ * Cancel pending work so it cannot access the firmware after the ACPI
+ * EC is stopped for suspend; state is re-read on resume.
+ */
+ cancel_delayed_work_sync(&ucsi->work);
+
+ if (!ucsi->connector)
+ return 0;
+
+ for (i = 0; i < ucsi->cap.num_connectors; i++)
+ cancel_work_sync(&ucsi->connector[i].work);
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(ucsi_suspend);
+
int ucsi_resume(struct ucsi *ucsi)
{
if (ucsi->connector)
--- a/drivers/usb/typec/ucsi/ucsi.h
+++ b/drivers/usb/typec/ucsi/ucsi.h
@@ -386,6 +386,7 @@ int ucsi_send_command(struct ucsi *ucsi,
void *retval, size_t size);
void ucsi_altmode_update_active(struct ucsi_connector *con);
+int ucsi_suspend(struct ucsi *ucsi);
int ucsi_resume(struct ucsi *ucsi);
#if IS_ENABLED(CONFIG_POWER_SUPPLY)
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -288,6 +288,13 @@ static void ucsi_acpi_remove(struct plat
ucsi_acpi_notify);
}
+static int ucsi_acpi_suspend(struct device *dev)
+{
+ struct ucsi_acpi *ua = dev_get_drvdata(dev);
+
+ return ucsi_suspend(ua->ucsi);
+}
+
static int ucsi_acpi_resume(struct device *dev)
{
struct ucsi_acpi *ua = dev_get_drvdata(dev);
@@ -295,7 +302,8 @@ static int ucsi_acpi_resume(struct devic
return ucsi_resume(ua->ucsi);
}
-static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_acpi_pm_ops, NULL, ucsi_acpi_resume);
+static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_acpi_pm_ops, ucsi_acpi_suspend,
+ ucsi_acpi_resume);
static const struct acpi_device_id ucsi_acpi_match[] = {
{ "PNP0CA0", 0 },
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0258/1266] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0257/1266] usb: typec: ucsi: cancel pending work on system suspend Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0259/1266] PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Greg Kroah-Hartman
` (740 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liviu Stan, Stable, Jonathan Cameron,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <liviu.stan@analog.com>
[ Upstream commit 434c150752675f44dc52c384a7fa22e5176bc35a ]
When adi,number-of-wires is absent, n_wires is left at 0. The binding
documents a default of 2 wires, matching the hardware default. However
the current-rotate validation checks n_wires == 2 || n_wires == 3, so
with n_wires = 0 the guard is bypassed and adi,current-rotate is accepted
for a 2-wire RTD.
Initialize n_wires = 2 to match the binding default and ensure the
rotation check fires correctly when the property is absent.
Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
[ Liviu Stan: resolve conflict - keep fwnode_handle *ref declaration
which was removed upstream ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/temperature/ltc2983.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/temperature/ltc2983.c b/drivers/iio/temperature/ltc2983.c
index 08485c4ecd52e5..a2e4ddf095d88a 100644
--- a/drivers/iio/temperature/ltc2983.c
+++ b/drivers/iio/temperature/ltc2983.c
@@ -751,7 +751,7 @@ ltc2983_rtd_new(const struct fwnode_handle *child, struct ltc2983_data *st,
int ret = 0;
struct device *dev = &st->spi->dev;
struct fwnode_handle *ref;
- u32 excitation_current = 0, n_wires = 0;
+ u32 excitation_current = 0, n_wires = 2;
rtd = devm_kzalloc(dev, sizeof(*rtd), GFP_KERNEL);
if (!rtd)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0259/1266] PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0258/1266] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0260/1266] udf: validate free block extents against the partition length Greg Kroah-Hartman
` (739 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki, Bjorn Helgaas,
Alok Tiwari, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit 72780f7964684939d7d2f69c348876213b184484 upstream.
Discard Vendor:Device ID matching in the PCIe failed link retraining quirk
and ignore the link status for the removal of the 2.5GT/s speed clamp,
whether applied by the quirk itself or the firmware earlier on. Revert to
the original target link speed if this final link retraining has failed.
This is so that link training noise in hot-plug scenarios does not make a
link remain clamped to the 2.5GT/s speed where an event race has led the
quirk to apply the speed clamp for one device, only to leave it in place
for a subsequent device to be plugged in.
Refer to the Link Capabilities register directly for the maximum link speed
determination so as to streamline backporting.
Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Cc: stable@vger.kernel.org # v6.5+
Link: https://patch.msgid.link/alpine.DEB.2.21.2512080331530.49654@angie.orcam.me.uk
[ Update for missing PCIe link speed helpers for 6.6.y. ]
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 51 +++++++++++++++++---------------------------
1 file changed, 20 insertions(+), 31 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 5df3a6ea660187..28fa0a9b18c824 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -68,11 +68,10 @@
* Restrict the speed to 2.5GT/s then with the Target Link Speed field,
* request a retrain and check the result.
*
- * If this turns out successful and we know by the Vendor:Device ID it is
- * safe to do so, then lift the restriction, letting the devices negotiate
- * a higher speed. Also check for a similar 2.5GT/s speed restriction the
- * firmware may have already arranged and lift it with ports that already
- * report their data link being up.
+ * If this turns out successful, or where a 2.5GT/s speed restriction has
+ * been previously arranged by the firmware and the port reports its link
+ * already being up, lift the restriction, in a hope it is safe to do so,
+ * letting the devices negotiate a higher speed.
*
* Otherwise revert the speed to the original setting and request a retrain
* again to remove any residual state, ignoring the result as it's supposed
@@ -83,12 +82,9 @@
*/
int pcie_failed_link_retrain(struct pci_dev *dev)
{
- static const struct pci_device_id ids[] = {
- { PCI_VDEVICE(ASMEDIA, 0x2824) }, /* ASMedia ASM2824 */
- {}
- };
- u16 lnksta, lnkctl2;
+ u16 lnksta, lnkctl2, oldlnkctl2;
int ret = -ENOTTY;
+ u32 lnkcap;
if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) ||
!pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting)
@@ -96,10 +92,9 @@ int pcie_failed_link_retrain(struct pci_dev *dev)
pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &lnkctl2);
pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
+ oldlnkctl2 = lnkctl2;
if ((lnksta & (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_DLLLA)) ==
PCI_EXP_LNKSTA_LBMS) {
- u16 oldlnkctl2 = lnkctl2;
-
pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS;
@@ -107,35 +102,29 @@ int pcie_failed_link_retrain(struct pci_dev *dev)
pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
ret = pcie_retrain_link(dev, false);
- if (ret) {
- pci_info(dev, "retraining failed\n");
- pcie_capability_write_word(dev, PCI_EXP_LNKCTL2,
- oldlnkctl2);
- pcie_retrain_link(dev, true);
- return ret;
- }
-
- pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
+ if (ret)
+ goto err;
}
- if ((lnksta & PCI_EXP_LNKSTA_DLLLA) &&
- (lnkctl2 & PCI_EXP_LNKCTL2_TLS) == PCI_EXP_LNKCTL2_TLS_2_5GT &&
- pci_match_id(ids, dev)) {
- u32 lnkcap;
-
+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnkcap);
+ if ((lnkctl2 & PCI_EXP_LNKCTL2_TLS) == PCI_EXP_LNKCTL2_TLS_2_5GT &&
+ (lnkcap & PCI_EXP_LNKCAP_SLS) != PCI_EXP_LNKCAP_SLS_2_5GB) {
pci_info(dev, "removing 2.5GT/s downstream link speed restriction\n");
- pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnkcap);
lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS;
lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS;
pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
ret = pcie_retrain_link(dev, false);
- if (ret) {
- pci_info(dev, "retraining failed\n");
- return ret;
- }
+ if (ret)
+ goto err;
}
+ return ret;
+err:
+ pci_info(dev, "retraining failed\n");
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, oldlnkctl2);
+
+ pcie_retrain_link(dev, true);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0260/1266] udf: validate free block extents against the partition length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0259/1266] PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0261/1266] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
` (738 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jan Kara
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 5f0419457f89dce1a3f1c8e62a3adf2f39ab8168 upstream.
udf_free_blocks() checks the logical block number and count against the
partition length, but drops the extent offset from that final bound. A
crafted extent can pass the guard while logicalBlockNum + offset + count
points past the partition, which later indexes past the space bitmap
array.
A single ftruncate(2) on a file backed by such an extent reliably
panics the kernel. This is a local availability issue. On desktop
systems where UDisks/polkit allows the active user to mount removable
UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply
the crafted filesystem and trigger the panic by truncating a writable
file on it. Systems that require root or CAP_SYS_ADMIN to mount the
image have a higher prerequisite.
No confidentiality or integrity impact is claimed: the reproduced
primitive is an out-of-bounds read of a bitmap pointer slot followed by
a kernel panic.
Use the already computed logicalBlockNum + offset + count value for the
partition length check. Also make load_block_bitmap() reject an
out-of-range block group before indexing s_block_bitmap[], so corrupted
callers cannot walk past the flexible array.
Fixes: 56e69e59751d ("udf: prevent integer overflow in udf_bitmap_free_blocks()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260515142327.1120767-1-michael.bommarito@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/balloc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -82,8 +82,9 @@ static int __load_block_bitmap(struct su
int nr_groups = bitmap->s_nr_groups;
if (block_group >= nr_groups) {
- udf_debug("block_group (%u) > nr_groups (%d)\n",
+ udf_debug("block_group (%u) >= nr_groups (%d)\n",
block_group, nr_groups);
+ return -EFSCORRUPTED;
}
if (bitmap->s_block_bitmap[block_group]) {
@@ -679,7 +680,7 @@ void udf_free_blocks(struct super_block
if (check_add_overflow(bloc->logicalBlockNum, offset, &blk) ||
check_add_overflow(blk, count, &blk) ||
- bloc->logicalBlockNum + count > map->s_partition_len) {
+ blk > map->s_partition_len) {
udf_debug("Invalid request to free blocks: (%d, %u), off %u, "
"len %u, partition len %u\n",
partition, bloc->logicalBlockNum, offset, count,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0261/1266] udf: validate VAT header length against the VAT inode size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0260/1266] udf: validate free block extents against the partition length Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0262/1266] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
` (737 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jan Kara
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit d8202786b3d75125c84ebc4de6d946f92fde0ee8 upstream.
udf_load_vat() takes the virtual partition's start offset straight from
the on-disk VAT 2.0 header without checking it against the VAT inode
size:
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.s_start_offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds
the VAT inode size, the s_num_entries subtraction underflows to a huge
count, which defeats the "block > s_num_entries" bound in
udf_get_pblock_virt15(); and on the ICB-inline path that function reads
((__le32 *)(iinfo->i_data + s_start_offset))[block]
so a large s_start_offset indexes past the inode's in-ICB data. Mounting
a crafted UDF image with a virtual (VAT) partition then triggers an
out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one
entry within the VAT inode.
Fixes: fa5e08156335 ("udf: Handle VAT packed inside inode properly")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260612-b4-disp-9a2317ee-v1-1-fefef5736154@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1232,6 +1232,14 @@ static int udf_load_vat(struct super_blo
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
+ if (map->s_type_specific.s_virtual.s_start_offset
+ > sbi->s_vat_inode->i_size) {
+ udf_err(sb, "Corrupted VAT header length %u (VAT inode size %lld)\n",
+ map->s_type_specific.s_virtual.s_start_offset,
+ sbi->s_vat_inode->i_size);
+ brelse(bh);
+ return -EFSCORRUPTED;
+ }
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0262/1266] udf: validate sparing table length as an entry count, not a byte count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0261/1266] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0263/1266] hwrng: jh7110 - fix refcount leak in starfive_trng_read() Greg Kroah-Hartman
` (736 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jan Kara
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 3ec997bd5508e9b25210b5bbec89031629cdb093 upstream.
udf_load_sparable_map() accepts a sparing table when
sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize
is false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block. But the table is walked as an array of 8-byte
sparingEntry elements:
for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {
struct sparingEntry *entry = &st->mapEntry[i];
... entry->origLocation ...
}
in udf_get_pblock_spar15() and udf_relocate_blocks(). A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block. On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.
Validate reallocationTableLen as the entry count it is, with
struct_size().
Fixes: 1df2ae31c724 ("udf: Fortify loading of sparing table")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260612-b4-disp-91780c4e-v1-1-f15112ff6882@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1395,7 +1395,8 @@ static int udf_load_sparable_map(struct
if (ident != 0 ||
strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
strlen(UDF_ID_SPARING)) ||
- sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
+ struct_size(st, mapEntry,
+ le16_to_cpu(st->reallocationTableLen)) >
sb->s_blocksize) {
brelse(bh);
continue;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0263/1266] hwrng: jh7110 - fix refcount leak in starfive_trng_read()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0262/1266] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0264/1266] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
` (735 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 8d13f7a8450206e3f820cdb26e33e91d181071b4 upstream.
The starfive_trng_read() function acquires a runtime PM reference
via pm_runtime_get_sync() but fails to release it on two error
paths. If starfive_trng_wait_idle() or starfive_trng_cmd() returns
an error, the function exits without calling
pm_runtime_put_sync_autosuspend(), leaving the runtime PM usage
counter permanently elevated and preventing the device from entering
runtime suspend.
Refactor the function to use a unified error path that calls
pm_runtime_put_sync_autosuspend() before returning.
Cc: stable@vger.kernel.org
Fixes: c388f458bc34 ("hwrng: starfive - Add TRNG driver for StarFive SoC")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/hw_random/jh7110-trng.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/char/hw_random/jh7110-trng.c
+++ b/drivers/char/hw_random/jh7110-trng.c
@@ -256,19 +256,22 @@ static int starfive_trng_read(struct hwr
if (wait) {
ret = starfive_trng_wait_idle(trng);
- if (ret)
- return -ETIMEDOUT;
+ if (ret) {
+ ret = -ETIMEDOUT;
+ goto out_put;
+ }
}
ret = starfive_trng_cmd(trng, STARFIVE_CTRL_GENE_RANDNUM, wait);
if (ret)
- return ret;
+ goto out_put;
memcpy_fromio(buf, trng->base + STARFIVE_RAND0, max);
+ ret = max;
+out_put:
pm_runtime_put_sync_autosuspend(trng->dev);
-
- return max;
+ return ret;
}
static int starfive_trng_probe(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0264/1266] dm-ioctl: report an error if a device has no table
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0263/1266] hwrng: jh7110 - fix refcount leak in starfive_trng_read() Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0265/1266] nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Greg Kroah-Hartman
` (734 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Benjamin Marzinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 457e32348d606a77f9b20e25e989734189834c07 upstream.
When we send a message to a device that has no table, the return code was
not set. The code would return "2", which is not considered a valid return value.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1806,8 +1806,11 @@ static int target_message(struct file *f
goto out_argv;
table = dm_get_live_table(md, &srcu_idx);
- if (!table)
+ if (!table) {
+ DMERR("The device has no table.");
+ r = -EINVAL;
goto out_table;
+ }
if (dm_deleting_md(md)) {
r = -ENXIO;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0265/1266] nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0264/1266] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0266/1266] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
` (733 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Igor Achkinazi,
Keith Busch
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Achkinazi, Igor <Igor.Achkinazi@dell.com>
commit 88bac2c1a72b8f4f71e9845699aa872df04e5850 upstream.
When nvme_ns_head_submit_bio() remaps a bio from the multipath head to a
per-path namespace, bio_set_dev() clears BIO_REMAPPED. The remapped bio
is then resubmitted through submit_bio_noacct() which calls
bio_check_eod() because BIO_REMAPPED is not set.
This races with nvme_ns_remove() which zeroes the per-path capacity
before synchronize_srcu():
CPU 0 (IO submission)
---------------------
srcu_read_lock()
nvme_find_path() -> ns
[NVME_NS_READY is set]
CPU 1 (namespace removal)
-------------------------
clear_bit(NVME_NS_READY)
set_capacity(ns->disk, 0)
synchronize_srcu() <- blocks
CPU 0 (IO submission)
---------------------
bio_set_dev(bio, ns->disk->part0)
[clears BIO_REMAPPED]
submit_bio_noacct(bio)
-> bio_check_eod() sees capacity=0
-> bio fails with IO error
The SRCU read lock prevents synchronize_srcu() from completing, but does
not prevent set_capacity(0) from executing. The bio fails the EOD check
before it reaches the NVMe driver, so nvme_failover_req() never gets a
chance to redirect it to another path of multipath. IO errors are
reported to the application despite another path being available.
On older kernels (before commit 0b64682e78f7 "block: skip unnecessary
checks for split bio"), the same race was also reachable through split
remainders resubmitted via submit_bio_noacct().
Fix this by setting BIO_REMAPPED after bio_set_dev() in
nvme_ns_head_submit_bio(). This skips bio_check_eod() on the per-path
device; the EOD check already passed on the multipath head.
NVMe per-path namespace devices are always whole disks (bd_partno=0), so
the blk_partition_remap() skip also gated by BIO_REMAPPED is a no-op.
The flag does not persist across failover and cannot go stale if the
namespace geometry changes between attempts: nvme_failover_req() calls
bio_set_dev() to redirect the bio back to the multipath head, which
clears BIO_REMAPPED. When nvme_requeue_work() resubmits through
submit_bio_noacct(), bio_check_eod() runs normally against the current
capacity.
Same approach as commit 3a905c37c351 ("block: skip bio_check_eod for
partition-remapped bios").
Fixes: a7c7f7b2b641 ("nvme: use bio_set_dev to assign ->bi_bdev")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Igor Achkinazi <igor.achkinazi@dell.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/multipath.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -467,6 +467,12 @@ static void nvme_ns_head_submit_bio(stru
ns = nvme_find_path(head);
if (likely(ns)) {
bio_set_dev(bio, ns->disk->part0);
+ /*
+ * Use BIO_REMAPPED to skip bio_check_eod() when this bio
+ * enters submit_bio_noacct() for the per-path device. The EOD
+ * check already passed on the multipath head.
+ */
+ bio_set_flag(bio, BIO_REMAPPED);
bio->bi_opf |= REQ_NVME_MPATH;
trace_block_bio_remap(bio, disk_devt(ns->head->disk),
bio->bi_iter.bi_sector);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0266/1266] btrfs: do not trim a device which is not writeable
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0265/1266] nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0267/1266] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
` (732 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Yue, Filipe Manana, Qu Wenruo,
David Sterba
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
commit 1b1937eb08f51319bf71575484cde2b8c517aedc upstream.
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small fix.
Thankfully the regular bbio submission path has already handled it well
by checking if the device->bdev is NULL before submitting.
So here we just fix the crash by checking if the device is writeable and
has a bdev pointer before calling bdev_max_discard_sectors().
Reported-by: Su Yue <glass.su@suse.com>
Link: https://lore.kernel.org/linux-btrfs/wlwir19t.fsf@damenly.org/
Fixes: 499f377f49f0 ("btrfs: iterate over unused chunk space in FITRIM")
CC: stable@vger.kernel.org # 5.10+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent-tree.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6053,12 +6053,16 @@ static int btrfs_trim_free_extents(struc
*trimmed = 0;
- /* Discard not supported = nothing to do. */
- if (!bdev_max_discard_sectors(device->bdev))
+ /*
+ * The caller only filters out MISSING devices, but a device that was
+ * missing at mount and later rescanned has MISSING cleared while bdev
+ * is still NULL and WRITEABLE is still unset. Skip those here.
+ */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) || !device->bdev)
return 0;
- /* Not writable = nothing to do. */
- if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ /* Discard not supported = nothing to do. */
+ if (!bdev_max_discard_sectors(device->bdev))
return 0;
/* No free space = nothing to do. */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0267/1266] partitions: aix: bound the pp_count scan to the ppe array
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0266/1266] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0268/1266] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
` (731 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Philippe De Muyter,
Jens Axboe
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 2dc0bfd2fe355fb930de63c2f2eb8ced8570c579 upstream.
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.
Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Acked-by: Philippe De Muyter <phdm@macqel.be>
Link: https://patch.msgid.link/20260607064137.302574-1-hexlabsecurity@proton.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/partitions/aix.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -228,6 +228,15 @@ int aix_partition(struct parsed_partitio
int next_lp_ix = 1;
int lp_ix;
+ /*
+ * pvd was read into a fixed-size struct pvd whose ppe[] array
+ * holds ARRAY_SIZE(pvd->ppe) entries. pp_count is an
+ * unvalidated on-disk __be16, so clamp the scan to the array
+ * size to avoid walking past the allocation.
+ */
+ if (numpps > ARRAY_SIZE(pvd->ppe))
+ numpps = ARRAY_SIZE(pvd->ppe);
+
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
unsigned int lv_ix;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0268/1266] isofs: bound Rock Ridge symlink components to the SL record
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0267/1266] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0269/1266] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
` (730 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Bryam Vargas,
Jan Kara
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 5fa1d6a5ec2356d2107dead614437c66fa7138b1 upstream.
get_symlink_chunk() and the SL handling in
parse_rock_ridge_inode_internal() walk the variable-length components of
a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte
header (flags, len) followed by len bytes of text, so it occupies
slp->len + 2 bytes. Both loops read slp->len and advance to the next
component, and get_symlink_chunk() additionally does
memcpy(rpnt, slp->text, slp->len), but neither checks that the component
lies within the SL record before dereferencing it.
A crafted SL record whose component declares a len that runs past the
record (rr->len) therefore triggers an out-of-bounds read of up to 255
bytes. When the record sits at the tail of its backing buffer - for
example a small kmalloc()ed continuation block reached through a CE
record - the read crosses the allocation; get_symlink_chunk() then
copies the out-of-bounds bytes into the symlink body returned to user
space by readlink(), disclosing adjacent kernel memory.
ISO 9660 images are routinely mounted from untrusted removable media -
desktop environments auto-mount them (e.g. via udisks2) without
CAP_SYS_ADMIN - so the record contents are attacker-controlled.
Reject any component that does not fit in the remaining record bytes
before using it. In get_symlink_chunk() return NULL, like the existing
output-buffer (plimit) checks, so a malformed record makes readlink()
fail with -EIO rather than silently returning a truncated target; in
parse_rock_ridge_inode_internal() stop the inode-size walk.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Suggested-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260607011823.217748-1-hexlabsecurity@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/isofs/rock.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -462,6 +462,9 @@ repeat:
inode->i_size = symlink_len;
while (slen > 1) {
rootflag = 0;
+ /* keep the component within the SL record */
+ if (slp->len + 2 > slen)
+ goto eio;
switch (slp->flags & ~1) {
case 0:
inode->i_size +=
@@ -617,6 +620,14 @@ static char *get_symlink_chunk(char *rpn
slp = &rr->u.SL.link;
while (slen > 1) {
rootflag = 0;
+ /*
+ * A component is slp->len + 2 bytes (a two-byte header plus
+ * len bytes of text). If it does not fit in the bytes left in
+ * the SL record the record is malformed: fail like the plimit
+ * checks below so readlink() returns -EIO, not a truncated path.
+ */
+ if (slp->len + 2 > slen)
+ return NULL;
switch (slp->flags & ~1) {
case 0:
if (slp->len > plimit - rpnt)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0269/1266] crypto: af_alg - Remove zero-copy support from skcipher and aead
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0268/1266] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0270/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
` (729 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taeyang Lee, Feng Ning,
Demi Marie Obenour, Eric Biggers, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit ffdd2bc378953b525aca61902534e753f1f8e734 upstream.
The zero-copy support is one of the riskiest aspects of AF_ALG. It
allows userspace to request cryptographic operations directly on
pagecache pages of files like the 'su' binary. It also allows userspace
to concurrently modify the memory which is being operated on, a recipe
for TOCTOU vulnerabilities.
While zero-copy support is more valuable in other areas of the kernel
like the frequently used networking and file I/O code, it has far less
value in AF_ALG, which is a niche UAPI. AF_ALG primarily just exists
for backwards compatibility with a small set of userspace programs such
as 'iwd' that haven't yet been fixed to use userspace crypto code.
Originally AF_ALG was intended to be used to access hardware crypto
accelerators. However, it isn't an efficient interface for that anyway,
and it turned out to be rarely used in this way in practice.
Thus, the risks of the zero-copy support in AF_ALG vastly outweigh its
benefits. Let's just remove it.
This commit removes it from the "skcipher" and "aead" algorithm types.
"hash" will be handled separately.
This is a soft break, not a hard break. Even after this commit, it
still works to use splice() or sendfile() to transfer data to an AF_ALG
request socket from a pipe or any file, respectively. What changes is
just that the kernel now makes an internal, stable copy of the data
before doing the crypto operation. So performance is slightly reduced,
but the UAPI isn't broken. And, very importantly, it's much safer.
Tested with libkcapi/test.sh. All its test cases still pass. I also
verified that this would have prevented the copy.fail exploit as well.
I also used a custom test program to verify that sendfile() still works.
Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
Fixes: 400c40cf78da ("crypto: algif - add AEAD support")
Reported-by: Taeyang Lee <0wn@theori.io>
Link: https://copy.fail/
Reported-by: Feng Ning <feng@innora.ai>
Closes: https://lore.kernel.org/r/afYcc-tZFwvZZo76@ans-MacBook-Pro.local
Reviewed-by: Demi Marie Obenour <demiobenour@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/crypto/userspace-if.rst | 31 +-------------
crypto/af_alg.c | 71 +++++++++++-----------------------
crypto/algif_aead.c | 8 +--
3 files changed, 32 insertions(+), 78 deletions(-)
--- a/Documentation/crypto/userspace-if.rst
+++ b/Documentation/crypto/userspace-if.rst
@@ -328,33 +328,10 @@ CRYPTO_USER_API_RNG_CAVP option:
Zero-Copy Interface
-------------------
-In addition to the send/write/read/recv system call family, the AF_ALG
-interface can be accessed with the zero-copy interface of
-splice/vmsplice. As the name indicates, the kernel tries to avoid a copy
-operation into kernel space.
-
-The zero-copy operation requires data to be aligned at the page
-boundary. Non-aligned data can be used as well, but may require more
-operations of the kernel which would defeat the speed gains obtained
-from the zero-copy interface.
-
-The system-inherent limit for the size of one zero-copy operation is 16
-pages. If more data is to be sent to AF_ALG, user space must slice the
-input into segments with a maximum size of 16 pages.
-
-Zero-copy can be used with the following code example (a complete
-working example is provided with libkcapi):
-
-::
-
- int pipes[2];
-
- pipe(pipes);
- /* input data in iov */
- vmsplice(pipes[1], iov, iovlen, SPLICE_F_GIFT);
- /* opfd is the file descriptor returned from accept() system call */
- splice(pipes[0], NULL, opfd, NULL, ret, 0);
- read(opfd, out, outlen);
+AF_ALG used to have zero-copy support, but it was removed due to it being a
+frequent source of vulnerabilities. For backwards compatibility the splice()
+and sendfile() system calls are still supported, but the kernel will make an
+internal copy of the data before passing it to the crypto code.
Setsockopt Interface
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -976,7 +976,7 @@ int af_alg_sendmsg(struct socket *sock,
ssize_t plen;
/* use the existing memory in an allocated page */
- if (ctx->merge && !(msg->msg_flags & MSG_SPLICE_PAGES)) {
+ if (ctx->merge) {
sgl = list_entry(ctx->tsgl_list.prev,
struct af_alg_tsgl, list);
sg = sgl->sg + sgl->cur - 1;
@@ -1020,60 +1020,37 @@ int af_alg_sendmsg(struct socket *sock,
if (sgl->cur)
sg_unmark_end(sg + sgl->cur - 1);
- if (msg->msg_flags & MSG_SPLICE_PAGES) {
- struct sg_table sgtable = {
- .sgl = sg,
- .nents = sgl->cur,
- .orig_nents = sgl->cur,
- };
-
- plen = extract_iter_to_sg(&msg->msg_iter, len, &sgtable,
- MAX_SGL_ENTS - sgl->cur, 0);
- if (plen < 0) {
- err = plen;
+ do {
+ struct page *pg;
+ unsigned int i = sgl->cur;
+
+ plen = min_t(size_t, len, PAGE_SIZE);
+
+ pg = alloc_page(GFP_KERNEL);
+ if (!pg) {
+ err = -ENOMEM;
goto unlock;
}
- for (; sgl->cur < sgtable.nents; sgl->cur++)
- get_page(sg_page(&sg[sgl->cur]));
+ sg_assign_page(sg + i, pg);
+
+ err = memcpy_from_msg(page_address(sg_page(sg + i)),
+ msg, plen);
+ if (err) {
+ __free_page(sg_page(sg + i));
+ sg_assign_page(sg + i, NULL);
+ goto unlock;
+ }
+
+ sg[i].length = plen;
len -= plen;
ctx->used += plen;
copied += plen;
size -= plen;
- } else {
- do {
- struct page *pg;
- unsigned int i = sgl->cur;
-
- plen = min_t(size_t, len, PAGE_SIZE);
-
- pg = alloc_page(GFP_KERNEL);
- if (!pg) {
- err = -ENOMEM;
- goto unlock;
- }
-
- sg_assign_page(sg + i, pg);
-
- err = memcpy_from_msg(
- page_address(sg_page(sg + i)),
- msg, plen);
- if (err) {
- __free_page(sg_page(sg + i));
- sg_assign_page(sg + i, NULL);
- goto unlock;
- }
-
- sg[i].length = plen;
- len -= plen;
- ctx->used += plen;
- copied += plen;
- size -= plen;
- sgl->cur++;
- } while (len && sgl->cur < MAX_SGL_ENTS);
+ sgl->cur++;
+ } while (len && sgl->cur < MAX_SGL_ENTS);
- ctx->merge = plen & (PAGE_SIZE - 1);
- }
+ ctx->merge = plen & (PAGE_SIZE - 1);
if (!size)
sg_mark_end(sg + sgl->cur - 1);
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -9,10 +9,10 @@
* The following concept of the memory management is used:
*
* The kernel maintains two SGLs, the TX SGL and the RX SGL. The TX SGL is
- * filled by user space with the data submitted via sendmsg (maybe with
- * MSG_SPLICE_PAGES). Filling up the TX SGL does not cause a crypto operation
- * -- the data will only be tracked by the kernel. Upon receipt of one recvmsg
- * call, the caller must provide a buffer which is tracked with the RX SGL.
+ * filled by user space with the data submitted via sendmsg. Filling up the TX
+ * SGL does not cause a crypto operation -- the data will only be tracked by the
+ * kernel. Upon receipt of one recvmsg call, the caller must provide a buffer
+ * which is tracked with the RX SGL.
*
* During the processing of the recvmsg operation, the cipher request is
* allocated and prepared. As part of the recvmsg operation, the processed
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0270/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0269/1266] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0271/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
` (728 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 3f57657b6ea23f933371f2c2846322f441773cee upstream.
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() and gen_split_key() to avoid leaking secrets at runtime when
CONFIG_DYNAMIC_DEBUG is enabled.
Fixes: 6e005503199b ("crypto: caam - print debug messages at debug level")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/caam/caamalg.c | 12 ++++++------
drivers/crypto/caam/caamalg_qi.c | 12 ++++++------
drivers/crypto/caam/caamhash.c | 4 ++--
drivers/crypto/caam/key_gen.c | 4 ++--
4 files changed, 16 insertions(+), 16 deletions(-)
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -597,7 +597,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(jrdev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
/*
@@ -633,7 +633,7 @@ static int aead_setkey(struct crypto_aea
dma_sync_single_for_device(jrdev, ctx->key_dma, ctx->adata.keylen_pad +
keys.enckeylen, ctx->dir);
- print_hex_dump_debug("ctx.key@"__stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -674,7 +674,7 @@ static int gcm_setkey(struct crypto_aead
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -695,7 +695,7 @@ static int rfc4106_setkey(struct crypto_
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -721,7 +721,7 @@ static int rfc4543_setkey(struct crypto_
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -748,7 +748,7 @@ static int skcipher_setkey(struct crypto
u32 *desc;
const bool is_rfc3686 = alg->caam.rfc3686;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -212,7 +212,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(jrdev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
/*
@@ -248,7 +248,7 @@ static int aead_setkey(struct crypto_aea
ctx->adata.keylen_pad + keys.enckeylen,
ctx->dir);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -371,7 +371,7 @@ static int gcm_setkey(struct crypto_aead
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -475,7 +475,7 @@ static int rfc4106_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -581,7 +581,7 @@ static int rfc4543_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -631,7 +631,7 @@ static int skcipher_setkey(struct crypto
const bool is_rfc3686 = alg->caam.rfc3686;
int ret = 0;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -505,7 +505,7 @@ static int axcbc_setkey(struct crypto_ah
DMA_TO_DEVICE);
ctx->adata.keylen = keylen;
- print_hex_dump_debug("axcbc ctx.key@" __stringify(__LINE__)" : ",
+ print_hex_dump_devel("axcbc ctx.key@" __stringify(__LINE__)" : ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key, keylen, 1);
return axcbc_set_sh_desc(ahash);
@@ -525,7 +525,7 @@ static int acmac_setkey(struct crypto_ah
ctx->adata.key_virt = key;
ctx->adata.keylen = keylen;
- print_hex_dump_debug("acmac ctx.key@" __stringify(__LINE__)" : ",
+ print_hex_dump_devel("acmac ctx.key@" __stringify(__LINE__)" : ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
return acmac_set_sh_desc(ahash);
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -58,7 +58,7 @@ int gen_split_key(struct device *jrdev,
dev_dbg(jrdev, "split keylen %d split keylen padded %d\n",
adata->keylen, adata->keylen_pad);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key_in, keylen, 1);
if (local_max > max_keylen)
@@ -113,7 +113,7 @@ int gen_split_key(struct device *jrdev,
wait_for_completion(&result.completion);
ret = result.err;
- print_hex_dump_debug("ctx.key@"__stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key_out,
adata->keylen_pad, 1);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0271/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps again
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0270/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0272/1266] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
` (727 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 8005dc808bcce7d6cc2ae015a3cde1683bee602d upstream.
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG
is enabled.
Fixes: 8d818c105501 ("crypto: caam/qi2 - add DPAA2-CAAM driver")
Fixes: 226853ac3ebe ("crypto: caam/qi2 - add skcipher algorithms")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/caam/caamalg_qi2.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -299,7 +299,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(dev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->adata.keylen = keys.authkeylen;
@@ -313,7 +313,7 @@ static int aead_setkey(struct crypto_aea
memcpy(ctx->key + ctx->adata.keylen_pad, keys.enckey, keys.enckeylen);
dma_sync_single_for_device(dev, ctx->key_dma, ctx->adata.keylen_pad +
keys.enckeylen, ctx->dir);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -730,7 +730,7 @@ static int gcm_setkey(struct crypto_aead
ret = aes_check_keylen(keylen);
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -826,7 +826,7 @@ static int rfc4106_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -925,7 +925,7 @@ static int rfc4543_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -953,7 +953,7 @@ static int skcipher_setkey(struct crypto
u32 *desc;
const bool is_rfc3686 = alg->caam.rfc3686;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0272/1266] crypto: ecc - Fix carry overflow in vli multiplication
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0271/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0273/1266] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
` (726 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anastasia Tishchenko, Lukas Wunner,
Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasia Tishchenko <sv3iry@gmail.com>
commit 27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406 upstream.
The carry flag calculation fails when r01.m_high is saturated
(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.
The condition (r01.m_high < product.m_high) doesn't handle the case
where r01.m_high == product.m_high and an additional carry exists
from lower-bit overflow.
When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
introduced crypto/ecc.c, it split the muladd() function in the
micro-ecc library into separate mul_64_64() and add_128_128() helpers.
It seems the check got lost in translation.
Add proper handling for this boundary by accounting for the carry
from the lower addition.
Fixes: 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
Signed-off-by: Anastasia Tishchenko <sv3iry@gmail.com>
Cc: stable@vger.kernel.org # v4.8+
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/ecc.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -400,14 +400,26 @@ static uint128_t mul_64_64(u64 left, u64
return result;
}
-static uint128_t add_128_128(uint128_t a, uint128_t b)
+/* Calculate addition with overflow checking. Returns true on wrap-around,
+ * false otherwise.
+ */
+static bool check_add_128_128_overflow(uint128_t *result, uint128_t a,
+ uint128_t b)
{
- uint128_t result;
+ bool carry;
- result.m_low = a.m_low + b.m_low;
- result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low);
+ result->m_low = a.m_low + b.m_low;
+ carry = (result->m_low < a.m_low);
- return result;
+ result->m_high = a.m_high + b.m_high + carry;
+
+ /* Using constant-time bitwise arithmetic to prevent timing
+ * side-channels.
+ */
+ carry = (result->m_high < a.m_high) |
+ ((result->m_high == a.m_high) & carry);
+
+ return carry;
}
static void vli_mult(u64 *result, const u64 *left, const u64 *right,
@@ -432,9 +444,7 @@ static void vli_mult(u64 *result, const
uint128_t product;
product = mul_64_64(left[i], right[k - i]);
-
- r01 = add_128_128(r01, product);
- r2 += (r01.m_high < product.m_high);
+ r2 += check_add_128_128_overflow(&r01, r01, product);
}
result[k] = r01.m_low;
@@ -457,7 +467,7 @@ static void vli_umult(u64 *result, const
uint128_t product;
product = mul_64_64(left[k], right);
- r01 = add_128_128(r01, product);
+ check_add_128_128_overflow(&r01, r01, product);
/* no carry */
result[k] = r01.m_low;
r01.m_low = r01.m_high;
@@ -494,8 +504,7 @@ static void vli_square(u64 *result, cons
product.m_low <<= 1;
}
- r01 = add_128_128(r01, product);
- r2 += (r01.m_high < product.m_high);
+ r2 += check_add_128_128_overflow(&r01, r01, product);
}
result[k] = r01.m_low;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0273/1266] crypto: pcrypt - restore callback for non-parallel fallback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0272/1266] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0274/1266] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
` (725 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Zhengchuan Liang, Xin Liu, Ruijie Li, Ren Wei,
Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruijie Li <ruijieli51@gmail.com>
commit ed459fe319376e876de433d12b6c6772e612ca36 upstream.
pcrypt installs pcrypt_aead_done() on the child AEAD request before
trying to submit it through padata. If padata_do_parallel() returns
-EBUSY, pcrypt falls back to calling the child AEAD directly.
That fallback must not keep the padata completion callback. Otherwise
an asynchronous completion runs pcrypt_aead_done() even though the
request was never enrolled in padata.
Restore the original request callback and callback data before calling
the child AEAD directly. This keeps the fallback path aligned with a
direct AEAD request while leaving the parallel path unchanged.
Fixes: 662f2f13e66d ("crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Ruijie Li <ruijieli51@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/pcrypt.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -122,6 +122,8 @@ static int pcrypt_aead_encrypt(struct ae
return -EINPROGRESS;
if (err == -EBUSY) {
/* try non-parallel mode */
+ aead_request_set_callback(creq, flags, req->base.complete,
+ req->base.data);
return crypto_aead_encrypt(creq);
}
@@ -173,6 +175,8 @@ static int pcrypt_aead_decrypt(struct ae
return -EINPROGRESS;
if (err == -EBUSY) {
/* try non-parallel mode */
+ aead_request_set_callback(creq, flags, req->base.complete,
+ req->base.data);
return crypto_aead_decrypt(creq);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0274/1266] crypto: drbg - Fix returning success on failure in CTR_DRBG
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0273/1266] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0275/1266] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
` (724 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b upstream.
drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized. Fix it.
Fixes: cde001e4c3c3 ("crypto: rng - RNGs must return 0 in success case")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/drbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -603,7 +603,7 @@ static int drbg_ctr_generate(struct drbg
if (addtl && !list_empty(addtl)) {
ret = drbg_ctr_update(drbg, addtl, 2);
if (ret)
- return 0;
+ return ret;
}
/* 10.2.1.5.2 step 4.1 */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0275/1266] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0274/1266] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0276/1266] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
` (723 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 6f49f00c981bbb9ef602966f19bfdbef46b681d2 upstream.
On 64-bit kernels, drbg_max_addtl() returns 2**35 bytes. That's too
large, for two reasons:
1. SP800-90A says the maximum limit is 2**35 *bits*, not 2**35 bytes.
So the implemented limit has confused bits and bytes.
2. When drbg_kcapi_hash() calls crypto_shash_update() on the additional
information string, the length is implicitly cast to 'unsigned int'.
That truncates the additional information string to U32_MAX bytes.
Fix the maximum additional information string length to always be
U32_MAX - 1, causing an error to be returned for any longer lengths.
Fixes: 541af946fe13 ("crypto: drbg - SP800-90A Deterministic Random Bit Generator")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/crypto/drbg.h | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
--- a/include/crypto/drbg.h
+++ b/include/crypto/drbg.h
@@ -171,19 +171,15 @@ static inline size_t drbg_max_request_by
return (1 << 16);
}
+/*
+ * SP800-90A allows implementations to support additional info / personalization
+ * strings of up to 2**35 bits. Implementations can have a smaller maximum. We
+ * use 2**35 - 16 bits == U32_MAX - 1 bytes so that the max + 1 always fits in a
+ * size_t, allowing drbg_healthcheck_sanity() to verify its enforcement.
+ */
static inline size_t drbg_max_addtl(struct drbg_state *drbg)
{
- /* SP800-90A requires 2**35 bytes additional info str / pers str */
-#if (__BITS_PER_LONG == 32)
- /*
- * SP800-90A allows smaller maximum numbers to be returned -- we
- * return SIZE_MAX - 1 to allow the verification of the enforcement
- * of this value in drbg_healthcheck_sanity.
- */
- return (SIZE_MAX - 1);
-#else
- return (1UL<<35);
-#endif
+ return U32_MAX - 1;
}
static inline size_t drbg_max_requests(struct drbg_state *drbg)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0276/1266] crypto: drbg - Fix the fips_enabled priority boost
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0275/1266] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0277/1266] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
` (722 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit a8a1f93080efc83a9ff8452954429ae379e9e614 upstream.
When fips_enabled=1, it seems to have been intended for one of the
algorithms defined in crypto/drbg.c to be the highest priority "stdrng"
algorithm, so that it is what is used by "stdrng" users.
However, the code only boosts the priority to 400, which is less than
the priority 500 used in drivers/crypto/caam/caamprng.c. Thus, the CAAM
RNG could be used instead.
Fix this by boosting the priority by 2000 instead of 200.
Fixes: 541af946fe13 ("crypto: drbg - SP800-90A Deterministic Random Bit Generator")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/drbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -2095,7 +2095,7 @@ static inline void __init drbg_fill_arra
* it is selected.
*/
if (fips_enabled)
- alg->base.cra_priority += 200;
+ alg->base.cra_priority += 2000;
alg->base.cra_ctxsize = sizeof(struct drbg_state);
alg->base.cra_module = THIS_MODULE;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0277/1266] crypto: qat - validate RSA CRT component lengths
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0276/1266] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0278/1266] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
` (721 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Laurent M Coquerel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
commit b3ac78756588059729b9195fcc9f4b37d54057a5 upstream.
The generic RSA key parser (rsa_helper.c) bounds each CRT component (p,
q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()
allocates half-size DMA buffers (key_sz / 2) and right-aligns each
component with:
memcpy(dst + half_key_sz - len, src, len)
When a CRT component is larger than half_key_sz the subtraction
underflows and memcpy writes past the DMA buffer, causing memory
corruption.
Add a len > half_key_sz check next to the existing !len check for each
of the five CRT components so the driver falls back to the non-CRT path
instead of writing out of bounds.
Fixes: 879f77e9071f ("crypto: qat - Add RSA CRT mode")
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Tested-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/crypto/intel/qat/qat_common/qat_asym_algs.c
+++ b/drivers/crypto/intel/qat/qat_common/qat_asym_algs.c
@@ -1032,7 +1032,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->p;
len = rsa_key->p_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto err;
ctx->p = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_p, GFP_KERNEL);
if (!ctx->p)
@@ -1043,7 +1043,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->q;
len = rsa_key->q_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_p;
ctx->q = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_q, GFP_KERNEL);
if (!ctx->q)
@@ -1054,7 +1054,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->dp;
len = rsa_key->dp_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_q;
ctx->dp = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_dp,
GFP_KERNEL);
@@ -1066,7 +1066,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->dq;
len = rsa_key->dq_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_dp;
ctx->dq = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_dq,
GFP_KERNEL);
@@ -1078,7 +1078,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->qinv;
len = rsa_key->qinv_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_dq;
ctx->qinv = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_qinv,
GFP_KERNEL);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0278/1266] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0277/1266] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0279/1266] crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Greg Kroah-Hartman
` (720 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 upstream.
In order to know if a descriptor has been processed by the device,
the driver polls the FIFO to see if DESC_HDR_DONE is set on a descriptor
header to confirm completion.
The current code does not make sure that the CPU gets up to date data
before reading the descriptor.
Fix this by calling dma_sync_single_for_cpu() before reading memory
written by the device.
Cc: stable@vger.kernel.org
Fixes: 58cdbc6d2263 ("crypto: talitos - fix hash on SEC1.")
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -322,19 +322,31 @@ static int talitos_submit(struct device
return -EINPROGRESS;
}
-static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
+static __be32 get_request_hdr(struct device *dev,
+ struct talitos_request *request, bool is_sec1)
{
struct talitos_edesc *edesc;
- if (!is_sec1)
+ if (!is_sec1) {
+ dma_sync_single_for_cpu(dev, request->dma_desc,
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+
return request->desc->hdr;
+ }
- if (!request->desc->next_desc)
+ if (!request->desc->next_desc) {
+ dma_sync_single_for_cpu(dev, request->dma_desc,
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
return request->desc->hdr1;
-
- edesc = container_of(request->desc, struct talitos_edesc, desc);
-
- return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
+ } else {
+ dma_sync_single_for_cpu(dev,
+ be32_to_cpu(request->desc->next_desc),
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ edesc = container_of(request->desc, struct talitos_edesc, desc);
+
+ return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))
+ ->hdr1;
+ }
}
/*
@@ -358,7 +370,7 @@ static void flush_channel(struct device
/* descriptors with their done bits set don't get the error */
rmb();
- hdr = get_request_hdr(request, is_sec1);
+ hdr = get_request_hdr(dev, request, is_sec1);
if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
status = 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0279/1266] crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0278/1266] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0280/1266] crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Greg Kroah-Hartman
` (719 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit f126384ed55279c3b676f89d5ab547b8de8df782 upstream.
The SEC1 hardware can process a chain of descriptors without host
intervention. Only the hash implementation currently use this feature,
but with a chain of at most 2 descriptors added in commit 37b5e8897eb5
("crypto: talitos - chain in buffered data for ahash on SEC1").
Add supports for chaining an arbitrary number of descriptors in a chain.
Adapt the ahash implementation to make it compatible.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 180 +++++++++++++++++++++++++++++++----------------
drivers/crypto/talitos.h | 2
2 files changed, 124 insertions(+), 58 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -273,7 +273,10 @@ static int talitos_submit(struct device
void *context, int error),
void *context)
{
+ struct talitos_edesc *edesc = container_of(desc, struct talitos_edesc, desc);
struct talitos_private *priv = dev_get_drvdata(dev);
+ dma_addr_t dma_desc, prev_dma_desc;
+ struct talitos_edesc *prev_edesc = NULL;
struct talitos_request *request;
unsigned long flags;
int head;
@@ -292,10 +295,31 @@ static int talitos_submit(struct device
/* map descriptor and save caller data */
if (is_sec1) {
- desc->hdr1 = desc->hdr;
- request->dma_desc = dma_map_single(dev, &desc->hdr1,
+ while (edesc) {
+ edesc->desc.hdr1 = edesc->desc.hdr;
+
+ dma_desc = dma_map_single(dev, &edesc->desc.hdr1,
+ TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+
+ if (!prev_edesc) {
+ request->dma_desc = dma_desc;
+ goto next;
+ }
+
+ /* Chain in any previous descriptors. */
+
+ prev_edesc->desc.next_desc = cpu_to_be32(dma_desc);
+
+ dma_sync_single_for_device(dev, prev_dma_desc,
TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
+ DMA_TO_DEVICE);
+
+next:
+ prev_edesc = edesc;
+ prev_dma_desc = dma_desc;
+ edesc = edesc->next_desc;
+ }
} else {
request->dma_desc = dma_map_single(dev, desc,
TALITOS_DESC_SIZE,
@@ -326,6 +350,7 @@ static __be32 get_request_hdr(struct dev
struct talitos_request *request, bool is_sec1)
{
struct talitos_edesc *edesc;
+ dma_addr_t dma_desc;
if (!is_sec1) {
dma_sync_single_for_cpu(dev, request->dma_desc,
@@ -334,19 +359,17 @@ static __be32 get_request_hdr(struct dev
return request->desc->hdr;
}
- if (!request->desc->next_desc) {
- dma_sync_single_for_cpu(dev, request->dma_desc,
- TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
- return request->desc->hdr1;
- } else {
- dma_sync_single_for_cpu(dev,
- be32_to_cpu(request->desc->next_desc),
- TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
- edesc = container_of(request->desc, struct talitos_edesc, desc);
-
- return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))
- ->hdr1;
+ edesc = container_of(request->desc, struct talitos_edesc, desc);
+ dma_desc = request->dma_desc;
+ while (edesc->next_desc) {
+ dma_desc = be32_to_cpu(edesc->desc.next_desc);
+ edesc = edesc->next_desc;
}
+
+ dma_sync_single_for_cpu(dev, dma_desc, TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+
+ return edesc->desc.hdr1;
}
/*
@@ -356,6 +379,7 @@ static void flush_channel(struct device
{
struct talitos_private *priv = dev_get_drvdata(dev);
struct talitos_request *request, saved_req;
+ struct talitos_edesc *edesc;
unsigned long flags;
int tail, status;
bool is_sec1 = has_ftr_sec1(priv);
@@ -380,9 +404,22 @@ static void flush_channel(struct device
else
status = error;
- dma_unmap_single(dev, request->dma_desc,
- TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
+ if (is_sec1) {
+ dma_unmap_single(dev, request->dma_desc,
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ edesc = container_of(request->desc,
+ struct talitos_edesc, desc);
+ while (edesc->next_desc) {
+ dma_unmap_single(
+ dev, be32_to_cpu(edesc->desc.next_desc),
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ edesc = edesc->next_desc;
+ }
+ } else {
+ dma_unmap_single(dev, request->dma_desc,
+ TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+ }
/* copy entries so we can call callback outside lock */
saved_req.desc = request->desc;
@@ -477,8 +514,12 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH
static __be32 current_desc_hdr(struct device *dev, int ch)
{
struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+ struct talitos_request *request;
+ struct talitos_edesc *edesc;
int tail, iter;
dma_addr_t cur_desc;
+ __be32 hdr = 0;
cur_desc = ((u64)in_be32(priv->chan[ch].reg + TALITOS_CDPR)) << 32;
cur_desc |= in_be32(priv->chan[ch].reg + TALITOS_CDPR_LO);
@@ -489,27 +530,35 @@ static __be32 current_desc_hdr(struct de
}
tail = priv->chan[ch].tail;
-
iter = tail;
- while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
- priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
- iter = (iter + 1) & (priv->fifo_len - 1);
- if (iter == tail) {
- dev_err(dev, "couldn't locate current descriptor\n");
- return 0;
+ do {
+ request = &priv->chan[ch].fifo[iter];
+
+ if (request->dma_desc == cur_desc) {
+ hdr = request->desc->hdr;
+ } else if (is_sec1) {
+ edesc = container_of(request->desc,
+ struct talitos_edesc, desc);
+ while (edesc->next_desc) {
+ if (edesc->desc.next_desc ==
+ cpu_to_be32(cur_desc)) {
+ hdr = edesc->next_desc->desc.hdr1;
+ break;
+ }
+ edesc = edesc->next_desc;
+ }
}
- }
- if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
- struct talitos_edesc *edesc;
+ if (hdr)
+ break;
- edesc = container_of(priv->chan[ch].fifo[iter].desc,
- struct talitos_edesc, desc);
- return ((struct talitos_desc *)
- (edesc->buf + edesc->dma_len))->hdr;
- }
+ iter = (iter + 1) & (priv->fifo_len - 1);
+ } while (iter != tail);
+
+ if (!hdr)
+ dev_err(dev, "couldn't locate current descriptor\n");
- return priv->chan[ch].fifo[iter].desc->hdr;
+ return hdr;
}
/*
@@ -1408,10 +1457,6 @@ static struct talitos_edesc *talitos_ede
dma_len = 0;
}
alloc_len += icv_stashing ? authsize : 0;
-
- /* if its a ahash, add space for a second desc next to the first one */
- if (is_sec1 && !dst)
- alloc_len += sizeof(struct talitos_desc);
alloc_len += ivsize;
edesc = kmalloc(ALIGN(alloc_len, dma_get_cache_alignment()), flags);
@@ -1427,6 +1472,7 @@ static struct talitos_edesc *talitos_ede
edesc->dst_nents = dst_nents;
edesc->iv_dma = iv_dma;
edesc->dma_len = dma_len;
+ edesc->next_desc = NULL;
if (dma_len)
edesc->dma_link_tbl = dma_map_single(dev, &edesc->link_tbl[0],
edesc->dma_len,
@@ -1727,8 +1773,10 @@ static void common_nonsnoop_hash_unmap(s
struct talitos_private *priv = dev_get_drvdata(dev);
bool is_sec1 = has_ftr_sec1(priv);
struct talitos_desc *desc = &edesc->desc;
- struct talitos_desc *desc2 = (struct talitos_desc *)
- (edesc->buf + edesc->dma_len);
+ struct talitos_desc *desc2;
+
+ if (desc->next_desc)
+ desc2 = &edesc->next_desc->desc;
unmap_single_talitos_ptr(dev, &desc->ptr[5], DMA_FROM_DEVICE);
if (desc->next_desc &&
@@ -1756,10 +1804,17 @@ static void common_nonsnoop_hash_unmap(s
if (edesc->dma_len)
dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
DMA_BIDIRECTIONAL);
+}
- if (desc->next_desc)
- dma_unmap_single(dev, be32_to_cpu(desc->next_desc),
- TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+static void free_edesc_list_from(struct talitos_edesc *edesc)
+{
+ struct talitos_edesc *next;
+
+ while (edesc) {
+ next = edesc->next_desc;
+ kfree(edesc);
+ edesc = next;
+ }
}
static void ahash_done(struct device *dev,
@@ -1778,7 +1833,7 @@ static void ahash_done(struct device *de
}
common_nonsnoop_hash_unmap(dev, edesc, areq);
- kfree(edesc);
+ free_edesc_list_from(edesc);
if (err) {
ahash_request_complete(areq, err);
@@ -1894,14 +1949,23 @@ static int common_nonsnoop_hash(struct t
talitos_handle_buggy_hash(ctx, edesc, &desc->ptr[3]);
if (is_sec1 && req_ctx->nbuf && length) {
- struct talitos_desc *desc2 = (struct talitos_desc *)
- (edesc->buf + edesc->dma_len);
- dma_addr_t next_desc;
+ struct talitos_edesc *edesc2;
+ struct talitos_desc *desc2;
+
+ edesc2 = kzalloc(sizeof(*edesc2),
+ areq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
+ GFP_KERNEL :
+ GFP_ATOMIC);
+ if (!edesc2) {
+ ret = -ENOMEM;
+ goto err;
+ }
+ edesc->next_desc = edesc2;
+
+ desc2 = &edesc2->desc;
- memset(desc2, 0, sizeof(*desc2));
desc2->hdr = desc->hdr;
desc2->hdr &= ~DESC_HDR_MODE0_MDEU_INIT;
- desc2->hdr1 = desc2->hdr;
desc->hdr &= ~DESC_HDR_MODE0_MDEU_PAD;
desc->hdr |= DESC_HDR_MODE0_MDEU_CONT;
desc->hdr &= ~DESC_HDR_DONE_NOTIFY;
@@ -1925,21 +1989,21 @@ static int common_nonsnoop_hash(struct t
req_ctx->hw_context_size,
req_ctx->hw_context,
DMA_FROM_DEVICE);
-
- next_desc = dma_map_single(dev, &desc2->hdr1, TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
- desc->next_desc = cpu_to_be32(next_desc);
}
if (sync_needed)
dma_sync_single_for_device(dev, edesc->dma_link_tbl,
edesc->dma_len, DMA_BIDIRECTIONAL);
- ret = talitos_submit(dev, ctx->ch, desc, callback, areq);
- if (ret != -EINPROGRESS) {
- common_nonsnoop_hash_unmap(dev, edesc, areq);
- kfree(edesc);
- }
+ ret = talitos_submit(dev, ctx->ch, desc, callback,
+ areq);
+ if (ret != -EINPROGRESS)
+ goto err;
+
+ return -EINPROGRESS;
+err:
+ common_nonsnoop_hash_unmap(dev, edesc, areq);
+ kfree(edesc);
return ret;
}
--- a/drivers/crypto/talitos.h
+++ b/drivers/crypto/talitos.h
@@ -49,6 +49,7 @@ struct talitos_desc {
* @iv_dma: dma address of iv for checking continuity and link table
* @dma_len: length of dma mapped link_tbl space
* @dma_link_tbl: bus physical address of link_tbl/buf
+ * @next_desc: next descriptor
* @desc: h/w descriptor
* @link_tbl: input and output h/w link tables (if {src,dst}_nents > 1) (SEC2)
* @buf: input and output buffeur (if {src,dst}_nents > 1) (SEC1)
@@ -63,6 +64,7 @@ struct talitos_edesc {
dma_addr_t iv_dma;
int dma_len;
dma_addr_t dma_link_tbl;
+ struct talitos_edesc *next_desc;
struct talitos_desc desc;
union {
DECLARE_FLEX_ARRAY(struct talitos_ptr, link_tbl);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0280/1266] crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0279/1266] crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0281/1266] crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Greg Kroah-Hartman
` (718 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 4d9b0b7415b9e79a3d54d18b5ff230974ea78740 upstream.
Previously added code to flush_channel() in order to unmap an entire
descriptor.
Move that code into a standalone function to improve readability.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 39 ++++++++++++++++++++++-----------------
1 file changed, 22 insertions(+), 17 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -372,6 +372,27 @@ static __be32 get_request_hdr(struct dev
return edesc->desc.hdr1;
}
+static void dma_unmap_request(struct device *dev,
+ struct talitos_request *request, bool is_sec1)
+{
+ struct talitos_edesc *edesc;
+
+ if (is_sec1) {
+ dma_unmap_single(dev, request->dma_desc, TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+ edesc = container_of(request->desc, struct talitos_edesc, desc);
+ while (edesc->next_desc) {
+ dma_unmap_single(dev,
+ be32_to_cpu(edesc->desc.next_desc),
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ edesc = edesc->next_desc;
+ }
+ } else {
+ dma_unmap_single(dev, request->dma_desc, TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+ }
+}
+
/*
* process what was done, notify callback of error if not
*/
@@ -379,7 +400,6 @@ static void flush_channel(struct device
{
struct talitos_private *priv = dev_get_drvdata(dev);
struct talitos_request *request, saved_req;
- struct talitos_edesc *edesc;
unsigned long flags;
int tail, status;
bool is_sec1 = has_ftr_sec1(priv);
@@ -404,22 +424,7 @@ static void flush_channel(struct device
else
status = error;
- if (is_sec1) {
- dma_unmap_single(dev, request->dma_desc,
- TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
- edesc = container_of(request->desc,
- struct talitos_edesc, desc);
- while (edesc->next_desc) {
- dma_unmap_single(
- dev, be32_to_cpu(edesc->desc.next_desc),
- TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
- edesc = edesc->next_desc;
- }
- } else {
- dma_unmap_single(dev, request->dma_desc,
- TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
- }
+ dma_unmap_request(dev, request, is_sec1);
/* copy entries so we can call callback outside lock */
saved_req.desc = request->desc;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0281/1266] crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0280/1266] crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0282/1266] crypto: talitos - move code in current_desc_hdr() into a standalone function Greg Kroah-Hartman
` (717 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 5c0aa8cad7745505297103f05dda3fa06e8ac670 upstream.
Previously added code to talitos_submit() in order to map an entire
descriptor chain.
Move that code into a standalone function to improve readability.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 75 +++++++++++++++++++++++++----------------------
1 file changed, 41 insertions(+), 34 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -255,6 +255,46 @@ static int init_device(struct device *de
return 0;
}
+static void dma_map_request(struct device *dev, struct talitos_request *request,
+ struct talitos_desc *desc, bool is_sec1)
+{
+ struct talitos_edesc *edesc =
+ container_of(desc, struct talitos_edesc, desc);
+ dma_addr_t dma_desc, prev_dma_desc;
+ struct talitos_edesc *prev_edesc = NULL;
+
+ if (is_sec1) {
+ while (edesc) {
+ edesc->desc.hdr1 = edesc->desc.hdr;
+
+ dma_desc = dma_map_single(dev, &edesc->desc.hdr1,
+ TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+
+ if (!prev_edesc) {
+ request->dma_desc = dma_desc;
+ goto next;
+ }
+
+ /* Chain in any previous descriptors. */
+
+ prev_edesc->desc.next_desc = cpu_to_be32(dma_desc);
+
+ dma_sync_single_for_device(dev, prev_dma_desc,
+ TALITOS_DESC_SIZE,
+ DMA_TO_DEVICE);
+
+next:
+ prev_edesc = edesc;
+ prev_dma_desc = dma_desc;
+ edesc = edesc->next_desc;
+ }
+ } else {
+ request->dma_desc = dma_map_single(dev, desc, TALITOS_DESC_SIZE,
+ DMA_BIDIRECTIONAL);
+ }
+}
+
/**
* talitos_submit - submits a descriptor to the device for processing
* @dev: the SEC device to be used
@@ -273,10 +313,7 @@ static int talitos_submit(struct device
void *context, int error),
void *context)
{
- struct talitos_edesc *edesc = container_of(desc, struct talitos_edesc, desc);
struct talitos_private *priv = dev_get_drvdata(dev);
- dma_addr_t dma_desc, prev_dma_desc;
- struct talitos_edesc *prev_edesc = NULL;
struct talitos_request *request;
unsigned long flags;
int head;
@@ -294,37 +331,7 @@ static int talitos_submit(struct device
request = &priv->chan[ch].fifo[head];
/* map descriptor and save caller data */
- if (is_sec1) {
- while (edesc) {
- edesc->desc.hdr1 = edesc->desc.hdr;
-
- dma_desc = dma_map_single(dev, &edesc->desc.hdr1,
- TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
-
- if (!prev_edesc) {
- request->dma_desc = dma_desc;
- goto next;
- }
-
- /* Chain in any previous descriptors. */
-
- prev_edesc->desc.next_desc = cpu_to_be32(dma_desc);
-
- dma_sync_single_for_device(dev, prev_dma_desc,
- TALITOS_DESC_SIZE,
- DMA_TO_DEVICE);
-
-next:
- prev_edesc = edesc;
- prev_dma_desc = dma_desc;
- edesc = edesc->next_desc;
- }
- } else {
- request->dma_desc = dma_map_single(dev, desc,
- TALITOS_DESC_SIZE,
- DMA_BIDIRECTIONAL);
- }
+ dma_map_request(dev, request, desc, is_sec1);
request->callback = callback;
request->context = context;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0282/1266] crypto: talitos - move code in current_desc_hdr() into a standalone function
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0281/1266] crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Greg Kroah-Hartman
@ 2026-07-21 15:11 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0283/1266] crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Greg Kroah-Hartman
` (716 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit f8713d9e6091755dd30f7f1cfa25f8440cddf81b upstream.
Previously added code in current_desc_hdr() in order to add support for
searching an offending descriptor inside a descriptor chain.
Move that code into a standalone function to improve readability.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 35 +++++++++++++++++++----------------
1 file changed, 19 insertions(+), 16 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -520,6 +520,24 @@ DEF_TALITOS2_DONE(ch0, TALITOS2_ISR_CH_0
DEF_TALITOS2_DONE(ch0_2, TALITOS2_ISR_CH_0_2_DONE)
DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
+static __be32 search_desc_hdr_in_request(struct talitos_request *request,
+ dma_addr_t cur_desc, bool is_sec1)
+{
+ struct talitos_edesc *edesc;
+
+ if (request->dma_desc == cur_desc) {
+ return request->desc->hdr;
+ } else if (is_sec1) {
+ edesc = container_of(request->desc, struct talitos_edesc, desc);
+ while (edesc->next_desc) {
+ if (edesc->desc.next_desc == cpu_to_be32(cur_desc))
+ return edesc->next_desc->desc.hdr1;
+ edesc = edesc->next_desc;
+ }
+ }
+ return 0;
+}
+
/*
* locate current (offending) descriptor
*/
@@ -528,7 +546,6 @@ static __be32 current_desc_hdr(struct de
struct talitos_private *priv = dev_get_drvdata(dev);
bool is_sec1 = has_ftr_sec1(priv);
struct talitos_request *request;
- struct talitos_edesc *edesc;
int tail, iter;
dma_addr_t cur_desc;
__be32 hdr = 0;
@@ -546,21 +563,7 @@ static __be32 current_desc_hdr(struct de
do {
request = &priv->chan[ch].fifo[iter];
- if (request->dma_desc == cur_desc) {
- hdr = request->desc->hdr;
- } else if (is_sec1) {
- edesc = container_of(request->desc,
- struct talitos_edesc, desc);
- while (edesc->next_desc) {
- if (edesc->desc.next_desc ==
- cpu_to_be32(cur_desc)) {
- hdr = edesc->next_desc->desc.hdr1;
- break;
- }
- edesc = edesc->next_desc;
- }
- }
-
+ hdr = search_desc_hdr_in_request(request, cur_desc, is_sec1);
if (hdr)
break;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0283/1266] crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-07-21 15:11 ` [PATCH 6.6 0282/1266] crypto: talitos - move code in current_desc_hdr() into a standalone function Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0284/1266] crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Greg Kroah-Hartman
` (715 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 59b5d899e33701665f18abe6bebf987427876e3e upstream.
Currently, when SEC1 has buffered data (nbuf != 0), the ahash code
creates an additional descriptor on the fly inside
common_nonsnoop_hash() to handle the remainder of the data. This
approach is incompatible with the arbitrary-length descriptor chaining
that follows.
Remove the "additional descriptor" logic from common_nonsnoop_hash()
and common_nonsnoop_hash_unmap().
Also remove the nbytes adjustment for SEC1 in ahash_edesc_alloc()
that subtracted nbuf.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 101 ++---------------------------------------------
1 file changed, 6 insertions(+), 95 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1788,15 +1788,9 @@ static void common_nonsnoop_hash_unmap(s
struct talitos_private *priv = dev_get_drvdata(dev);
bool is_sec1 = has_ftr_sec1(priv);
struct talitos_desc *desc = &edesc->desc;
- struct talitos_desc *desc2;
-
- if (desc->next_desc)
- desc2 = &edesc->next_desc->desc;
unmap_single_talitos_ptr(dev, &desc->ptr[5], DMA_FROM_DEVICE);
- if (desc->next_desc &&
- desc->ptr[5].ptr != desc2->ptr[5].ptr)
- unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
+
if (req_ctx->last_desc)
memcpy(areq->result, req_ctx->hw_context,
crypto_ahash_digestsize(tfm));
@@ -1808,13 +1802,6 @@ static void common_nonsnoop_hash_unmap(s
if (from_talitos_ptr_len(&desc->ptr[1], is_sec1))
unmap_single_talitos_ptr(dev, &desc->ptr[1],
DMA_TO_DEVICE);
- else if (desc->next_desc)
- unmap_single_talitos_ptr(dev, &desc2->ptr[1],
- DMA_TO_DEVICE);
-
- if (is_sec1 && req_ctx->nbuf)
- unmap_single_talitos_ptr(dev, &desc->ptr[3],
- DMA_TO_DEVICE);
if (edesc->dma_len)
dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
@@ -1922,9 +1909,6 @@ static int common_nonsnoop_hash(struct t
to_talitos_ptr(&desc->ptr[2], ctx->dma_key, ctx->keylen,
is_sec1);
- if (is_sec1 && req_ctx->nbuf)
- length -= req_ctx->nbuf;
-
sg_count = edesc->src_nents ?: 1;
if (is_sec1 && sg_count > 1)
sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
@@ -1934,16 +1918,10 @@ static int common_nonsnoop_hash(struct t
/*
* data in
*/
- if (is_sec1 && req_ctx->nbuf) {
- map_single_talitos_ptr(dev, &desc->ptr[3], req_ctx->nbuf,
- req_ctx->buf[req_ctx->buf_idx],
- DMA_TO_DEVICE);
- } else {
- sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
- &desc->ptr[3], sg_count, 0, 0);
- if (sg_count > 1)
- sync_needed = true;
- }
+ sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
+ &desc->ptr[3], sg_count, 0, 0);
+ if (sg_count > 1)
+ sync_needed = true;
/* fifth DWORD empty */
@@ -1963,49 +1941,6 @@ static int common_nonsnoop_hash(struct t
if (is_sec1 && from_talitos_ptr_len(&desc->ptr[3], true) == 0)
talitos_handle_buggy_hash(ctx, edesc, &desc->ptr[3]);
- if (is_sec1 && req_ctx->nbuf && length) {
- struct talitos_edesc *edesc2;
- struct talitos_desc *desc2;
-
- edesc2 = kzalloc(sizeof(*edesc2),
- areq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
- GFP_KERNEL :
- GFP_ATOMIC);
- if (!edesc2) {
- ret = -ENOMEM;
- goto err;
- }
- edesc->next_desc = edesc2;
-
- desc2 = &edesc2->desc;
-
- desc2->hdr = desc->hdr;
- desc2->hdr &= ~DESC_HDR_MODE0_MDEU_INIT;
- desc->hdr &= ~DESC_HDR_MODE0_MDEU_PAD;
- desc->hdr |= DESC_HDR_MODE0_MDEU_CONT;
- desc->hdr &= ~DESC_HDR_DONE_NOTIFY;
-
- if (desc->ptr[1].ptr)
- copy_talitos_ptr(&desc2->ptr[1], &desc->ptr[1],
- is_sec1);
- else
- map_single_talitos_ptr_nosync(dev, &desc2->ptr[1],
- req_ctx->hw_context_size,
- req_ctx->hw_context,
- DMA_TO_DEVICE);
- copy_talitos_ptr(&desc2->ptr[2], &desc->ptr[2], is_sec1);
- sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
- &desc2->ptr[3], sg_count, 0, 0);
- if (sg_count > 1)
- sync_needed = true;
- copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
- if (req_ctx->last_desc)
- map_single_talitos_ptr_nosync(dev, &desc->ptr[5],
- req_ctx->hw_context_size,
- req_ctx->hw_context,
- DMA_FROM_DEVICE);
- }
-
if (sync_needed)
dma_sync_single_for_device(dev, edesc->dma_link_tbl,
edesc->dma_len, DMA_BIDIRECTIONAL);
@@ -2028,11 +1963,6 @@ static struct talitos_edesc *ahash_edesc
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- struct talitos_private *priv = dev_get_drvdata(ctx->dev);
- bool is_sec1 = has_ftr_sec1(priv);
-
- if (is_sec1)
- nbytes -= req_ctx->nbuf;
return talitos_edesc_alloc(ctx->dev, req_ctx->psrc, NULL, NULL, 0,
nbytes, 0, 0, 0, areq->base.flags, false);
@@ -2051,8 +1981,6 @@ static int ahash_process_req_one(struct
unsigned int nsg;
int nents;
struct device *dev = ctx->dev;
- struct talitos_private *priv = dev_get_drvdata(dev);
- bool is_sec1 = has_ftr_sec1(priv);
u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
if (!req_ctx->last_desc && (nbytes + req_ctx->nbuf <= blocksize)) {
@@ -2084,30 +2012,13 @@ static int ahash_process_req_one(struct
}
/* Chain in any previously buffered data */
- if (!is_sec1 && req_ctx->nbuf) {
+ if (req_ctx->nbuf) {
nsg = (req_ctx->nbuf < nbytes_to_hash) ? 2 : 1;
sg_init_table(req_ctx->bufsl, nsg);
sg_set_buf(req_ctx->bufsl, ctx_buf, req_ctx->nbuf);
if (nsg > 1)
sg_chain(req_ctx->bufsl, 2, req_ctx->request_sl);
req_ctx->psrc = req_ctx->bufsl;
- } else if (is_sec1 && req_ctx->nbuf && req_ctx->nbuf < blocksize) {
- int offset;
-
- if (nbytes_to_hash > blocksize)
- offset = blocksize - req_ctx->nbuf;
- else
- offset = nbytes_to_hash - req_ctx->nbuf;
- nents = sg_nents_for_len(req_ctx->request_sl, offset);
- if (nents < 0) {
- dev_err(dev, "Invalid number of src SG.\n");
- return nents;
- }
- sg_copy_to_buffer(req_ctx->request_sl, nents,
- ctx_buf + req_ctx->nbuf, offset);
- req_ctx->nbuf += offset;
- req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, req_ctx->request_sl,
- offset);
} else
req_ctx->psrc = req_ctx->request_sl;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0284/1266] crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0283/1266] crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0285/1266] crypto: talitos/hash - drop workqueue mechanism for SEC1 Greg Kroah-Hartman
` (714 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit f1ede6d95d8ad3b32c6a552d2baab805bd00fc38 upstream.
Rework the SEC1 ahash implementation to build a chain of hardware
descriptors, replacing the previous approach of submitting one
descriptor at a time via a workqueue, introduced by commit 655ef638a2bc
("crypto: talitos - fix SEC1 32k ahash request limitation").
Introduce ahash_process_req_prepare() which iterates over the request
data, allocating enough descriptors to cover the entire ahash request.
The new fields (bufsl, src, first, last) are added to talitos_edesc for
this purpose.
common_nonsnoop_hash() no longer calls talitos_submit(); it only
maps and sets up the descriptor. Submission is now done by the caller
after the chain is built.
ahash_free_desc_list_from() takes over calling
common_nonsnoop_hash_unmap() for each descriptor during cleanup.
Compared to the workqueue based solution, request are slightly faster
since there is no more scheduling latency induced by the workqueue, and
only one interrupt is generated by the device at the end of a chain.
Commit 655ef638a2bc ("crypto: talitos - fix SEC1 32k ahash request
limitation") :
$ /usr/libexec/libkcapi/sha256sum ./test_5M.bin
013c5609d63c... ./test_5M.bin
real 0m 0.41s
user 0m 0.01s
sys 0m 0.07s
Now :
$ /usr/libexec/libkcapi/sha256sum ./test_5M.bin
013c5609d63c... ./test_5M.bin
real 0m 0.33s
user 0m 0.01s
sys 0m 0.20s
Tested on a system with an MPC885 SoC featuring the SEC1 Lite.
The increase in sys time is due to the fact that commit 37b5e8897eb5
("crypto: talitos - chain in buffered data for ahash on SEC1") can no
longer be applied.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 168 +++++++++++++++++++++++++++++------------------
drivers/crypto/talitos.h | 10 ++
2 files changed, 115 insertions(+), 63 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1791,12 +1791,12 @@ static void common_nonsnoop_hash_unmap(s
unmap_single_talitos_ptr(dev, &desc->ptr[5], DMA_FROM_DEVICE);
- if (req_ctx->last_desc)
+ if (edesc->last && req_ctx->last_request)
memcpy(areq->result, req_ctx->hw_context,
crypto_ahash_digestsize(tfm));
- if (req_ctx->psrc)
- talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
+ if (edesc->src)
+ talitos_sg_unmap(dev, edesc, edesc->src, NULL, 0, 0);
/* When using hashctx-in, must unmap it. */
if (from_talitos_ptr_len(&desc->ptr[1], is_sec1))
@@ -1808,12 +1808,14 @@ static void common_nonsnoop_hash_unmap(s
DMA_BIDIRECTIONAL);
}
-static void free_edesc_list_from(struct talitos_edesc *edesc)
+static void free_edesc_list_from(struct ahash_request *areq, struct talitos_edesc *edesc)
{
+ struct talitos_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq));
struct talitos_edesc *next;
while (edesc) {
next = edesc->next_desc;
+ common_nonsnoop_hash_unmap(ctx->dev, edesc, areq);
kfree(edesc);
edesc = next;
}
@@ -1828,19 +1830,18 @@ static void ahash_done(struct device *de
container_of(desc, struct talitos_edesc, desc);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+
if (!req_ctx->last_desc && req_ctx->to_hash_later) {
/* Position any partial block for next update/final/finup */
req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
req_ctx->nbuf = req_ctx->to_hash_later;
}
- common_nonsnoop_hash_unmap(dev, edesc, areq);
- free_edesc_list_from(edesc);
+ free_edesc_list_from(areq, edesc);
- if (err) {
- ahash_request_complete(areq, err);
- return;
- }
+ ahash_request_complete(areq, err);
+
+ return;
req_ctx->remaining_ahash_request_bytes -=
req_ctx->current_ahash_request_bytes;
@@ -1874,18 +1875,15 @@ static void talitos_handle_buggy_hash(st
(char *)padded_hash, DMA_TO_DEVICE);
}
-static int common_nonsnoop_hash(struct talitos_edesc *edesc,
- struct ahash_request *areq, unsigned int length,
- void (*callback) (struct device *dev,
- struct talitos_desc *desc,
- void *context, int error))
+static void common_nonsnoop_hash(struct talitos_edesc *edesc,
+ struct ahash_request *areq,
+ unsigned int length)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
struct device *dev = ctx->dev;
struct talitos_desc *desc = &edesc->desc;
- int ret;
bool sync_needed = false;
struct talitos_private *priv = dev_get_drvdata(dev);
bool is_sec1 = has_ftr_sec1(priv);
@@ -1894,7 +1892,7 @@ static int common_nonsnoop_hash(struct t
/* first DWORD empty */
/* hash context in */
- if (!req_ctx->first_desc || req_ctx->swinit) {
+ if (!edesc->first || !req_ctx->first_desc || req_ctx->swinit) {
map_single_talitos_ptr_nosync(dev, &desc->ptr[1],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1911,22 +1909,22 @@ static int common_nonsnoop_hash(struct t
sg_count = edesc->src_nents ?: 1;
if (is_sec1 && sg_count > 1)
- sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
+ sg_copy_to_buffer(edesc->src, sg_count, edesc->buf, length);
else if (length)
- sg_count = dma_map_sg(dev, req_ctx->psrc, sg_count,
- DMA_TO_DEVICE);
+ sg_count = dma_map_sg(dev, edesc->src, sg_count, DMA_TO_DEVICE);
+
/*
* data in
*/
- sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
- &desc->ptr[3], sg_count, 0, 0);
+ sg_count = talitos_sg_map(dev, edesc->src, length, edesc, &desc->ptr[3],
+ sg_count, 0, 0);
if (sg_count > 1)
sync_needed = true;
/* fifth DWORD empty */
/* hash/HMAC out -or- hash context out */
- if (req_ctx->last_desc)
+ if (edesc->last && req_ctx->last_request)
map_single_talitos_ptr(dev, &desc->ptr[5],
crypto_ahash_digestsize(tfm),
req_ctx->hw_context, DMA_FROM_DEVICE);
@@ -1944,30 +1942,89 @@ static int common_nonsnoop_hash(struct t
if (sync_needed)
dma_sync_single_for_device(dev, edesc->dma_link_tbl,
edesc->dma_len, DMA_BIDIRECTIONAL);
-
- ret = talitos_submit(dev, ctx->ch, desc, callback,
- areq);
- if (ret != -EINPROGRESS)
- goto err;
-
- return -EINPROGRESS;
-err:
- common_nonsnoop_hash_unmap(dev, edesc, areq);
- kfree(edesc);
- return ret;
}
static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
+ struct scatterlist *src,
unsigned int nbytes)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- return talitos_edesc_alloc(ctx->dev, req_ctx->psrc, NULL, NULL, 0,
+ return talitos_edesc_alloc(ctx->dev, src, NULL, NULL, 0,
nbytes, 0, 0, 0, areq->base.flags, false);
}
+static struct talitos_edesc *
+ahash_process_req_prepare(struct ahash_request *areq, unsigned int nbytes,
+ unsigned int blocksize, bool is_sec1)
+{
+ struct talitos_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq));
+ struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ struct talitos_edesc *first = NULL, *prev_edesc = NULL, *edesc;
+ size_t desc_max = is_sec1 ? TALITOS1_MAX_DATA_LEN : SIZE_MAX;
+ struct scatterlist tmp[2];
+ size_t to_hash_this_desc;
+ struct scatterlist *src;
+ size_t offset = 0;
+
+ do {
+ src = scatterwalk_ffwd(tmp, req_ctx->psrc, offset);
+
+ to_hash_this_desc =
+ min(nbytes, ALIGN_DOWN(desc_max, blocksize));
+
+ /* Allocate extended descriptor */
+ edesc = ahash_edesc_alloc(areq, src, to_hash_this_desc);
+ if (IS_ERR(edesc)) {
+ if (first)
+ free_edesc_list_from(areq, first);
+ return edesc;
+ }
+
+ edesc->src =
+ scatterwalk_ffwd(edesc->bufsl, req_ctx->psrc, offset);
+ edesc->desc.hdr = ctx->desc_hdr_template;
+ edesc->first = offset == 0;
+ edesc->last = nbytes - to_hash_this_desc == 0;
+
+ /* On last one, request SEC to pad; otherwise continue */
+ if (req_ctx->last_request && edesc->last)
+ edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_PAD;
+ else
+ edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_CONT;
+
+ /* request SEC to INIT hash. */
+ if (req_ctx->first_desc && edesc->first && !req_ctx->swinit)
+ edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
+
+ /*
+ * When the tfm context has a keylen, it's an HMAC.
+ * A first or last (ie. not middle) descriptor must request HMAC.
+ */
+ if (ctx->keylen && ((req_ctx->first_desc && edesc->first) ||
+ (req_ctx->last_request && edesc->last)))
+ edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
+
+ /* clear the DN bit */
+ if (is_sec1 && !edesc->last)
+ edesc->desc.hdr &= ~DESC_HDR_DONE_NOTIFY;
+
+ common_nonsnoop_hash(edesc, areq, to_hash_this_desc);
+
+ offset += to_hash_this_desc;
+ nbytes -= to_hash_this_desc;
+
+ if (!prev_edesc)
+ first = edesc;
+ else
+ prev_edesc->next_desc = edesc;
+ prev_edesc = edesc;
+ } while (nbytes);
+
+ return first;
+}
+
static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
@@ -1976,14 +2033,16 @@ static int ahash_process_req_one(struct
struct talitos_edesc *edesc;
unsigned int blocksize =
crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
+ bool is_sec1 = has_ftr_sec1(dev_get_drvdata(ctx->dev));
unsigned int nbytes_to_hash;
unsigned int to_hash_later;
unsigned int nsg;
int nents;
struct device *dev = ctx->dev;
u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
+ int ret;
- if (!req_ctx->last_desc && (nbytes + req_ctx->nbuf <= blocksize)) {
+ if (!req_ctx->last_request && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
if (nents < 0) {
@@ -2000,7 +2059,7 @@ static int ahash_process_req_one(struct
nbytes_to_hash = nbytes + req_ctx->nbuf;
to_hash_later = nbytes_to_hash & (blocksize - 1);
- if (req_ctx->last_desc)
+ if (req_ctx->last_request)
to_hash_later = 0;
else if (to_hash_later)
/* There is a partial block. Hash the full block(s) now */
@@ -2035,30 +2094,16 @@ static int ahash_process_req_one(struct
}
req_ctx->to_hash_later = to_hash_later;
- /* Allocate extended descriptor */
- edesc = ahash_edesc_alloc(req_ctx->areq, nbytes_to_hash);
+ edesc = ahash_process_req_prepare(areq, nbytes_to_hash, blocksize,
+ is_sec1);
if (IS_ERR(edesc))
return PTR_ERR(edesc);
- edesc->desc.hdr = ctx->desc_hdr_template;
-
- /* On last one, request SEC to pad; otherwise continue */
- if (req_ctx->last_desc)
- edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_PAD;
- else
- edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_CONT;
-
- /* request SEC to INIT hash. */
- if (req_ctx->first_desc && !req_ctx->swinit)
- edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
-
- /* When the tfm context has a keylen, it's an HMAC.
- * A first or last (ie. not middle) descriptor must request HMAC.
- */
- if (ctx->keylen && (req_ctx->first_desc || req_ctx->last_desc))
- edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
+ ret = talitos_submit(dev, ctx->ch, &edesc->desc, ahash_done, areq);
+ if (ret != -EINPROGRESS)
+ free_edesc_list_from(areq, edesc);
- return common_nonsnoop_hash(edesc, req_ctx->areq, nbytes_to_hash, ahash_done);
+ return ret;
}
static void sec1_ahash_process_remaining(struct work_struct *work)
@@ -2102,16 +2147,13 @@ static int ahash_process_req(struct ahas
req_ctx->remaining_ahash_request_bytes = nbytes;
if (is_sec1) {
- if (nbytes > TALITOS1_MAX_DATA_LEN)
- nbytes = TALITOS1_MAX_DATA_LEN;
- else if (req_ctx->last_request)
+ if (req_ctx->last_request)
req_ctx->last_desc = 1;
}
req_ctx->current_ahash_request_bytes = nbytes;
- return ahash_process_req_one(req_ctx->areq,
- req_ctx->current_ahash_request_bytes);
+ return ahash_process_req_one(req_ctx->areq, nbytes);
}
static int ahash_init(struct ahash_request *areq)
--- a/drivers/crypto/talitos.h
+++ b/drivers/crypto/talitos.h
@@ -44,6 +44,11 @@ struct talitos_desc {
/*
* talitos_edesc - s/w-extended descriptor
+ * @bufsl: scatterlist buffer
+ * @src: pointer to input scatterlist
+ * @first: first descriptor of a chain
+ * @last: last descriptor of a chain
+ *
* @src_nents: number of segments in input scatterlist
* @dst_nents: number of segments in output scatterlist
* @iv_dma: dma address of iv for checking continuity and link table
@@ -59,6 +64,11 @@ struct talitos_desc {
* of link_tbl data
*/
struct talitos_edesc {
+ struct scatterlist bufsl[2];
+ struct scatterlist *src;
+ int first;
+ int last;
+
int src_nents;
int dst_nents;
dma_addr_t iv_dma;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0285/1266] crypto: talitos/hash - drop workqueue mechanism for SEC1
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0284/1266] crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0286/1266] crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Greg Kroah-Hartman
` (713 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit be4802afb1700534e48cb776d0d1e772c27de130 upstream.
Now that SEC1 hash uses hardware descriptor chaining instead of a
workqueue to process requests exceeding TALITOS1_MAX_DATA_LEN, the
workqueue code is no longer needed.
Remove sec1_ahash_process_remaining(), the related fields from
talitos_ahash_req_ctx (request_bufsl, areq, request_sl,
remaining_ahash_request_bytes, current_ahash_request_bytes,
sec1_ahash_process_remaining), the dead code in ahash_done(), and
simplify ahash_process_req() to call ahash_process_req_one() directly
with the original areq->src and areq->nbytes.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 80 ++++-------------------------------------------
1 file changed, 7 insertions(+), 73 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -12,7 +12,6 @@
* All rights reserved.
*/
-#include <linux/workqueue.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
@@ -952,13 +951,6 @@ struct talitos_ahash_req_ctx {
unsigned int nbuf;
struct scatterlist bufsl[2];
struct scatterlist *psrc;
-
- struct scatterlist request_bufsl[2];
- struct ahash_request *areq;
- struct scatterlist *request_sl;
- unsigned int remaining_ahash_request_bytes;
- unsigned int current_ahash_request_bytes;
- struct work_struct sec1_ahash_process_remaining;
};
struct talitos_export_state {
@@ -1840,18 +1832,6 @@ static void ahash_done(struct device *de
free_edesc_list_from(areq, edesc);
ahash_request_complete(areq, err);
-
- return;
-
- req_ctx->remaining_ahash_request_bytes -=
- req_ctx->current_ahash_request_bytes;
-
- if (!req_ctx->remaining_ahash_request_bytes) {
- ahash_request_complete(areq, 0);
- return;
- }
-
- schedule_work(&req_ctx->sec1_ahash_process_remaining);
}
/*
@@ -2044,12 +2024,12 @@ static int ahash_process_req_one(struct
if (!req_ctx->last_request && (nbytes + req_ctx->nbuf <= blocksize)) {
/* Buffer up to one whole block */
- nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
+ nents = sg_nents_for_len(areq->src, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_copy_to_buffer(req_ctx->request_sl, nents,
+ sg_copy_to_buffer(areq->src, nents,
ctx_buf + req_ctx->nbuf, nbytes);
req_ctx->nbuf += nbytes;
return 0;
@@ -2076,18 +2056,18 @@ static int ahash_process_req_one(struct
sg_init_table(req_ctx->bufsl, nsg);
sg_set_buf(req_ctx->bufsl, ctx_buf, req_ctx->nbuf);
if (nsg > 1)
- sg_chain(req_ctx->bufsl, 2, req_ctx->request_sl);
+ sg_chain(req_ctx->bufsl, 2, areq->src);
req_ctx->psrc = req_ctx->bufsl;
} else
- req_ctx->psrc = req_ctx->request_sl;
+ req_ctx->psrc = areq->src;
if (to_hash_later) {
- nents = sg_nents_for_len(req_ctx->request_sl, nbytes);
+ nents = sg_nents_for_len(areq->src, nbytes);
if (nents < 0) {
dev_err(dev, "Invalid number of src SG.\n");
return nents;
}
- sg_pcopy_to_buffer(req_ctx->request_sl, nents,
+ sg_pcopy_to_buffer(areq->src, nents,
req_ctx->buf[(req_ctx->buf_idx + 1) & 1],
to_hash_later,
nbytes - to_hash_later);
@@ -2106,54 +2086,9 @@ static int ahash_process_req_one(struct
return ret;
}
-static void sec1_ahash_process_remaining(struct work_struct *work)
-{
- struct talitos_ahash_req_ctx *req_ctx =
- container_of(work, struct talitos_ahash_req_ctx,
- sec1_ahash_process_remaining);
- int err = 0;
-
- req_ctx->request_sl = scatterwalk_ffwd(req_ctx->request_bufsl,
- req_ctx->request_sl, TALITOS1_MAX_DATA_LEN);
-
- if (req_ctx->remaining_ahash_request_bytes > TALITOS1_MAX_DATA_LEN)
- req_ctx->current_ahash_request_bytes = TALITOS1_MAX_DATA_LEN;
- else {
- req_ctx->current_ahash_request_bytes =
- req_ctx->remaining_ahash_request_bytes;
-
- if (req_ctx->last_request)
- req_ctx->last_desc = 1;
- }
-
- err = ahash_process_req_one(req_ctx->areq,
- req_ctx->current_ahash_request_bytes);
-
- if (err != -EINPROGRESS)
- ahash_request_complete(req_ctx->areq, err);
-}
-
static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
{
- struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
- struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
- struct device *dev = ctx->dev;
- struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
- struct talitos_private *priv = dev_get_drvdata(dev);
- bool is_sec1 = has_ftr_sec1(priv);
-
- req_ctx->areq = areq;
- req_ctx->request_sl = areq->src;
- req_ctx->remaining_ahash_request_bytes = nbytes;
-
- if (is_sec1) {
- if (req_ctx->last_request)
- req_ctx->last_desc = 1;
- }
-
- req_ctx->current_ahash_request_bytes = nbytes;
-
- return ahash_process_req_one(req_ctx->areq, nbytes);
+ return ahash_process_req_one(areq, nbytes);
}
static int ahash_init(struct ahash_request *areq)
@@ -2176,7 +2111,6 @@ static int ahash_init(struct ahash_reque
req_ctx->hw_context_size = size;
req_ctx->last_request = 0;
req_ctx->last_desc = 0;
- INIT_WORK(&req_ctx->sec1_ahash_process_remaining, sec1_ahash_process_remaining);
dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
DMA_TO_DEVICE);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0286/1266] crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0285/1266] crypto: talitos/hash - drop workqueue mechanism for SEC1 Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0287/1266] crypto: talitos/hash - remove useless wrapper Greg Kroah-Hartman
` (712 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 8bcf00671400ac3b3a4cc3011e6c1496dbd880fd upstream.
In talitos_ahash_req_ctx and talitos_export_state, the fields
first_desc and last_desc describe request-level (not descriptor-level)
state. Rename them to first_request and last_request for clarity.
last_desc is also removed from talitos_ahash_req_ctx as it is no
longer used.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 29 +++++++++++++----------------
1 file changed, 13 insertions(+), 16 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -944,8 +944,7 @@ struct talitos_ahash_req_ctx {
u8 buf[2][HASH_MAX_BLOCK_SIZE];
int buf_idx;
unsigned int swinit;
- unsigned int first_desc;
- unsigned int last_desc;
+ unsigned int first_request;
unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
@@ -957,8 +956,8 @@ struct talitos_export_state {
u32 hw_context[TALITOS_MDEU_MAX_CONTEXT_SIZE / sizeof(u32)];
u8 buf[HASH_MAX_BLOCK_SIZE];
unsigned int swinit;
- unsigned int first_desc;
- unsigned int last_desc;
+ unsigned int first_request;
+ unsigned int last_request;
unsigned int to_hash_later;
unsigned int nbuf;
};
@@ -1822,8 +1821,7 @@ static void ahash_done(struct device *de
container_of(desc, struct talitos_edesc, desc);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
-
- if (!req_ctx->last_desc && req_ctx->to_hash_later) {
+ if (!req_ctx->last_request && req_ctx->to_hash_later) {
/* Position any partial block for next update/final/finup */
req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
req_ctx->nbuf = req_ctx->to_hash_later;
@@ -1872,7 +1870,7 @@ static void common_nonsnoop_hash(struct
/* first DWORD empty */
/* hash context in */
- if (!edesc->first || !req_ctx->first_desc || req_ctx->swinit) {
+ if (!edesc->first || !req_ctx->first_request || req_ctx->swinit) {
map_single_talitos_ptr_nosync(dev, &desc->ptr[1],
req_ctx->hw_context_size,
req_ctx->hw_context,
@@ -1880,7 +1878,7 @@ static void common_nonsnoop_hash(struct
req_ctx->swinit = 0;
}
/* Indicate next op is not the first. */
- req_ctx->first_desc = 0;
+ req_ctx->first_request = 0;
/* HMAC key */
if (ctx->keylen)
@@ -1975,14 +1973,14 @@ ahash_process_req_prepare(struct ahash_r
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_CONT;
/* request SEC to INIT hash. */
- if (req_ctx->first_desc && edesc->first && !req_ctx->swinit)
+ if (req_ctx->first_request && edesc->first && !req_ctx->swinit)
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
/*
* When the tfm context has a keylen, it's an HMAC.
* A first or last (ie. not middle) descriptor must request HMAC.
*/
- if (ctx->keylen && ((req_ctx->first_desc && edesc->first) ||
+ if (ctx->keylen && ((req_ctx->first_request && edesc->first) ||
(req_ctx->last_request && edesc->last)))
edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
@@ -2103,14 +2101,13 @@ static int ahash_init(struct ahash_reque
/* Initialize the context */
req_ctx->buf_idx = 0;
req_ctx->nbuf = 0;
- req_ctx->first_desc = 1; /* first_desc indicates h/w must init its context */
+ req_ctx->first_request = 1;
req_ctx->swinit = 0; /* assume h/w init of context */
size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
: TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
req_ctx->hw_context_size = size;
req_ctx->last_request = 0;
- req_ctx->last_desc = 0;
dma = dma_map_single(dev, req_ctx->hw_context, req_ctx->hw_context_size,
DMA_TO_DEVICE);
@@ -2202,8 +2199,8 @@ static int ahash_export(struct ahash_req
req_ctx->hw_context_size);
memcpy(export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf);
export->swinit = req_ctx->swinit;
- export->first_desc = req_ctx->first_desc;
- export->last_desc = req_ctx->last_desc;
+ export->first_request = req_ctx->first_request;
+ export->last_request = req_ctx->last_request;
export->to_hash_later = req_ctx->to_hash_later;
export->nbuf = req_ctx->nbuf;
@@ -2228,8 +2225,8 @@ static int ahash_import(struct ahash_req
memcpy(req_ctx->hw_context, export->hw_context, size);
memcpy(req_ctx->buf[0], export->buf, export->nbuf);
req_ctx->swinit = export->swinit;
- req_ctx->first_desc = export->first_desc;
- req_ctx->last_desc = export->last_desc;
+ req_ctx->first_request = export->first_request;
+ req_ctx->last_request = export->last_request;
req_ctx->to_hash_later = export->to_hash_later;
req_ctx->nbuf = export->nbuf;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0287/1266] crypto: talitos/hash - remove useless wrapper
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0286/1266] crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0288/1266] crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Greg Kroah-Hartman
` (711 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 907ae6088c82c9abae2d26477fddd60df6ad003b upstream.
ahash_process_req() was a wrapper used in commit 655ef638a2bc ("crypto:
talitos - fix SEC1 32k ahash request limitation"). Rename
ahash_process_req_one() to ahash_process_req() and remove the wrapper.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -2003,7 +2003,7 @@ ahash_process_req_prepare(struct ahash_r
return first;
}
-static int ahash_process_req_one(struct ahash_request *areq, unsigned int nbytes)
+static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
@@ -2084,11 +2084,6 @@ static int ahash_process_req_one(struct
return ret;
}
-static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
-{
- return ahash_process_req_one(areq, nbytes);
-}
-
static int ahash_init(struct ahash_request *areq)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0288/1266] crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0287/1266] crypto: talitos/hash - remove useless wrapper Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0289/1266] arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Greg Kroah-Hartman
` (710 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit 6e12daff6ec125102a6fdcafc5aa7199f7ce8933 upstream.
The problem described in commit 655ef638a2bc ("crypto: talitos - fix
SEC1 32k ahash request limitation") also apply for the SEC2 hardware,
but with a limitation of 64k - 1 bytes.
Split ahash_done() into SEC1 and SEC2 paths: SEC1 continues to free the
whole descriptor list at once, while SEC2 now iterates through
descriptors one by one, submitting the next only after the previous
completes, which is required since SEC2 cannot chain descriptors in
hardware.
Cc: stable@vger.kernel.org
Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES")
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 49 ++++++++++++++++++++++++++++++++++++++---------
1 file changed, 40 insertions(+), 9 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1820,16 +1820,46 @@ static void ahash_done(struct device *de
struct talitos_edesc *edesc =
container_of(desc, struct talitos_edesc, desc);
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ bool is_sec1 = has_ftr_sec1(dev_get_drvdata(dev));
+ struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+ struct talitos_edesc *next;
- if (!req_ctx->last_request && req_ctx->to_hash_later) {
- /* Position any partial block for next update/final/finup */
- req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
- req_ctx->nbuf = req_ctx->to_hash_later;
+ if (is_sec1) {
+ if (!req_ctx->last_request && req_ctx->to_hash_later) {
+ /* Position any partial block for next update/final/finup */
+ req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
+ req_ctx->nbuf = req_ctx->to_hash_later;
+ }
+
+ free_edesc_list_from(areq, edesc);
+ ahash_request_complete(areq, err);
+ } else {
+ next = edesc->next_desc;
+
+ common_nonsnoop_hash_unmap(dev, edesc, areq);
+ kfree(edesc);
+
+ if (err)
+ goto out;
+
+ if (next) {
+ err = talitos_submit(dev, ctx->ch, &next->desc,
+ ahash_done, areq);
+ if (err != -EINPROGRESS)
+ goto out;
+ return;
+ }
+out:
+ if (!req_ctx->last_request && req_ctx->to_hash_later) {
+ /* Position any partial block for next update/final/finup */
+ req_ctx->buf_idx = (req_ctx->buf_idx + 1) & 1;
+ req_ctx->nbuf = req_ctx->to_hash_later;
+ }
+ if (err && next)
+ free_edesc_list_from(areq, next);
+ ahash_request_complete(areq, err);
}
-
- free_edesc_list_from(areq, edesc);
-
- ahash_request_complete(areq, err);
}
/*
@@ -1940,7 +1970,8 @@ ahash_process_req_prepare(struct ahash_r
struct talitos_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq));
struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
struct talitos_edesc *first = NULL, *prev_edesc = NULL, *edesc;
- size_t desc_max = is_sec1 ? TALITOS1_MAX_DATA_LEN : SIZE_MAX;
+ size_t desc_max = is_sec1 ? TALITOS1_MAX_DATA_LEN :
+ TALITOS2_MAX_DATA_LEN;
struct scatterlist tmp[2];
size_t to_hash_this_desc;
struct scatterlist *src;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0289/1266] arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0288/1266] crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0290/1266] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
` (709 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Catalin Marinas,
Fuad Tabba, James Morse, Marc Zyngier, Mark Brown, Oliver Upton,
Vladimir Murzin, Will Deacon
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 247bd153905085c18ff9006cca1ccb96dfd18e7f upstream.
The sme_save_state() and sme_load_state() functions take a 32-bit int
argument that describes whether to save/restore ZT0. Their assembly
implementations consume the entire 64-bit register containing this
32-bit value, and will attempt to save/restore ZT0 if any bit of
that 64-bit register is non-zero.
Per the AAPCS64 parameter passing rules, the callee is responsible for
any necessary widening, and the upper 32-bits are permitted to contain
arbitrary values. If the upper 32 bits are non-zero, this could result
in an unexpected attempt to save/restore ZT0, and consequently could
lead to unexpected traps/undefs/faults.
In practice compilers are very unlikely to generate code where the upper
32-bits would be non-zero, but they are permitted to do so.
Fix this by only consuming the low 32 bits of the register, and update
comments accordingly.
Fixes: 95fcec713259 ("arm64/sme: Implement context switching for ZT0")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Vladimir Murzin <vladimir.murzin@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/entry-fpsimd.S | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/kernel/entry-fpsimd.S
+++ b/arch/arm64/kernel/entry-fpsimd.S
@@ -103,13 +103,13 @@ SYM_FUNC_END(sme_set_vq)
* Save the ZA and ZT state
*
* x0 - pointer to buffer for state
- * x1 - number of ZT registers to save
+ * w1 - number of ZT registers to save
*/
SYM_FUNC_START(sme_save_state)
_sme_rdsvl 2, 1 // x2 = VL/8
sme_save_za 0, x2, 12 // Leaves x0 pointing to the end of ZA
- cbz x1, 1f
+ cbz w1, 1f
_str_zt 0
1:
ret
@@ -119,13 +119,13 @@ SYM_FUNC_END(sme_save_state)
* Load the ZA and ZT state
*
* x0 - pointer to buffer for state
- * x1 - number of ZT registers to save
+ * w1 - number of ZT registers to save
*/
SYM_FUNC_START(sme_load_state)
_sme_rdsvl 2, 1 // x2 = VL/8
sme_load_za 0, x2, 12 // Leaves x0 pointing to the end of ZA
- cbz x1, 1f
+ cbz w1, 1f
_ldr_zt 0
1:
ret
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0290/1266] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0289/1266] arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0291/1266] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
` (708 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Song, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <carlos.song@nxp.com>
commit e703ce47691b967fe9b4057fb1d062273211afa9 upstream.
dmaengine_terminate_all() has been deprecated, so replace it with
dmaengine_terminate_sync().
Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062357.3191349-2-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-lpspi.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -603,7 +603,7 @@ static int fsl_lpspi_dma_transfer(struct
tx->sgl, tx->nents, DMA_MEM_TO_DEV,
DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
if (!desc_tx) {
- dmaengine_terminate_all(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_tx);
return -EINVAL;
}
@@ -624,8 +624,8 @@ static int fsl_lpspi_dma_transfer(struct
transfer_timeout);
if (!timeout) {
dev_err(fsl_lpspi->dev, "I/O Error in DMA TX\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -ETIMEDOUT;
}
@@ -634,8 +634,8 @@ static int fsl_lpspi_dma_transfer(struct
transfer_timeout);
if (!timeout) {
dev_err(fsl_lpspi->dev, "I/O Error in DMA RX\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -ETIMEDOUT;
}
@@ -644,8 +644,8 @@ static int fsl_lpspi_dma_transfer(struct
fsl_lpspi->target_aborted) {
dev_dbg(fsl_lpspi->dev,
"I/O Error in DMA TX interrupted\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -EINTR;
}
@@ -654,8 +654,8 @@ static int fsl_lpspi_dma_transfer(struct
fsl_lpspi->target_aborted) {
dev_dbg(fsl_lpspi->dev,
"I/O Error in DMA RX interrupted\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -EINTR;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0291/1266] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0290/1266] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0292/1266] EDAC/i10nm: Dont fail probing if ADXL is missing Greg Kroah-Hartman
` (707 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Song, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <carlos.song@nxp.com>
commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe upstream.
When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.
Terminate the RX channel before returning on the TX prepare failure path.
Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-lpspi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -603,7 +603,7 @@ static int fsl_lpspi_dma_transfer(struct
tx->sgl, tx->nents, DMA_MEM_TO_DEV,
DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
if (!desc_tx) {
- dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0292/1266] EDAC/i10nm: Dont fail probing if ADXL is missing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0291/1266] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0293/1266] watchdog: apple: Add "apple,t8103-wdt" compatible Greg Kroah-Hartman
` (706 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasily Khoruzhick, Tony Luck,
Qiuxu Zhuo
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <vasilykh@arista.com>
commit e360a6d65bb46c527a5909430a31d640cdd5036e upstream.
ADXL is not present in Coreboot- or Slimbootloader-based BIOSes and as
result, the driver fails to probe there.
Since commit 2738c69a8813 ("EDAC/i10nm: Add driver decoder for Ice Lake
and Tremont CPUs"), i10nm_edac supports driver decoder. Switch to driver
decoding when ADXL is not present.
Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Cc: stable@vger.kernel.org # v6.1+
Link: https://patch.msgid.link/20260414181735.87023-1-anarsoul@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/i10nm_base.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -88,6 +88,7 @@ static struct res_config *res_cfg;
static int retry_rd_err_log;
static int decoding_via_mca;
static bool mem_cfg_2lm;
+static bool no_adxl;
static u32 offsets_scrub_icx[] = {0x22c60, 0x22c54, 0x22c5c, 0x22c58, 0x22c28, 0x20ed8};
static u32 offsets_scrub_spr[] = {0x22c60, 0x22c54, 0x22f08, 0x22c58, 0x22c28, 0x20ed8};
@@ -1173,8 +1174,14 @@ static int __init i10nm_init(void)
}
rc = skx_adxl_get();
- if (rc)
- goto fail;
+ if (rc) {
+ /* Decoding errors via MCA banks for 2LM isn't supported yet */
+ if (rc != -ENODEV || mem_cfg_2lm)
+ goto fail;
+ i10nm_printk(KERN_INFO, "ADXL not found, falling back to MCA-based decoding.\n");
+ no_adxl = true;
+ decoding_via_mca = true;
+ }
opstate_init();
mce_register_decode_chain(&i10nm_mce_dec);
@@ -1208,7 +1215,8 @@ static void __exit i10nm_exit(void)
teardown_i10nm_debug();
mce_unregister_decode_chain(&i10nm_mce_dec);
- skx_adxl_put();
+ if (!no_adxl)
+ skx_adxl_put();
skx_remove();
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0293/1266] watchdog: apple: Add "apple,t8103-wdt" compatible
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0292/1266] EDAC/i10nm: Dont fail probing if ADXL is missing Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0294/1266] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
` (705 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neal Gompa, Janne Grunau,
Guenter Roeck
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
commit 14ca4868886f2188401fe06cd7bf01a330b3fb99 upstream.
After discussion with the devicetree maintainers we agreed to not extend
lists with the generic compatible "apple,wdt" anymore [1]. Use
"apple,t8103-wdt" as base compatible as it is the SoC the driver and
bindings were written for.
[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
Fixes: 4ed224aeaf66 ("watchdog: Add Apple SoC watchdog driver")
Cc: stable@vger.kernel.org
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://lore.kernel.org/r/20251231-watchdog-apple-t8103-base-compat-v1-1-1702a02e0c45@jannau.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/apple_wdt.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/watchdog/apple_wdt.c
+++ b/drivers/watchdog/apple_wdt.c
@@ -191,6 +191,7 @@ static int apple_wdt_probe(struct platfo
}
static const struct of_device_id apple_wdt_of_match[] = {
+ { .compatible = "apple,t8103-wdt" },
{ .compatible = "apple,wdt" },
{},
};
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0294/1266] tracing: Prevent out-of-bounds read in glob matching
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0293/1266] watchdog: apple: Add "apple,t8103-wdt" compatible Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0295/1266] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
` (704 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Huihui Huang, Ren Wei,
Masami Hiramatsu (Google), Steven Rostedt
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huihui Huang <hhhuang@smu.edu.sg>
commit 0a6070839b1ef276d5b05bedfb787743e140fb17 upstream.
String event fields are not necessarily NUL-terminated, so the filter
predicate functions (filter_pred_string(), filter_pred_strloc() and
filter_pred_strrelloc()) pass the field length to the regex match
callbacks, and the length-aware matchers honour it.
regex_match_glob() was the exception: it ignored the length and called
glob_match(), which scans the string until it hits a NUL byte. Some
string fields are not NUL-terminated. One example is the dynamic char
array of the xfs_* namespace tracepoints, which is copied without a
trailing NUL. For such a field, glob matching reads past the end of
the event field, causing a KASAN slab-out-of-bounds read in
glob_match(), reached via regex_match_glob() and filter_match_preds()
from the xfs_lookup tracepoint.
Add a length-bounded glob_match_len() and use it from regex_match_glob()
so glob matching always stops at the field boundary. The matching loop
is factored into a shared helper so glob_match() keeps its behaviour.
Fixes: 60f1d5e3bac4 ("ftrace: Support full glob matching")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/da1aaf125fc3b63320b0c540fd6afa7c3d5b4f1a.1782836943.git.hhhuang@smu.edu.sg
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/glob.h | 1 +
kernel/trace/trace_events_filter.c | 6 ++----
lib/glob.c | 31 +++++++++++++++++++++++++++++--
3 files changed, 32 insertions(+), 6 deletions(-)
--- a/include/linux/glob.h
+++ b/include/linux/glob.h
@@ -6,5 +6,6 @@
#include <linux/compiler.h> /* For __pure */
bool __pure glob_match(char const *pat, char const *str);
+bool __pure glob_match_len(char const *pat, char const *str, size_t len);
#endif /* _LINUX_GLOB_H */
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1056,11 +1056,9 @@ static int regex_match_end(char *str, st
return 0;
}
-static int regex_match_glob(char *str, struct regex *r, int len __maybe_unused)
+static int regex_match_glob(char *str, struct regex *r, int len)
{
- if (glob_match(r->pattern, str))
- return 1;
- return 0;
+ return glob_match_len(r->pattern, str, len) ? 1 : 0;
}
/**
--- a/lib/glob.c
+++ b/lib/glob.c
@@ -9,6 +9,9 @@
MODULE_DESCRIPTION("glob(7) matching");
MODULE_LICENSE("Dual MIT/GPL");
+static bool __pure glob_match_str(char const *pat, char const *str,
+ char const *str_end);
+
/**
* glob_match - Shell-style pattern matching, like !fnmatch(pat, str, 0)
* @pat: Shell-style pattern to match, e.g. "*.[ch]".
@@ -39,6 +42,29 @@ MODULE_LICENSE("Dual MIT/GPL");
*/
bool __pure glob_match(char const *pat, char const *str)
{
+ return glob_match_str(pat, str, NULL);
+}
+EXPORT_SYMBOL(glob_match);
+
+/**
+ * glob_match_len - glob match against a length-bounded string
+ * @pat: Shell-style pattern to match.
+ * @str: String to match. Need not be NUL-terminated.
+ * @len: Number of bytes of @str that may be read.
+ *
+ * Like glob_match(), but @str is only read up to @len bytes, so it can be
+ * used on buffers that are not NUL-terminated (e.g. trace event fields).
+ * A NUL byte within @len still terminates the string.
+ */
+bool __pure glob_match_len(char const *pat, char const *str, size_t len)
+{
+ return glob_match_str(pat, str, str + len);
+}
+EXPORT_SYMBOL(glob_match_len);
+
+static bool __pure glob_match_str(char const *pat, char const *str,
+ char const *str_end)
+{
/*
* Backtrack to previous * on mismatch and retry starting one
* character later in the string. Because * matches all characters
@@ -53,9 +79,11 @@ bool __pure glob_match(char const *pat,
* on mismatch, or true after matching the trailing nul bytes.
*/
for (;;) {
- unsigned char c = *str++;
+ unsigned char c = (str_end && str >= str_end) ? '\0' : *str;
unsigned char d = *pat++;
+ str++;
+
switch (d) {
case '?': /* Wildcard: anything but nul */
if (c == '\0')
@@ -120,4 +148,3 @@ backtrack:
}
}
}
-EXPORT_SYMBOL(glob_match);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0295/1266] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0294/1266] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0296/1266] module: decompress: check return value of module_extend_max_pages() Greg Kroah-Hartman
` (703 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Benjamin Coddington,
Anna Schumaker
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 5140f099ecd8a2f2808b7f7b720ee1bad8468974 upstream.
POSIX requires write permission to truncate a file, so an open() that
specifies O_TRUNC must be authorized for write access regardless of the
O_ACCMODE access mode.
nfs_open_permission_mask() builds the access mask passed to
nfs_may_open(), which is the local authorization gate for OPENs the
client serves itself from a cached write delegation via the
can_open_delegated() path in nfs4_try_open_cached(). The mask is
derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a
file the caller cannot write requests only MAY_READ and passes the
local check. The OPEN is then satisfied locally and the truncation is
issued to the server as a SETATTR(size=0) over the delegation stateid,
which the server accepts under standard write-delegation semantics.
POSIX requires that this open fail with EACCES.
Include MAY_WRITE in the mask whenever O_TRUNC is set so the local
check matches the access the server would have enforced.
Suggested-by: Trond Myklebust <trondmy@kernel.org>
Fixes: af22f94ae02a ("NFSv4: Simplify _nfs4_do_access()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -3275,6 +3275,8 @@ static int nfs_open_permission_mask(int
mask |= MAY_READ;
if ((openflags & O_ACCMODE) != O_RDONLY)
mask |= MAY_WRITE;
+ if (openflags & O_TRUNC)
+ mask |= MAY_WRITE;
}
return mask;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0296/1266] module: decompress: check return value of module_extend_max_pages()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0295/1266] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0297/1266] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
` (702 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Torokhov, Luis Chamberlain,
Andrii Kuchmenko, Christophe Leroy (CS GROUP), Sami Tolvanen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Kuchmenko <capyenglishlite@gmail.com>
commit 786d2d84416a9a1c1a47b71a68d679d886284be2 upstream.
module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.
Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.
Fixes: b1ae6dc41eaa ("module: add in-kernel support for decompressing")
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Andrii Kuchmenko <capyenglishlite@gmail.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
[Sami: Corrected the analysis in the commit message.]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module/decompress.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/module/decompress.c
+++ b/kernel/module/decompress.c
@@ -307,6 +307,8 @@ int module_decompress(struct load_info *
*/
n_pages = DIV_ROUND_UP(size, PAGE_SIZE) * 2;
error = module_extend_max_pages(info, n_pages);
+ if (error)
+ return error;
data_size = MODULE_DECOMPRESS_FN(info, buf, size);
if (data_size < 0) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0297/1266] exfat: bound uniname advance in exfat_find_dir_entry()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0296/1266] module: decompress: check return value of module_extend_max_pages() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0298/1266] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Greg Kroah-Hartman
` (701 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Bryam Vargas
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 3a1230e7b043c62737b05a3e9275ca83a43ad20a upstream.
In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the
output pointer by a fixed amount while the loop guard only tracks the
accumulated name length:
if (++order == 2)
uniname = p_uniname->name;
else
uniname += EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
name_len += len;
unichar = *(uniname+len);
*(uniname+len) = 0x0;
uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len
grows only by the actual extracted length, which is shorter when a name
fragment contains an early NUL. The only guard is
`name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short
name fragments lets uniname run far past the
p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,
causing an out-of-bounds read and write at *(uniname+len).
The sibling extractor exfat_get_uniname_from_ext_entry() already stops
on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard
added in commit d42334578eba ("exfat: check if filename entries exceeds
max filename length")); exfat_find_dir_entry() never got the
equivalent. Track the per-entry write offset as a count and reject a
fragment once the offset, or the offset plus the extracted length, would
exceed MAX_NAME_LENGTH, before forming the output pointer.
Fixes: ca06197382bd ("exfat: add directory operations")
Cc: stable@vger.kernel.org
Suggested-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/dir.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -1081,6 +1081,7 @@ rewind:
if (entry_type == TYPE_EXTEND) {
unsigned short entry_uniname[16], unichar;
+ unsigned int offset;
if (step != DIRENT_STEP_NAME ||
name_len >= MAX_NAME_LENGTH) {
@@ -1089,13 +1090,15 @@ rewind:
continue;
}
- if (++order == 2)
- uniname = p_uniname->name;
- else
- uniname += EXFAT_FILE_NAME_LEN;
-
+ offset = (++order - 2) * EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
brelse(bh);
+ if (offset > MAX_NAME_LENGTH ||
+ len > MAX_NAME_LENGTH - offset) {
+ step = DIRENT_STEP_FILE;
+ continue;
+ }
+ uniname = p_uniname->name + offset;
name_len += len;
unichar = *(uniname+len);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0298/1266] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0297/1266] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0299/1266] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Greg Kroah-Hartman
` (700 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Manivannan Sadhasivam,
Bjorn Helgaas, Dave Jiang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
commit fcba26efe5efc7441f5505f4ccc69791214b40be upstream.
ntb_epf_init_isr() requests multiple MSI/MSI-X vectors in a loop. If
request_irq() fails part-way through, it jumps straight to
pci_free_irq_vectors() without freeing already requested IRQs.
Fix the error path by freeing any successfully requested IRQs before
releasing the vectors.
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Cc: stable@vger.kernel.org # v5.12+
Link: https://patch.msgid.link/20260304083028.1391068-2-den@valinux.co.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -357,7 +357,7 @@ static int ntb_epf_init_isr(struct ntb_e
0, "ntb_epf", ndev);
if (ret) {
dev_err(dev, "Failed to request irq\n");
- goto err_request_irq;
+ goto err_free_irq;
}
}
@@ -367,16 +367,14 @@ static int ntb_epf_init_isr(struct ntb_e
argument | irq);
if (ret) {
dev_err(dev, "Failed to configure doorbell\n");
- goto err_configure_db;
+ goto err_free_irq;
}
return 0;
-err_configure_db:
- for (i = 0; i < ndev->db_count + 1; i++)
+err_free_irq:
+ while (i--)
free_irq(pci_irq_vector(pdev, i), ndev);
-
-err_request_irq:
pci_free_irq_vectors(pdev);
return ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0299/1266] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0298/1266] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0300/1266] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
` (699 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hou Wenlong, Sean Christopherson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit c5bad4fa2d5dfd8c25140051a9807eba387a19b8 upstream.
Move KVM's stuffing of GUEST_PENDING_DBG_EXCEPTIONS.BS when RFLAGS.TF=1 and
MOV/POP SS or STI blocking is active into the exception injection code so
that KVM fixes up the VMCS for all injected #DBs, not only those that are
reflected back into the guest after #DB interception. E.g. if KVM queues
a #DB in the emulator, or more importantly if userspace does save/restore
exactly on the #DB+shadow boundary, then KVM needs to massage the VMCS to
avoid the VM-Entry consistency check.
Opportunistically update the wording of the comment to describe the
behavior as a workaround of flawed CPU behavior/architecture, to make it
clear that the *only* thing KVM is doing is fudging around a consistency
check. Per the SDM:
There are no pending debug exceptions after VM entry if any of the
following are true:
* The VM entry is vectoring with one of the following interruption
types: external interrupt, non-maskable interrupt (NMI), hardware
exception, or privileged software exception.
I.e. forcing GUEST_PENDING_DBG_EXCEPTIONS.BS does *not* impact guest-
visible behavior.
Fixes: b9bed78e2fa9 ("KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow")
Cc: stable@vger.kernel.org
Reported-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Closes: https://lore.kernel.org/all/b1a294bc9ed4dae532474a5dc6c8cb6e5962de7c.1757416809.git.houwenlong.hwl@antgroup.com
Reviewed-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Link: https://patch.msgid.link/20260515222638.1949982-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/vmx.c | 35 ++++++++++++++++++-----------------
1 file changed, 18 insertions(+), 17 deletions(-)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1810,6 +1810,24 @@ static void vmx_inject_exception(struct
u32 intr_info = ex->vector | INTR_INFO_VALID_MASK;
struct vcpu_vmx *vmx = to_vmx(vcpu);
+ /*
+ * When injecting a #DB, single-stepping is enabled in RFLAGS, and STI
+ * or MOV-SS blocking is active, set vmcs.PENDING_DBG_EXCEPTIONS.BS to
+ * prevent a false positive from VM-Entry consistency check. VM-Entry
+ * asserts that a single-step #DB _must_ be pending in this scenario,
+ * as the previous instruction cannot have toggled RFLAGS.TF 0=>1
+ * (because STI and POP/MOV don't modify RFLAGS), therefore the one
+ * instruction delay when activating single-step breakpoints must have
+ * already expired. However, the CPU isn't smart enough to peek at
+ * vmcs.VM_ENTRY_INTR_INFO_FIELD and so doesn't realize that yes, there
+ * is indeed a #DB pending/imminent.
+ */
+ if (ex->vector == DB_VECTOR &&
+ (vmx_get_rflags(vcpu) & X86_EFLAGS_TF) &&
+ vmx_get_interrupt_shadow(vcpu))
+ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
+ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS);
+
kvm_deliver_exception_payload(vcpu, ex);
if (ex->has_error_code) {
@@ -5281,26 +5299,9 @@ static int handle_exception_nmi(struct k
* avoid single-step #DB and MTF updates, as ICEBP is
* higher priority. Note, skipping ICEBP still clears
* STI and MOVSS blocking.
- *
- * For all other #DBs, set vmcs.PENDING_DBG_EXCEPTIONS.BS
- * if single-step is enabled in RFLAGS and STI or MOVSS
- * blocking is active, as the CPU doesn't set the bit
- * on VM-Exit due to #DB interception. VM-Entry has a
- * consistency check that a single-step #DB is pending
- * in this scenario as the previous instruction cannot
- * have toggled RFLAGS.TF 0=>1 (because STI and POP/MOV
- * don't modify RFLAGS), therefore the one instruction
- * delay when activating single-step breakpoints must
- * have already expired. Note, the CPU sets/clears BS
- * as appropriate for all other VM-Exits types.
*/
if (is_icebp(intr_info))
WARN_ON(!skip_emulated_instruction(vcpu));
- else if ((vmx_get_rflags(vcpu) & X86_EFLAGS_TF) &&
- (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
- (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS)))
- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS) | DR6_BS);
kvm_queue_exception_p(vcpu, DB_VECTOR, dr6);
return 1;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0300/1266] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0299/1266] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0301/1266] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
` (698 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot ci, Sean Christopherson,
Paolo Bonzini
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream.
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
Modules linked in:
CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
Call Trace:
<TASK>
apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
No functional change intended.
Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/vmx.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6701,11 +6701,10 @@ static noinstr void vmx_l1d_flush(struct
static void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
{
- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
int tpr_threshold;
if (is_guest_mode(vcpu) &&
- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+ nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW))
return;
tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0301/1266] udmabuf: fix DMA direction mismatch in release_udmabuf()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0300/1266] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0302/1266] i2c: core: fix adapter deregistration race Greg Kroah-Hartman
` (697 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikhail Gavrilov, Vivek Kasireddy
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream.
begin_cpu_udmabuf() maps the sg_table with the caller-provided direction
(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg
for reuse. However, release_udmabuf() always unmaps this sg_table with
a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was
originally used for the mapping.
With CONFIG_DMA_API_DEBUG=y this produces:
DMA-API: misc udmabuf: device driver frees DMA memory with different
direction [device address=0x000000044a123000] [size=4096 bytes]
[mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL]
The issue was found during video playback when GStreamer performed a
write-only DMA_BUF_IOCTL_SYNC on a udmabuf. It can be reproduced
with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd,
performing a write-only sync (DMA_BUF_SYNC_WRITE without
DMA_BUF_SYNC_READ), and closing the file descriptor.
Fix this by storing the DMA direction used when the sg_table is first
created in begin_cpu_udmabuf(), and passing that same direction to
put_sg_table() in release_udmabuf().
Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/udmabuf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -27,6 +27,7 @@ struct udmabuf {
pgoff_t pagecount;
struct page **pages;
struct sg_table *sg;
+ enum dma_data_direction sg_dir;
struct miscdevice *device;
};
@@ -139,7 +140,7 @@ static void release_udmabuf(struct dma_b
pgoff_t pg;
if (ubuf->sg)
- put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
+ put_sg_table(dev, ubuf->sg, ubuf->sg_dir);
for (pg = 0; pg < ubuf->pagecount; pg++)
put_page(ubuf->pages[pg]);
@@ -159,6 +160,8 @@ static int begin_cpu_udmabuf(struct dma_
if (IS_ERR(ubuf->sg)) {
ret = PTR_ERR(ubuf->sg);
ubuf->sg = NULL;
+ } else {
+ ubuf->sg_dir = direction;
}
} else {
dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0302/1266] i2c: core: fix adapter deregistration race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0301/1266] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0303/1266] i2c: mpc: Fix timeout calculations Greg Kroah-Hartman
` (696 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean Delvare, Johan Hovold,
Wolfram Sang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f upstream.
Adapters can be looked up by their id using i2c_get_adapter() which
takes a reference to the embedded struct device.
Remove the adapter from the IDR before tearing it down during
deregistration (and on registration failure) to make sure its resources
are not accessed after having been freed (e.g. the device name).
Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections")
Cc: stable@vger.kernel.org # 2.6.31
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1563,7 +1563,7 @@ static int i2c_register_adapter(struct i
res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto err_remove_debugfs;
+ goto err_replace_id;
}
res = i2c_setup_smbus_alert(adap);
@@ -1607,7 +1607,10 @@ static int i2c_register_adapter(struct i
out_reg:
i2c_deregister_clients(adap);
device_del(&adap->dev);
-err_remove_debugfs:
+err_replace_id:
+ mutex_lock(&core_lock);
+ idr_replace(&i2c_adapter_idr, NULL, adap->nr);
+ mutex_unlock(&core_lock);
debugfs_remove_recursive(adap->debugfs);
init_completion(&adap->dev_released);
put_device(&adap->dev);
@@ -1797,6 +1800,8 @@ void i2c_del_adapter(struct i2c_adapter
/* First make sure that this adapter was ever added */
mutex_lock(&core_lock);
found = idr_find(&i2c_adapter_idr, adap->nr);
+ if (found == adap)
+ idr_replace(&i2c_adapter_idr, NULL, adap->nr);
mutex_unlock(&core_lock);
if (found != adap) {
pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0303/1266] i2c: mpc: Fix timeout calculations
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0302/1266] i2c: core: fix adapter deregistration race Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0304/1266] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
` (695 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Chris Packham,
Andi Shyti
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 2e9a7f68329be41792c0b123c28e6c53c2fa2249 upstream.
At first glance the harmless cleanup of the driver does nothing bad.
However, as the operator precedence list states the '*' (multiplication)
and '/' division operators have order 5 with left-to-right associativity
the *= has order 17 and associativity right-to-left. It wouldn't be
a problem to replace
foo = foo * HZ / 1000000;
with
foo *= HZ / 1000000;
if HZ constant is in Hertz. The problem is that in the Linux kernel HZ is
defined in jiffy units, which is order of magnitude smaller than a million.
That's why operator precedence has a crucial role here. Fix the regression
by reverting pre-optimized calculations.
Fixes: be40a3ae719f ("i2c: mpc: Use of_property_read_u32 instead of of_get_property")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: <stable@vger.kernel.org> # v6.4+
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260618144934.3249950-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-mpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -857,7 +857,7 @@ static int fsl_i2c_probe(struct platform
"fsl,timeout", &mpc_ops.timeout);
if (!result) {
- mpc_ops.timeout *= HZ / 1000000;
+ mpc_ops.timeout = mpc_ops.timeout * HZ / 1000000;
if (mpc_ops.timeout < 5)
mpc_ops.timeout = 5;
} else {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0304/1266] i2c: stm32f7: truncate clock period instead of rounding it
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0303/1266] i2c: mpc: Fix timeout calculations Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0305/1266] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
` (694 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillermo Rodríguez,
Alain Volmat, Pierre-Yves MORDRET, Andi Shyti
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillermo Rodríguez <guille.rodriguez@gmail.com>
commit 111bb7f9f4a90b32e495d70a607c67b137f3074a upstream.
stm32f7_i2c_compute_timing() derives the I2C clock source period
(i2cclk) with DIV_ROUND_CLOSEST, which may round it up. When the
period is overestimated, all timings computed from it (SCLDEL,
SDADEL, SCLL, SCLH) come out shorter on the wire than calculated,
and the resulting bus rate can exceed the requested speed, violating
the I2C specification minimums for tLOW and tHIGH.
For example, with a 104.45 MHz clock source (e.g. PCLK1, the
reset-default I2C clock source on STM32MP1), i2cclk is rounded from
9.574 ns up to 10 ns. Requesting a 400 kHz fast mode bus with
72/27 ns rise/fall times and no analog/digital filters then produces
an actual bus rate of 415.6 kHz with tLOW = 1254 ns, violating both
the 400 kHz maximum rate and the 1300 ns tLOW minimum of the
specification.
Truncate the period instead, so that it can only be underestimated.
The error then falls on the safe side: the programmed timings come
out slightly longer than computed and the bus runs marginally below
the target rate (375.3 kHz in the example above) while meeting the
specification.
i2cbus is left rounded-to-closest: it is only used as the target of
the clk_error comparison and is never multiplied into the programmed
timings, so nearest rounding remains accurate there.
Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
Signed-off-by: Guillermo Rodríguez <guille.rodriguez@gmail.com>
Cc: <stable@vger.kernel.org> # v4.14+
Acked-by: Alain Volmat <alain.volmat@foss.st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260611104857.242153-1-guille.rodriguez@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-stm32f7.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -450,8 +450,13 @@ static int stm32f7_i2c_compute_timing(st
{
struct stm32f7_i2c_spec *specs;
u32 p_prev = STM32F7_PRESC_MAX;
- u32 i2cclk = DIV_ROUND_CLOSEST(NSEC_PER_SEC,
- setup->clock_src);
+ /*
+ * Truncate instead of rounding to closest: if the clock period is
+ * overestimated, the computed SCL timings will come out shorter on
+ * the wire, which can push the bus above the target rate and below
+ * the spec's tLOW/tHIGH minimums.
+ */
+ u32 i2cclk = NSEC_PER_SEC / setup->clock_src;
u32 i2cbus = DIV_ROUND_CLOSEST(NSEC_PER_SEC,
setup->speed_freq);
u32 clk_error_prev = i2cbus;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0305/1266] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0304/1266] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0306/1266] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
` (693 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 6251f7d3472c0409e30f8d6a24f10d33d12e3f9a upstream.
If rmi_register_physical_driver() fails, the current error path
unregisters only the RMI bus. The function handlers registered
earlier remain registered with the driver core.
Add a separate error path to unregister the function handlers
before unregistering the bus in this failure case.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260610064633.2837084-1-haoxiang_li2024@163.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_bus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -448,11 +448,13 @@ static int __init rmi_bus_init(void)
if (error) {
pr_err("%s: error registering the RMI physical driver: %d\n",
__func__, error);
- goto err_unregister_bus;
+ goto err_unregister_function_handlers;
}
return 0;
+err_unregister_function_handlers:
+ rmi_unregister_function_handlers();
err_unregister_bus:
bus_unregister(&rmi_bus_type);
return error;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0306/1266] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0305/1266] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0307/1266] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
` (692 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 57c10915f2c16c90e0d46ad00876bf39ece40fc2 upstream.
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Fixes: 9e4c596bfd00 ("Input: synaptics-rmi4 - add support for F3A")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-1-cf39a3615085@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f3a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_f3a.c
+++ b/drivers/input/rmi4/rmi_f3a.c
@@ -132,7 +132,7 @@ static int rmi_f3a_map_gpios(struct rmi_
int button_count = min_t(u8, f3a->gpio_count, TRACKSTICK_RANGE_END);
f3a->gpio_key_map = devm_kcalloc(&fn->dev,
- button_count,
+ f3a->gpio_count,
sizeof(f3a->gpio_key_map[0]),
GFP_KERNEL);
if (!f3a->gpio_key_map) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0307/1266] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0306/1266] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0308/1266] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
` (691 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit d577e46785d45484b2ab7e7309c49b18764bf56c upstream.
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Fixes: 3e64fcbdbd10 ("Input: synaptics-rmi4 - limit the range of what GPIOs are buttons")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-2-cf39a3615085@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f30.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -233,7 +233,7 @@ static int rmi_f30_map_gpios(struct rmi_
int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
f30->gpioled_key_map = devm_kcalloc(&fn->dev,
- button_count,
+ f30->gpioled_count,
sizeof(f30->gpioled_key_map[0]),
GFP_KERNEL);
if (!f30->gpioled_key_map) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0308/1266] Input: elan_i2c - prevent division by zero and arithmetic underflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0307/1266] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0309/1266] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
` (690 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ranjan Kumar, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <kumarranja@chromium.org>
commit df2b818fa009c10ff6ba875a1663ff001cda9558 upstream.
The Elan I2C touchpad driver queries the device for its physical
dimensions and trace counts to calculate the device resolution and width.
However, if the device firmware or device tree provides invalid zero
values for x_traces or y_traces, it results in a fatal division-by-zero
exception leading to a kernel panic during device probe.
Add checks to ensure these parameters are non-zero before performing
the division. If invalid trace values are detected, fall back to a safe
default of 1.
Additionally, prevent an arithmetic underflow in the touch reporting
logic. Previously, if the calculated or fallback width was smaller than
ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a
massive unsigned integer being reported to userspace. Clamp the adjusted
width to a minimum of 0 to safely handle small physical dimensions and
fallback scenarios.
Completing the probe with safe fallback values ensures the sysfs nodes
are created, keeping the firmware update path intact so a recovery
firmware can be flashed to the device.
Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad")
Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are provided")
Signed-off-by: Ranjan Kumar <kumarranja@chromium.org>
Link: https://patch.msgid.link/20260612060339.3829666-1-kumarranja@chromium.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elan_i2c_core.c | 36 ++++++++++++++++++++++++++++++------
1 file changed, 30 insertions(+), 6 deletions(-)
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -424,8 +424,17 @@ static int elan_query_device_parameters(
if (error)
return error;
}
- data->width_x = data->max_x / x_traces;
- data->width_y = data->max_y / y_traces;
+
+ if (!x_traces || !y_traces) {
+ dev_warn(&client->dev,
+ "invalid trace numbers: x=%u, y=%u\n",
+ x_traces, y_traces);
+ data->width_x = 1;
+ data->width_y = 1;
+ } else {
+ data->width_x = data->max_x / x_traces;
+ data->width_y = data->max_y / y_traces;
+ }
if (device_property_read_u32(&client->dev,
"touchscreen-x-mm", &x_mm) ||
@@ -439,8 +448,16 @@ static int elan_query_device_parameters(
data->x_res = elan_convert_resolution(hw_x_res, data->pattern);
data->y_res = elan_convert_resolution(hw_y_res, data->pattern);
} else {
- data->x_res = (data->max_x + 1) / x_mm;
- data->y_res = (data->max_y + 1) / y_mm;
+ if (unlikely(x_mm == 0 || y_mm == 0)) {
+ dev_warn(&client->dev,
+ "invalid physical dimensions: x_mm=%u, y_mm=%u\n",
+ x_mm, y_mm);
+ data->x_res = 1;
+ data->y_res = 1;
+ } else {
+ data->x_res = (data->max_x + 1) / x_mm;
+ data->y_res = (data->max_y + 1) / y_mm;
+ }
}
if (device_property_read_bool(&client->dev, "elan,clickpad"))
@@ -959,6 +976,7 @@ static void elan_report_contact(struct e
if (data->report_features & ETP_FEATURE_REPORT_MK) {
unsigned int mk_x, mk_y, area_x, area_y;
+ int adj_width_x, adj_width_y;
u8 mk_data = high_precision ?
packet[ETP_MK_DATA_OFFSET + contact_num] :
finger_data[3];
@@ -970,8 +988,14 @@ static void elan_report_contact(struct e
* To avoid treating large finger as palm, let's reduce
* the width x and y per trace.
*/
- area_x = mk_x * (data->width_x - ETP_FWIDTH_REDUCE);
- area_y = mk_y * (data->width_y - ETP_FWIDTH_REDUCE);
+
+ adj_width_x = data->width_x > ETP_FWIDTH_REDUCE ?
+ data->width_x - ETP_FWIDTH_REDUCE : 0;
+ adj_width_y = data->width_y > ETP_FWIDTH_REDUCE ?
+ data->width_y - ETP_FWIDTH_REDUCE : 0;
+
+ area_x = mk_x * adj_width_x;
+ area_y = mk_y * adj_width_y;
input_report_abs(input, ABS_TOOL_WIDTH, mk_x);
input_report_abs(input, ABS_MT_TOUCH_MAJOR,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0309/1266] Input: goodix - clamp the device-reported contact count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0308/1266] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0310/1266] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
` (689 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Hans de Goede,
Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 5ed62a96e06be4e94b8296b7932afee550a70e04 upstream.
goodix_ts_read_input_report() copies the number of touch points reported
by the device into an on-stack buffer
u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];
which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max_touch_num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:
ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num
of up to 15 and the second goodix_i2c_read() writes
ts->contact_size * (touch_num - 1) bytes past the one-contact header into
point_data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.
Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts
point_data[] is sized for, when reading it from the configuration.
Fixes: a7ac7c95d468 ("Input: goodix - use max touch number from device config")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260612-b4-disp-6844625d-v1-1-df0aed080c9d@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/goodix.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -1056,7 +1056,8 @@ static void goodix_read_config(struct go
}
ts->int_trigger_type = ts->config[TRIGGER_LOC] & 0x03;
- ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
+ ts->max_touch_num = min(ts->config[MAX_CONTACTS_LOC] & 0x0f,
+ GOODIX_MAX_CONTACTS);
x_max = get_unaligned_le16(&ts->config[RESOLUTION_LOC]);
y_max = get_unaligned_le16(&ts->config[RESOLUTION_LOC + 2]);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0310/1266] Input: iforce - bound the device-reported force-feedback effect index
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0309/1266] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0311/1266] Input: mms114 - fix touch indexing for MMS134S and MMS136 Greg Kroah-Hartman
` (688 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 0e9943d2e4c63496b6ca84bc66fd3c71d40558e2 upstream.
iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:
i = data[1] & 0x7f;
if (data[1] & 0x80) {
if (!test_and_set_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags))
...
} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags)) {
...
}
The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array. core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.
data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.
Reject an out-of-range index instead of indexing with it. Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so
the check guarantees memory safety regardless of how many effects the
device registered. A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/iforce/iforce-packets.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/input/joystick/iforce/iforce-packets.c
+++ b/drivers/input/joystick/iforce/iforce-packets.c
@@ -192,14 +192,18 @@ void iforce_process_packet(struct iforce
/* Check if an effect was just started or stopped */
i = data[1] & 0x7f;
- if (data[1] & 0x80) {
- if (!test_and_set_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) {
- /* Report play event */
- input_report_ff_status(dev, i, FF_STATUS_PLAYING);
+ if (i < IFORCE_EFFECTS_MAX) {
+ if (data[1] & 0x80) {
+ if (!test_and_set_bit(FF_CORE_IS_PLAYED,
+ iforce->core_effects[i].flags)) {
+ /* Report play event */
+ input_report_ff_status(dev, i, FF_STATUS_PLAYING);
+ }
+ } else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
+ iforce->core_effects[i].flags)) {
+ /* Report stop event */
+ input_report_ff_status(dev, i, FF_STATUS_STOPPED);
}
- } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) {
- /* Report stop event */
- input_report_ff_status(dev, i, FF_STATUS_STOPPED);
}
for (j = 3; j < len; j += 2)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0311/1266] Input: mms114 - fix touch indexing for MMS134S and MMS136
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0310/1266] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0312/1266] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
` (687 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Bryam Vargas,
Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d upstream.
The MMS134S and MMS136 touch controllers have an event size of 6 bytes
rather than 8 bytes. When __mms114_read_reg() reads the touch data
packet from the device into the touch buffer, the events are packed
tightly at 6-byte intervals. However, the driver iterates through the
events using standard C array indexing (touch[index]), where each
element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any
touch events beyond the first one are read from incorrect offsets and
parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event
based on the device's specific event size.
Fixes: 53fefdd1d3a3 ("Input: mms114 - support MMS136")
Fixes: ab108678195f ("Input: mms114 - support MMS134S")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Reviewed-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260616050912.1531241-1-dmitry.torokhov@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/mms114.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -218,7 +218,9 @@ static irqreturn_t mms114_interrupt(int
struct i2c_client *client = data->client;
struct input_dev *input_dev = data->input_dev;
struct mms114_touch touch[MMS114_MAX_TOUCH];
+ struct mms114_touch *t;
int packet_size;
+ int event_size;
int touch_size;
int index;
int error;
@@ -236,9 +238,11 @@ static irqreturn_t mms114_interrupt(int
/* MMS136 has slightly different event size */
if (data->type == TYPE_MMS134S || data->type == TYPE_MMS136)
- touch_size = packet_size / MMS136_EVENT_SIZE;
+ event_size = MMS136_EVENT_SIZE;
else
- touch_size = packet_size / MMS114_EVENT_SIZE;
+ event_size = MMS114_EVENT_SIZE;
+
+ touch_size = packet_size / event_size;
error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
(u8 *)touch);
@@ -246,18 +250,20 @@ static irqreturn_t mms114_interrupt(int
goto out;
for (index = 0; index < touch_size; index++) {
- switch (touch[index].type) {
+ t = (struct mms114_touch *)((u8 *)touch + index * event_size);
+
+ switch (t->type) {
case MMS114_TYPE_TOUCHSCREEN:
- mms114_process_mt(data, touch + index);
+ mms114_process_mt(data, t);
break;
case MMS114_TYPE_TOUCHKEY:
- mms114_process_touchkey(data, touch + index);
+ mms114_process_touchkey(data, t);
break;
default:
dev_err(&client->dev, "Wrong touch type (%d)\n",
- touch[index].type);
+ t->type);
break;
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0312/1266] Input: touchwin - reset the packet index on every complete packet
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0311/1266] Input: mms114 - fix touch indexing for MMS134S and MMS136 Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0313/1266] Input: mms114 - reject an oversized device packet size Greg Kroah-Hartman
` (686 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 478cdd736f2ce3114f90e775d7358136d3977b94 upstream.
tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
...
tw->idx = 0;
}
The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.
Fixes: 11ea3173d5f2 ("Input: add driver for Touchwin serial touchscreens")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260613-b4-disp-69921bfd-v1-1-82c036899959@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/touchwin.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/input/touchscreen/touchwin.c
+++ b/drivers/input/touchscreen/touchwin.c
@@ -63,12 +63,15 @@ static irqreturn_t tw_interrupt(struct s
if (data) { /* touch */
tw->touched = 1;
tw->data[tw->idx++] = data;
- /* verify length and that the two Y's are the same */
- if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
- input_report_abs(dev, ABS_X, tw->data[0]);
- input_report_abs(dev, ABS_Y, tw->data[1]);
- input_report_key(dev, BTN_TOUCH, 1);
- input_sync(dev);
+ /* a full packet ends the accumulation, valid or not */
+ if (tw->idx == TW_LENGTH) {
+ /* report only if the two Y's are the same */
+ if (tw->data[1] == tw->data[2]) {
+ input_report_abs(dev, ABS_X, tw->data[0]);
+ input_report_abs(dev, ABS_Y, tw->data[1]);
+ input_report_key(dev, BTN_TOUCH, 1);
+ input_sync(dev);
+ }
tw->idx = 0;
}
} else if (tw->touched) { /* untouch */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0313/1266] Input: mms114 - reject an oversized device packet size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0312/1266] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0314/1266] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
` (685 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 66725039f7090afe14c31bd259e2059a68f04023 upstream.
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
if (packet_size <= 0)
goto out;
...
error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
(u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.
Fixes: 07b8481d4aff ("Input: add MELFAS mms114 touchscreen driver")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612-b4-disp-dc4b8dc4-v1-1-d7cb0a828d92@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/mms114.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -236,6 +236,12 @@ static irqreturn_t mms114_interrupt(int
if (packet_size <= 0)
goto out;
+ if (packet_size > sizeof(touch)) {
+ dev_err(&client->dev, "Invalid packet size %d (max %zu)\n",
+ packet_size, sizeof(touch));
+ goto out;
+ }
+
/* MMS136 has slightly different event size */
if (data->type == TYPE_MMS134S || data->type == TYPE_MMS136)
event_size = MMS136_EVENT_SIZE;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0314/1266] Input: maplemouse - fix NULL pointer dereference in open()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0313/1266] Input: mms114 - reject an oversized device packet size Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0315/1266] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
` (684 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit ee89db004238bd0b034f2a6176e175561658750b upstream.
Commit 555c765b0cc2 ("Input: mouse - drop unnecessary calls to
input_set_drvdata") dropped the input_set_drvdata() call in probe
because the data appeared to be unused. However, dc_mouse_open() and
dc_mouse_close() were using maple_get_drvdata(to_maple_dev(&dev->dev)).
This appears to be accessing the data attached to an instance of
maple_device structure, while in reality this actually retrieves driver
data from the input device's embedded struct device (doing invalid
conversion of input device structure to maple device). After
input_set_drvdata() was removed, that lookup started returning NULL and
opening the input device dereferences mse->mdev.
Restore input_set_drvdata() and convert open() and close() to use
input_get_drvdata() so the dependency is no longer hidden.
Fixes: 6b3480855aad ("maple: input: fix up maple mouse driver")
Fixes: 555c765b0cc2 ("Input: mouse - drop unnecessary calls to input_set_drvdata")
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/20260628230715.2982552-1-fuchsfl@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/maplemouse.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/input/mouse/maplemouse.c
+++ b/drivers/input/mouse/maplemouse.c
@@ -48,7 +48,7 @@ static void dc_mouse_callback(struct map
static int dc_mouse_open(struct input_dev *dev)
{
- struct dc_mouse *mse = maple_get_drvdata(to_maple_dev(&dev->dev));
+ struct dc_mouse *mse = input_get_drvdata(dev);
maple_getcond_callback(mse->mdev, dc_mouse_callback, HZ/50,
MAPLE_FUNC_MOUSE);
@@ -58,7 +58,7 @@ static int dc_mouse_open(struct input_de
static void dc_mouse_close(struct input_dev *dev)
{
- struct dc_mouse *mse = maple_get_drvdata(to_maple_dev(&dev->dev));
+ struct dc_mouse *mse = input_get_drvdata(dev);
maple_getcond_callback(mse->mdev, dc_mouse_callback, 0,
MAPLE_FUNC_MOUSE);
@@ -88,6 +88,7 @@ static int probe_maple_mouse(struct devi
mse->dev = input_dev;
mse->mdev = mdev;
+ input_set_drvdata(input_dev, mse);
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
input_dev->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0315/1266] Input: mms114 - fix multi-touch slot corruption
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0314/1266] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0316/1266] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
` (683 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, sashiko-bot, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit adea84ee6cdea611146c4251d3c1616f5a09feca upstream.
If the touchscreen controller reports a touch ID of 0, the driver
calculates the slot ID as touch->id - 1, which underflows to UINT_MAX.
This is passed to input_mt_slot() as -1.
Since the input core ignores negative slot values, the active slot remains
unchanged. The driver then reports the touch coordinates for the previously
active slot, corrupting its state.
Fix this by rejecting touch reports with ID 0.
Fixes: 07b8481d4aff ("Input: add MELFAS mms114 touchscreen driver")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/mms114.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -165,7 +165,7 @@ static void mms114_process_mt(struct mms
unsigned int x;
unsigned int y;
- if (touch->id > MMS114_MAX_TOUCH) {
+ if (touch->id == 0 || touch->id > MMS114_MAX_TOUCH) {
dev_err(&client->dev, "Wrong touch id (%d)\n", touch->id);
return;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0316/1266] Input: maple_keyb - set driver data before registering input device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0315/1266] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0317/1266] Input: maplemouse " Greg Kroah-Hartman
` (682 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 536394ec81419b67d9f4f0028812c4372397be1b upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/maple_keyb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/input/keyboard/maple_keyb.c
+++ b/drivers/input/keyboard/maple_keyb.c
@@ -169,6 +169,8 @@ static int probe_maple_kbd(struct device
kbd->dev = idev;
memcpy(kbd->keycode, dc_kbd_keycode, sizeof(kbd->keycode));
+ maple_set_drvdata(mdev, kbd);
+
idev->name = mdev->product_name;
idev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
idev->keycode = kbd->keycode;
@@ -193,8 +195,6 @@ static int probe_maple_kbd(struct device
mdev->driver = mdrv;
- maple_set_drvdata(mdev, kbd);
-
return error;
fail_register:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0317/1266] Input: maplemouse - set driver data before registering input device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0316/1266] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0318/1266] Input: maplecontrol " Greg Kroah-Hartman
` (681 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 738f24bbbc95dd50cb4229d1ed62a05f29db2bda upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/akNXw45L_8bxD6QV@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/maplemouse.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/mouse/maplemouse.c
+++ b/drivers/input/mouse/maplemouse.c
@@ -88,6 +88,8 @@ static int probe_maple_mouse(struct devi
mse->dev = input_dev;
mse->mdev = mdev;
+ maple_set_drvdata(mdev, mse);
+
input_set_drvdata(input_dev, mse);
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
input_dev->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
@@ -103,12 +105,12 @@ static int probe_maple_mouse(struct devi
goto fail_register;
mdev->driver = mdrv;
- maple_set_drvdata(mdev, mse);
return error;
fail_register:
input_free_device(input_dev);
+ maple_set_drvdata(mdev, NULL);
fail_nomem:
kfree(mse);
fail:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0318/1266] Input: maplecontrol - set driver data before registering input device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0317/1266] Input: maplemouse " Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0319/1266] RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Greg Kroah-Hartman
` (680 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit fe938ee497d58c644f6910cfe6ae155f6fb3e523 upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/akNYib9hQFNN1fA9@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/maplecontrol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/input/joystick/maplecontrol.c
+++ b/drivers/input/joystick/maplecontrol.c
@@ -112,6 +112,8 @@ static int probe_maple_controller(struct
pad->dev = idev;
pad->mdev = mdev;
+ maple_set_drvdata(mdev, pad);
+
idev->open = dc_pad_open;
idev->close = dc_pad_close;
@@ -146,7 +148,6 @@ static int probe_maple_controller(struct
goto fail;
mdev->driver = mdrv;
- maple_set_drvdata(mdev, pad);
return 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0319/1266] RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0318/1266] Input: maplecontrol " Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0320/1266] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
` (679 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Zhenhao Wan,
Md Haris Iqbal, Jason Gunthorpe
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhenhao Wan <whi4ed0g@gmail.com>
commit 963af8d97a8c6a117134a8d0db1415e0489200b1 upstream.
When the server answers an RTRS READ, rdma_write_sg() builds the source
scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the
peer. Its length is taken directly from the wire descriptor:
plist->length = le32_to_cpu(id->rd_msg->desc[0].len);
rd_msg points into the chunk buffer that the remote peer filled via
RDMA-WRITE-WITH-IMM (rtrs_srv_rdma_done() -> process_io_req() ->
process_read()), so desc[0].len is attacker-controlled and, before this
change, was only rejected when zero. The source address is the fixed
chunk start (dma_addr[msg_id]) and the source lkey is the PD-wide
local_dma_lkey, which is not tied to the chunk's MR mapping, so the verbs
layer does not constrain the transfer length to max_chunk_size. msg_id
and off are bounded against queue_depth and max_chunk_size in
rtrs_srv_rdma_done(), but desc[0].len is a separate field that was not
checked against the chunk size.
A peer that advertises desc[0].len larger than max_chunk_size can make
the posted RDMA write read past the chunk's mapped region. The resulting
behaviour depends on the IOMMU configuration: with no IOMMU or in
passthrough mode the read may extend into memory adjacent to the chunk
and be returned to the peer, which can disclose host memory; with a
translating IOMMU the out-of-range access is expected to fault and abort
the connection. In either case the transfer exceeds what the protocol
permits and is driven by a remote peer.
Reject a descriptor length above max_chunk_size, mirroring the existing
off >= max_chunk_size bound in rtrs_srv_rdma_done(). Legitimate clients
do not exceed it: the client sets desc[0].len to its MR length, which is
capped at the negotiated max_io_size (max_chunk_size - MAX_HDR_SIZE).
Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
Link: https://patch.msgid.link/r/20260612-master-v1-1-70cde5c6fdc9@gmail.com
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -224,8 +224,9 @@ static int rdma_write_sg(struct rtrs_srv
/* WR will fail with length error
* if this is 0
*/
- if (plist->length == 0) {
- rtrs_err(s, "Invalid RDMA-Write sg list length 0\n");
+ if (plist->length == 0 || plist->length > max_chunk_size) {
+ rtrs_err(s, "Invalid RDMA-Write sg list length %u\n",
+ plist->length);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0320/1266] RDMA/siw: bound Read Response placement to the RREAD length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0319/1266] RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0321/1266] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
` (678 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jason Gunthorpe
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b upstream.
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
inbound Read Response DDP segment at sge->laddr + wqe->processed and then
accumulates wqe->processed, but it never checks the running total against
the sink buffer length on continuation segments. siw_check_sge() resolves
and validates the sink memory only on the first fragment (the if (!*mem)
branch), and siw_rresp_check_ntoh() compares the cumulative length against
wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).
A connected siw peer that answers an outstanding RREAD with Read Response
segments that keep the DDP Last flag clear, carrying more total payload
than the RREAD requested, drives wqe->processed past the validated sink
buffer; the next siw_rx_data() call writes out of bounds at
sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP,
so the peer is the remote end of an established RDMA connection and needs
no local privilege.
Bound every segment before placement, exactly as siw_proc_send() and
siw_proc_write() already do for their tagged and untagged paths, and
terminate the connection with a base-or-bounds DDP error when the
Read Response would overrun the sink buffer.
This is the second receive-path length fix for this file. A separate
change rejects an MPA FPDU length that underflows the per-fragment
remainder in the header decode; that guard does not cover this case,
because here each individual segment length is self-consistent and only
the accumulated placement offset overruns the buffer.
Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
Link: https://patch.msgid.link/r/20260602194700.2273758-1-michael.bommarito@gmail.com
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/siw/siw_qp_rx.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
@@ -848,6 +848,15 @@ int siw_proc_rresp(struct siw_qp *qp)
}
mem_p = *mem;
+ if (unlikely(wqe->processed + srx->fpdu_part_rem > wqe->bytes)) {
+ siw_dbg_qp(qp, "rresp len: %d + %d > %d\n",
+ wqe->processed, srx->fpdu_part_rem, wqe->bytes);
+ wqe->wc_status = SIW_WC_LOC_LEN_ERR;
+ siw_init_terminate(qp, TERM_ERROR_LAYER_DDP,
+ DDP_ETYPE_TAGGED_BUF,
+ DDP_ECODE_T_BASE_BOUNDS, 0);
+ return -EINVAL;
+ }
bytes = min(srx->fpdu_part_rem, srx->skb_new);
if (mem_p->mem_obj == NULL)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0321/1266] fuse: fix device node leak in cuse_process_init_reply()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0320/1266] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0322/1266] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
` (677 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alberto Ruiz, Miklos Szeredi
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alberto Ruiz <aruiz@redhat.com>
commit 9fa4f7a53406430ee9982f2f636a15b338185122 upstream.
If device_add() succeeds during CUSE initialization but a subsequent
step (cdev_alloc() or cdev_add()) fails, the error path calls
put_device() without first calling device_del(). This leaks the
devtmpfs entry created by device_add(), leaving a stale /dev/<name>
node that persists until reboot.
Since the cuse_conn is never linked into cuse_conntbl on the failure
path, cuse_channel_release() sees cc->dev == NULL and skips
device_unregister(), so no other code path cleans up the node.
This has several consequences:
- The device name is permanently poisoned: any subsequent attempt to
create a CUSE device with the same name hits the stale sysfs entry,
device_add() fails, and the new device is aborted.
- The collision manifests as ENODEV returned to userspace with no
dmesg diagnostic, making it very difficult to debug.
- The failure is self-perpetuating: once a name is leaked, all future
attempts with that name fail identically.
Fix this by introducing an err_dev label that calls device_del() to
undo device_add() before falling through to err_unlock. The existing
err_unlock path from a device_add() failure correctly skips device_del()
since the device was never added.
Testing instructions can be found at the lore link below.
Link: https://lore.kernel.org/all/20260408-wip-cuse-leak-fix-v1-0-1c028d575e97@redhat.com/
Signed-off-by: Alberto Ruiz <aruiz@redhat.com>
Fixes: 151060ac1314 ("CUSE: implement CUSE - Character device in Userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/cuse.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -386,7 +386,7 @@ static void cuse_process_init_reply(stru
rc = -ENOMEM;
cdev = cdev_alloc();
if (!cdev)
- goto err_unlock;
+ goto err_dev;
cdev->owner = THIS_MODULE;
cdev->ops = &cuse_frontend_fops;
@@ -412,6 +412,8 @@ out:
err_cdev:
cdev_del(cdev);
+err_dev:
+ device_del(dev);
err_unlock:
mutex_unlock(&cuse_lock);
put_device(dev);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0322/1266] fuse: re-lock request before returning from fuse_ref_folio()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0321/1266] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0323/1266] smb: client: reject overlapping data areas in SMB2 responses Greg Kroah-Hartman
` (676 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joanne Koong, Miklos Szeredi
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
commit b5befa80fdbe287a98480effed9564712924add5 upstream.
fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.
Fix this by locking the request in fuse_ref_folio() before returning.
Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -912,7 +912,7 @@ static int fuse_ref_page(struct fuse_cop
cs->nr_segs++;
cs->len = 0;
- return 0;
+ return lock_request(cs->req);
}
/*
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0323/1266] smb: client: reject overlapping data areas in SMB2 responses
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0322/1266] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0324/1266] xfs: fail recovery on a committed log item with no regions Greg Kroah-Hartman
` (675 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shoichiro Miyamoto, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
commit 8986c932905ea508d66da421eb2eb6e676ace1fe upstream.
Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to
responses without data area") restricted the implied bcc[0] length
exception to responses without a data area. However, the overlap
handling in __smb2_calc_size() clears data_length, which can make an
invalid response appear to have no data area and so qualify for the
exception.
Track data area overlap separately and reject such responses before
applying the length compatibility exceptions.
Fixes: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Cc: stable@vger.kernel.org
Signed-off-by: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2misc.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -18,7 +18,8 @@
#include "nterr.h"
#include "cached_dir.h"
-static unsigned int __smb2_calc_size(void *buf, bool *have_data);
+static unsigned int __smb2_calc_size(void *buf, bool *have_data,
+ bool *data_area_overlap);
static int
check_smb2_hdr(struct smb2_hdr *shdr, __u64 mid)
@@ -146,6 +147,7 @@ smb2_check_message(char *buf, unsigned i
__u32 calc_len; /* calculated length */
__u64 mid;
bool have_data;
+ bool data_area_overlap;
/* If server is a channel, select the primary channel */
pserver = SERVER_IS_CHAN(server) ? server->primary_server : server;
@@ -230,7 +232,12 @@ smb2_check_message(char *buf, unsigned i
}
have_data = false;
- calc_len = __smb2_calc_size(buf, &have_data);
+ data_area_overlap = false;
+ calc_len = __smb2_calc_size(buf, &have_data, &data_area_overlap);
+
+ /* Reject responses whose data area overlaps the fixed area. */
+ if (data_area_overlap)
+ return 1;
/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might
* be 0, and not a real miscalculation */
@@ -414,14 +421,15 @@ smb2_get_data_area_len(int *off, int *le
}
/*
- * Calculate the size of the SMB message based on the fixed header
- * portion, the number of word parameters and the data portion of the message.
- * If have_data is non-NULL, it is set to true when a non-empty data area was
- * found (data_length > 0), allowing callers to distinguish the implied bcc[0]
- * case (no data area) from an overreported data length.
+ * Calculate the size of the SMB message based on the fixed header, fixed
+ * parameter area, and variable data area.
+ *
+ * If have_data is not NULL, it is set when a non-empty data area is found.
+ * If data_area_overlap is not NULL, it is set when the data area overlaps
+ * the fixed area.
*/
static unsigned int
-__smb2_calc_size(void *buf, bool *have_data)
+__smb2_calc_size(void *buf, bool *have_data, bool *data_area_overlap)
{
struct smb2_pdu *pdu = buf;
struct smb2_hdr *shdr = &pdu->hdr;
@@ -430,6 +438,11 @@ __smb2_calc_size(void *buf, bool *have_d
/* Structure Size has already been checked to make sure it is 64 */
int len = le16_to_cpu(shdr->StructureSize);
+ if (have_data)
+ *have_data = false;
+ if (data_area_overlap)
+ *data_area_overlap = false;
+
/*
* StructureSize2, ie length of fixed parameter area has already
* been checked to make sure it is the correct length.
@@ -452,7 +465,10 @@ __smb2_calc_size(void *buf, bool *have_d
if (offset + 1 < len) {
cifs_dbg(VFS, "data area offset %d overlaps SMB2 header %d\n",
offset + 1, len);
+ if (data_area_overlap)
+ *data_area_overlap = true;
data_length = 0;
+ goto calc_size_exit;
} else {
len = offset + data_length;
}
@@ -467,7 +483,7 @@ calc_size_exit:
unsigned int
smb2_calc_size(void *buf)
{
- return __smb2_calc_size(buf, NULL);
+ return __smb2_calc_size(buf, NULL, NULL);
}
/* Note: caller must free return buffer */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0324/1266] xfs: fail recovery on a committed log item with no regions
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0323/1266] smb: client: reject overlapping data areas in SMB2 responses Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0325/1266] xfs: resample the data fork mapping after cycling ILOCK Greg Kroah-Hartman
` (674 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Christoph Hellwig, Darrick J. Wong, Carlos Maiolino
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 2094dab19d45c487285617b7b68913d0cc0c1211 upstream.
If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.
The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log. It came from an AI-assisted code audit of the
recovery parser.
xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf. Reject it there, before the commit handlers that also read
ri_buf[0].
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
xlog_recover (fs/xfs/xfs_log_recover.c:3493)
xfs_log_mount (fs/xfs/xfs_log.c:618)
xfs_mountfs (fs/xfs/xfs_mount.c:1034)
xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
vfs_get_tree (fs/super.c:1695)
path_mount (fs/namespace.c:4161)
__x64_sys_mount (fs/namespace.c:4367)
Fixes: 89cebc847729 ("xfs: validate transaction header length on log recovery")
Cc: stable@vger.kernel.org # v4.3
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_log_recover.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1872,6 +1872,15 @@ xlog_recover_reorder_trans(
list_for_each_entry_safe(item, n, &sort_list, ri_list) {
enum xlog_recover_reorder fate = XLOG_REORDER_ITEM_LIST;
+ /* a committed item with no regions has a NULL ri_buf[0] */
+ if (!item->ri_cnt || !item->ri_buf) {
+ xfs_warn(log->l_mp,
+ "%s: committed log item has no regions",
+ __func__);
+ error = -EFSCORRUPTED;
+ break;
+ }
+
item->ri_ops = xlog_find_item_ops(item);
if (!item->ri_ops) {
xfs_warn(log->l_mp,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0325/1266] xfs: resample the data fork mapping after cycling ILOCK
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0324/1266] xfs: fail recovery on a committed log item with no regions Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0326/1266] smb/server: do not require delete access for non-replacing links Greg Kroah-Hartman
` (673 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, hch, Darrick J. Wong,
Carlos Maiolino, Carlos Maiolino
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <djwong@kernel.org>
commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 upstream.
xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping. Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK. Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.
If *shared is now false, the directio write proceeds with a stale data
fork mapping. Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.
Cc: hch@lst.de
Cc: stable@vger.kernel.org # v4.11
Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -389,6 +389,7 @@ xfs_reflink_fill_cow_hole(
struct xfs_trans *tp;
xfs_filblks_t resaligned;
xfs_extlen_t resblks;
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
int nimaps;
int error;
bool found;
@@ -407,6 +408,22 @@ xfs_reflink_fill_cow_hole(
*lockmode = XFS_ILOCK_EXCL;
+ /*
+ * The data fork mapping may have changed while we dropped the ILOCK
+ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full
+ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset
+ * and drops the refcount of the old shared block). Re-read it so the
+ * shared-status recheck below and the caller's in-place iomap both
+ * operate on the current mapping rather than a stale physical block.
+ */
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
+ nimaps = 1;
+ error = xfs_bmapi_read(ip, imap->br_startoff,
+ imap->br_blockcount, imap, &nimaps, 0);
+ if (error)
+ goto out_trans_cancel;
+ }
+
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found);
if (error || !*shared)
goto out_trans_cancel;
@@ -453,6 +470,8 @@ xfs_reflink_fill_delalloc(
bool found;
do {
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
+
xfs_iunlock(ip, *lockmode);
*lockmode = 0;
@@ -463,6 +482,23 @@ xfs_reflink_fill_delalloc(
*lockmode = XFS_ILOCK_EXCL;
+ /*
+ * The data fork mapping may have changed while we dropped the
+ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can
+ * complete a full CoW cycle including xfs_reflink_end_cow(),
+ * which remaps this offset and drops the refcount of the old
+ * shared block). Re-read it so the shared-status recheck
+ * below and the caller's in-place iomap both operate on the
+ * current mapping rather than a stale physical block.
+ */
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
+ nimaps = 1;
+ error = xfs_bmapi_read(ip, imap->br_startoff,
+ imap->br_blockcount, imap, &nimaps, 0);
+ if (error)
+ goto out_trans_cancel;
+ }
+
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared,
&found);
if (error || !*shared)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0326/1266] smb/server: do not require delete access for non-replacing links
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0325/1266] xfs: resample the data fork mapping after cycling ILOCK Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0327/1266] block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Greg Kroah-Hartman
` (672 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, ChenXiaoSong,
Namjae Jeon, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
[ Upstream commit 851ed9e09639e0daf79a506ce26097b296ed5518 ]
Reproducer:
1. server: systemctl start ksmbd
2. client: mount -t cifs //${server_ip}/export /mnt
3. client: touch /mnt/file; ln /mnt/file /mnt/hardlink
4. client err log: ln: failed to create hard link 'hardlink' =>
'file': Permission denied
5. server err log: ksmbd: no right to delete : 0x80
Fixes: 13f3942f2bf4 ("ksmbd: add per-handle permission check to FILE_LINK_INFORMATION")
Cc: stable@vger.kernel.org
Reported-by: Steve French <stfrench@microsoft.com>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 968b1b5d858fb7..fafbb4275bba4d 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6504,16 +6504,18 @@ static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp,
}
case FILE_LINK_INFORMATION:
{
- if (!(fp->daccess & FILE_DELETE_LE)) {
- pr_err("no right to delete : 0x%x\n", fp->daccess);
- return -EACCES;
- }
+ struct smb2_file_link_info *file_info;
if (buf_len < sizeof(struct smb2_file_link_info))
return -EINVAL;
- return smb2_create_link(work, work->tcon->share_conf,
- (struct smb2_file_link_info *)buffer,
+ file_info = (struct smb2_file_link_info *)buffer;
+ if (file_info->ReplaceIfExists && !(fp->daccess & FILE_DELETE_LE)) {
+ pr_err("no right to delete : 0x%x\n", fp->daccess);
+ return -EACCES;
+ }
+
+ return smb2_create_link(work, work->tcon->share_conf, file_info,
buf_len, fp->filp,
work->conn->local_nls);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0327/1266] block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0326/1266] smb/server: do not require delete access for non-replacing links Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0328/1266] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
` (671 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sungwoo Kim, Dave Tian, Weidong Zhu,
Chao Shi, Christoph Hellwig, Jens Axboe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Shi <coshi036@gmail.com>
commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a upstream.
bdev_mark_dead()'s @surprise == true means the device is already gone.
The filesystem callback fs_bdev_mark_dead() honours this and skips
sync_filesystem(), but the bare block device path (no ->mark_dead op)
lost its !surprise guard when the holder ->mark_dead callback was wired
up (see Fixes), and now calls sync_blockdev() unconditionally, which can
hang forever waiting on writeback that can no longer complete.
syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
folio_wait_writeback(), wedging the reset worker and every task waiting
on it.
Skip the sync on surprise removal, matching fs_bdev_mark_dead();
invalidate_bdev() still runs. Orderly removal (surprise == false) is
unchanged.
Found by FuzzNvme.
Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
Acked-by: Sungwoo Kim <iam@sung-woo.kim>
Acked-by: Dave Tian <daveti@purdue.edu>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Signed-off-by: Chao Shi <coshi036@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260522220025.1770388-1-coshi036@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ adjusted for 6.6.y: bdev_mark_dead() there still unlocks bd_holder_lock
after the if/else and the else arm is a bare sync_blockdev(), so the
!surprise guard is added as "else if (!surprise)" instead of inside the
mainline else block. ]
Signed-off-by: Chao Shi <coshi036@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bdev.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/block/bdev.c b/block/bdev.c
index 598f94827b941f..a255492ba82654 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -1024,7 +1024,12 @@ void bdev_mark_dead(struct block_device *bdev, bool surprise)
mutex_lock(&bdev->bd_holder_lock);
if (bdev->bd_holder_ops && bdev->bd_holder_ops->mark_dead)
bdev->bd_holder_ops->mark_dead(bdev, surprise);
- else
+ /*
+ * On surprise removal the device is already gone; syncing is
+ * futile and can hang forever waiting on I/O that will never
+ * complete. Match fs_bdev_mark_dead(), which also skips it.
+ */
+ else if (!surprise)
sync_blockdev(bdev);
mutex_unlock(&bdev->bd_holder_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0328/1266] sched/fair: Only update stats for allowed CPUs when looking for dst group
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0327/1266] block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0329/1266] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
` (670 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Li, Peter Zijlstra (Intel),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Li <adamli@os.amperecomputing.com>
[ Upstream commit 82d6e01a0699800efd8b048eb584c907ccb47b7a ]
Load imbalance is observed when the workload frequently forks new threads.
Due to CPU affinity, the workload can run on CPU 0-7 in the first
group, and only on CPU 8-11 in the second group. CPU 12-15 are always idle.
{ 0 1 2 3 4 5 6 7 } {8 9 10 11 12 13 14 15}
* * * * * * * * * * * *
When looking for dst group for newly forked threads, in many times
update_sg_wakeup_stats() reports the second group has more idle CPUs
than the first group. The scheduler thinks the second group is less
busy. Then it selects least busy CPUs among CPU 8-11. Therefore CPU 8-11
can be crowded with newly forked threads, at the same time CPU 0-7
can be idle.
A task may not use all the CPUs in a schedule group due to CPU affinity.
Only update schedule group statistics for allowed CPUs.
Signed-off-by: Adam Li <adamli@os.amperecomputing.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index cdf49a04fd5820..2fc9fe94d3f1f4 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -10266,7 +10266,7 @@ static inline void update_sg_wakeup_stats(struct sched_domain *sd,
if (sd->flags & SD_ASYM_CPUCAPACITY)
sgs->group_misfit_task_load = 1;
- for_each_cpu(i, sched_group_span(group)) {
+ for_each_cpu_and(i, sched_group_span(group), p->cpus_ptr) {
struct rq *rq = cpu_rq(i);
unsigned int local;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0329/1266] crypto: algif_skcipher - force synchronous processing on trees without ctx->state
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0328/1266] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0330/1266] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU Greg Kroah-Hartman
` (669 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammet Kaan KILINÇ,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
directly into the skcipher request. After io_submit() the socket lock is
dropped and the request is processed asynchronously, so a concurrent
sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
run under an attacker-controlled IV. For CTR/stream modes this is
IV/keystream reuse and lets an unprivileged user recover the plaintext of
a concurrent operation.
Snapshotting ctx->iv into per-request storage for the async path is not
sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -
the MSG_MORE inter-chunk IV chaining is carried solely by the in-place
req->iv writeback, which a snapshot redirects into per-request memory that
af_alg_free_resources() releases on completion, silently producing wrong
output. Writing the IV back from the completion callback instead is not
possible either: that would require lock_sock() there, but the callback can
run in softirq/atomic context, so it must not sleep.
Make the operation synchronous instead, which removes both the IV race and
any writeback race. This is equivalent to the upstream resolution, commit
fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the
AIO socket path across net/ entirely and so produces the same end state for
this file. This patch deviates from that commit deliberately: rather than
removing AIO socket support tree-wide, which would be far too invasive for
stable, it removes only the AIO branch in crypto/algif_skcipher.c.
io_submit() now completes synchronously; AF_ALG async is rarely used in
practice.
The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
and is left alone to keep the fix minimal.
Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000
after the change; MSG_MORE chunked CTR output bit-identical to single-shot.
Reported-by: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Cc: <stable@vger.kernel.org>
Signed-off-by: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/algif_skcipher.c | 49 +++++++++++++++--------------------------
1 file changed, 18 insertions(+), 31 deletions(-)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index e31b1da58dba41..b12df4544d0bbb 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -107,37 +107,24 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
skcipher_request_set_crypt(&areq->cra_u.skcipher_req, areq->tsgl,
areq->first_rsgl.sgl.sgt.sgl, len, ctx->iv);
- if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
- /* AIO operation */
- sock_hold(sk);
- areq->iocb = msg->msg_iocb;
-
- /* Remember output size that will be generated. */
- areq->outlen = len;
-
- skcipher_request_set_callback(&areq->cra_u.skcipher_req,
- CRYPTO_TFM_REQ_MAY_SLEEP,
- af_alg_async_cb, areq);
- err = ctx->enc ?
- crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
- crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
-
- /* AIO operation in progress */
- if (err == -EINPROGRESS)
- return -EIOCBQUEUED;
-
- sock_put(sk);
- } else {
- /* Synchronous operation */
- skcipher_request_set_callback(&areq->cra_u.skcipher_req,
- CRYPTO_TFM_REQ_MAY_SLEEP |
- CRYPTO_TFM_REQ_MAY_BACKLOG,
- crypto_req_done, &ctx->wait);
- err = crypto_wait_req(ctx->enc ?
- crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
- crypto_skcipher_decrypt(&areq->cra_u.skcipher_req),
- &ctx->wait);
- }
+ /*
+ * Force synchronous processing. The async (AIO) path passed the
+ * socket-wide ctx->iv into the request, which the worker
+ * dereferenced after the socket lock was dropped, letting a
+ * concurrent sendmsg(ALG_SET_IV) inject an attacker IV. Mainline
+ * removed the AIO socket path in commit fcc77d33a34c ("net: Remove
+ * support for AIO on sockets"); these stable trees lack the
+ * per-request ctx->state used by newer kernels, so the minimal safe
+ * fix is to always complete synchronously.
+ */
+ skcipher_request_set_callback(&areq->cra_u.skcipher_req,
+ CRYPTO_TFM_REQ_MAY_SLEEP |
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &ctx->wait);
+ err = crypto_wait_req(ctx->enc ?
+ crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
+ crypto_skcipher_decrypt(&areq->cra_u.skcipher_req),
+ &ctx->wait);
free:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0330/1266] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0329/1266] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0331/1266] KVM: arm64: Clear __hyp_running_vcpu " Greg Kroah-Hartman
` (668 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Fuad Tabba,
Marc Zyngier, Fuad Tabba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 8cc8bbbfab14c22c5551d0dd19b208a44b141c76 upstream.
flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU
on every run. The vGIC list register save and restore use used_lrs as
their loop bound and expect it to stay within the number of implemented
list registers. While this is generally the case, flush_hyp_vcpu()
copies vgic_v3 verbatim and does not enforce this, so a value provided
by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2
(host -> EL2).
Fix by clamping used_lrs to the number of implemented list registers
after the copy, as the trusted path already does in
vgic_flush_lr_state(). The number of implemented list registers is
constant after init, so it is replicated once from
kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on
every entry.
Cc: stable@vger.kernel.org
Fixes: be66e67f1750 ("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260606175614.83273-3-imv4bel@gmail.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ tabba: adjust context in flush_hyp_vcpu() and kvm_hyp.h ]
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_hyp.h | 1 +
arch/arm64/kvm/arm.c | 2 ++
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 9 +++++++++
3 files changed, 12 insertions(+)
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index 51cd106cd840a0..1b209efac97287 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -146,5 +146,6 @@ extern u64 kvm_nvhe_sym(id_aa64smfr0_el1_sys_val);
extern unsigned long kvm_nvhe_sym(__icache_flags);
extern unsigned int kvm_nvhe_sym(kvm_arm_vmid_bits);
extern unsigned int kvm_nvhe_sym(kvm_host_sve_max_vl);
+extern unsigned int kvm_nvhe_sym(hyp_gicv3_nr_lr);
#endif /* __ARM64_KVM_HYP_H__ */
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 3ae529e967c7fb..e49ead6d005cc4 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -2026,6 +2026,8 @@ static int __init init_subsystems(void)
switch (err) {
case 0:
vgic_present = true;
+ if (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
+ kvm_nvhe_sym(hyp_gicv3_nr_lr) = kvm_vgic_global_state.nr_lr;
break;
case -ENODEV:
case -ENXIO:
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index 350d1775a5ce88..aa6c486667e706 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -22,6 +22,9 @@
DEFINE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params);
+/* Number of implemented GICv3 LRs. Used by flush_hyp_vcpu(). */
+unsigned int hyp_gicv3_nr_lr;
+
void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt);
static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
@@ -46,6 +49,12 @@ static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
hyp_vcpu->vcpu.arch.vsesr_el2 = host_vcpu->arch.vsesr_el2;
hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3 = host_vcpu->arch.vgic_cpu.vgic_v3;
+
+ /* Bound used_lrs by the number of implemented list registers. */
+ hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3.used_lrs =
+ min_t(unsigned int,
+ hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3.used_lrs,
+ hyp_gicv3_nr_lr);
}
static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0331/1266] KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0330/1266] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0332/1266] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
` (667 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Fuad Tabba,
Marc Zyngier, Fuad Tabba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit e8042f6e1d7befb2fb6b10a75918642bcd0acf9a upstream.
flush_hyp_vcpu() copies the host vCPU context into the hyp's private
vCPU on every run. ctxt_to_vcpu() expects a guest context to have a
NULL __hyp_running_vcpu, which is only ever set on the host context, so
that it resolves the vCPU via container_of(). While this is generally
the case, flush_hyp_vcpu() copies the context verbatim and does not
enforce this, so a value provided by the host is dereferenced at EL2
(host -> EL2).
Fix by clearing __hyp_running_vcpu after the copy.
Cc: stable@vger.kernel.org
Fixes: be66e67f1750 ("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260606175614.83273-2-imv4bel@gmail.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ tabba: adjust flush_hyp_vcpu() context ]
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index aa6c486667e706..ac0d5a0de01496 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -33,6 +33,9 @@ static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
hyp_vcpu->vcpu.arch.ctxt = host_vcpu->arch.ctxt;
+ /* __hyp_running_vcpu must be NULL in a guest context. */
+ hyp_vcpu->vcpu.arch.ctxt.__hyp_running_vcpu = NULL;
+
hyp_vcpu->vcpu.arch.sve_state = kern_hyp_va(host_vcpu->arch.sve_state);
hyp_vcpu->vcpu.arch.sve_max_vl = host_vcpu->arch.sve_max_vl;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0332/1266] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0331/1266] KVM: arm64: Clear __hyp_running_vcpu " Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0333/1266] nvmet-tcp: Fix potential UAF when ddgst mismatch Greg Kroah-Hartman
` (666 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Shivam Kumar,
Keith Busch
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <kumar.shivam43666@gmail.com>
commit 4606467a75cfc16721937272ed29462a750b60c8 upstream.
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.
Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1297,7 +1297,8 @@ static int nvmet_tcp_try_recv_ddgst(stru
queue->idx, cmd->req.cmd->common.command_id,
queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
le32_to_cpu(cmd->exp_ddgst));
- nvmet_req_uninit(&cmd->req);
+ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
+ nvmet_req_uninit(&cmd->req);
nvmet_tcp_free_cmd_buffers(cmd);
nvmet_tcp_fatal_error(queue);
ret = -EPROTO;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0333/1266] nvmet-tcp: Fix potential UAF when ddgst mismatch
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0332/1266] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0334/1266] crypto: sun4i-ss - Remove insecure and unused rng_alg Greg Kroah-Hartman
` (665 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shivam Kumar, Christoph Hellwig,
Sagi Grimberg, Keith Busch
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
commit dbbd07d0a7020b80f6a7028e561908f7b83b3d5a upstream.
Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
calls nvmet_req_uninit() — which performs percpu_ref_put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes_done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,
checks nvmet_tcp_need_data_in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes_done < transfer_len and cqe->status == 0). It therefore calls
nvmet_req_uninit() a second time on the same command — a double
percpu_ref_put against a single percpu_ref_get.
Reported-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/tcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1297,8 +1297,10 @@ static int nvmet_tcp_try_recv_ddgst(stru
queue->idx, cmd->req.cmd->common.command_id,
queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
le32_to_cpu(cmd->exp_ddgst));
- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
+ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) {
+ cmd->req.cqe->status = NVME_SC_CMD_SEQ_ERROR;
nvmet_req_uninit(&cmd->req);
+ }
nvmet_tcp_free_cmd_buffers(cmd);
nvmet_tcp_fatal_error(queue);
ret = -EPROTO;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0334/1266] crypto: sun4i-ss - Remove insecure and unused rng_alg
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0333/1266] nvmet-tcp: Fix potential UAF when ddgst mismatch Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0335/1266] x86/mm: Fix check/use ordering in switch_mm_irqs_off() Greg Kroah-Hartman
` (664 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tianchu Chen, Corentin LABBE,
Eric Biggers, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit b2c41fa9dd8fc740c489e060b199165771f268d1 upstream.
Remove sun4i_ss_rng, as it is insecure and unused:
- It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing
locking and has a buffer overflow. sun4i_ss_prng_generate() fails to
fill the entire buffer with cryptographic random bytes, because it
rounds the destination length down and also doesn't actually wait for
the hardware to be ready before pulling bytes from it.
- No user of this code is known. It's usable only theoretically via the
"rng" algorithm type of AF_ALG. But userspace actually just uses the
actual Linux RNG (/dev/random etc) instead. And rng_algs don't
contribute entropy to the actual Linux RNG either. (This may have
been confused with hwrng, which does contribute entropy.)
The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen
and discovered by Atuin - Automated Vulnerability Discovery Engine
There's no point in fixing all these vulnerabilities individually when
this is unused code, so let's just remove it.
Fixes: b8ae5c7387ad ("crypto: sun4i-ss - support the Security System PRNG")
Cc: stable@vger.kernel.org
Reported-by: Tianchu Chen <flynnnchen@tencent.com>
Closes: https://lore.kernel.org/r/af749a8447bd7f0e9dd26ca6c87e9c6afecb09d9@linux.dev/
Acked-by: Corentin LABBE <clabbe.montjoie@gmail.com>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/configs/sunxi_defconfig | 1 -
drivers/crypto/allwinner/Kconfig | 8 ---
drivers/crypto/allwinner/sun4i-ss/Makefile | 1 -
.../crypto/allwinner/sun4i-ss/sun4i-ss-core.c | 36 ----------
.../crypto/allwinner/sun4i-ss/sun4i-ss-prng.c | 69 -------------------
drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h | 20 ------
6 files changed, 135 deletions(-)
delete mode 100644 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index a83d29fed17563..f4b8d8f7dbefbb 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -170,7 +170,6 @@ CONFIG_ROOT_NFS=y
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_ISO8859_1=y
CONFIG_CRYPTO_DEV_SUN4I_SS=y
-CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG=y
CONFIG_CRYPTO_DEV_SUN8I_CE=y
CONFIG_CRYPTO_DEV_SUN8I_SS=y
CONFIG_DMA_CMA=y
diff --git a/drivers/crypto/allwinner/Kconfig b/drivers/crypto/allwinner/Kconfig
index b8e75210a0e315..06ea0e9fe6f22f 100644
--- a/drivers/crypto/allwinner/Kconfig
+++ b/drivers/crypto/allwinner/Kconfig
@@ -24,14 +24,6 @@ config CRYPTO_DEV_SUN4I_SS
To compile this driver as a module, choose M here: the module
will be called sun4i-ss.
-config CRYPTO_DEV_SUN4I_SS_PRNG
- bool "Support for Allwinner Security System PRNG"
- depends on CRYPTO_DEV_SUN4I_SS
- select CRYPTO_RNG
- help
- Select this option if you want to provide kernel-side support for
- the Pseudo-Random Number Generator found in the Security System.
-
config CRYPTO_DEV_SUN4I_SS_DEBUG
bool "Enable sun4i-ss stats"
depends on CRYPTO_DEV_SUN4I_SS
diff --git a/drivers/crypto/allwinner/sun4i-ss/Makefile b/drivers/crypto/allwinner/sun4i-ss/Makefile
index c0a2797d316827..06a9ae81f9f808 100644
--- a/drivers/crypto/allwinner/sun4i-ss/Makefile
+++ b/drivers/crypto/allwinner/sun4i-ss/Makefile
@@ -1,4 +1,3 @@
# SPDX-License-Identifier: GPL-2.0-only
obj-$(CONFIG_CRYPTO_DEV_SUN4I_SS) += sun4i-ss.o
sun4i-ss-y += sun4i-ss-core.o sun4i-ss-hash.o sun4i-ss-cipher.o
-sun4i-ss-$(CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG) += sun4i-ss-prng.o
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c
index 3bcfcfc3708426..6678fab422c31b 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c
@@ -215,23 +215,6 @@ static struct sun4i_ss_alg_template ss_algs[] = {
}
}
},
-#ifdef CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG
-{
- .type = CRYPTO_ALG_TYPE_RNG,
- .alg.rng = {
- .base = {
- .cra_name = "stdrng",
- .cra_driver_name = "sun4i_ss_rng",
- .cra_priority = 300,
- .cra_ctxsize = 0,
- .cra_module = THIS_MODULE,
- },
- .generate = sun4i_ss_prng_generate,
- .seed = sun4i_ss_prng_seed,
- .seedsize = SS_SEED_LEN / BITS_PER_BYTE,
- }
-},
-#endif
};
static int sun4i_ss_debugfs_show(struct seq_file *seq, void *v)
@@ -249,12 +232,6 @@ static int sun4i_ss_debugfs_show(struct seq_file *seq, void *v)
ss_algs[i].stat_req, ss_algs[i].stat_opti, ss_algs[i].stat_fb,
ss_algs[i].stat_bytes);
break;
- case CRYPTO_ALG_TYPE_RNG:
- seq_printf(seq, "%s %s reqs=%lu tsize=%lu\n",
- ss_algs[i].alg.rng.base.cra_driver_name,
- ss_algs[i].alg.rng.base.cra_name,
- ss_algs[i].stat_req, ss_algs[i].stat_bytes);
- break;
case CRYPTO_ALG_TYPE_AHASH:
seq_printf(seq, "%s %s reqs=%lu\n",
ss_algs[i].alg.hash.halg.base.cra_driver_name,
@@ -473,13 +450,6 @@ static int sun4i_ss_probe(struct platform_device *pdev)
goto error_alg;
}
break;
- case CRYPTO_ALG_TYPE_RNG:
- err = crypto_register_rng(&ss_algs[i].alg.rng);
- if (err) {
- dev_err(ss->dev, "Fail to register %s\n",
- ss_algs[i].alg.rng.base.cra_name);
- }
- break;
}
}
@@ -499,9 +469,6 @@ static int sun4i_ss_probe(struct platform_device *pdev)
case CRYPTO_ALG_TYPE_AHASH:
crypto_unregister_ahash(&ss_algs[i].alg.hash);
break;
- case CRYPTO_ALG_TYPE_RNG:
- crypto_unregister_rng(&ss_algs[i].alg.rng);
- break;
}
}
error_pm:
@@ -522,9 +489,6 @@ static int sun4i_ss_remove(struct platform_device *pdev)
case CRYPTO_ALG_TYPE_AHASH:
crypto_unregister_ahash(&ss_algs[i].alg.hash);
break;
- case CRYPTO_ALG_TYPE_RNG:
- crypto_unregister_rng(&ss_algs[i].alg.rng);
- break;
}
}
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c
deleted file mode 100644
index 491fcb7b81b40b..00000000000000
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c
+++ /dev/null
@@ -1,69 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-#include "sun4i-ss.h"
-
-int sun4i_ss_prng_seed(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen)
-{
- struct sun4i_ss_alg_template *algt;
- struct rng_alg *alg = crypto_rng_alg(tfm);
-
- algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
- memcpy(algt->ss->seed, seed, slen);
-
- return 0;
-}
-
-int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
- unsigned int slen, u8 *dst, unsigned int dlen)
-{
- struct sun4i_ss_alg_template *algt;
- struct rng_alg *alg = crypto_rng_alg(tfm);
- int i, err;
- u32 v;
- u32 *data = (u32 *)dst;
- const u32 mode = SS_OP_PRNG | SS_PRNG_CONTINUE | SS_ENABLED;
- size_t len;
- struct sun4i_ss_ctx *ss;
- unsigned int todo = (dlen / 4) * 4;
-
- algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
- ss = algt->ss;
-
- err = pm_runtime_resume_and_get(ss->dev);
- if (err < 0)
- return err;
-
- if (IS_ENABLED(CONFIG_CRYPTO_DEV_SUN4I_SS_DEBUG)) {
- algt->stat_req++;
- algt->stat_bytes += todo;
- }
-
- spin_lock_bh(&ss->slock);
-
- writel(mode, ss->base + SS_CTL);
-
- while (todo > 0) {
- /* write the seed */
- for (i = 0; i < SS_SEED_LEN / BITS_PER_LONG; i++)
- writel(ss->seed[i], ss->base + SS_KEY0 + i * 4);
-
- /* Read the random data */
- len = min_t(size_t, SS_DATA_LEN / BITS_PER_BYTE, todo);
- readsl(ss->base + SS_TXFIFO, data, len / 4);
- data += len / 4;
- todo -= len;
-
- /* Update the seed */
- for (i = 0; i < SS_SEED_LEN / BITS_PER_LONG; i++) {
- v = readl(ss->base + SS_KEY0 + i * 4);
- ss->seed[i] = v;
- }
- }
-
- writel(0, ss->base + SS_CTL);
- spin_unlock_bh(&ss->slock);
-
- pm_runtime_put(ss->dev);
-
- return 0;
-}
diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
index 6c5d4aa6453c7f..f7d1c79ac677d8 100644
--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
+++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
@@ -31,8 +31,6 @@
#include <crypto/internal/skcipher.h>
#include <crypto/aes.h>
#include <crypto/internal/des.h>
-#include <crypto/internal/rng.h>
-#include <crypto/rng.h>
#define SS_CTL 0x00
#define SS_KEY0 0x04
@@ -62,10 +60,6 @@
/* SS_CTL configuration values */
-/* PRNG generator mode - bit 15 */
-#define SS_PRNG_ONESHOT (0 << 15)
-#define SS_PRNG_CONTINUE (1 << 15)
-
/* IV mode for hash */
#define SS_IV_ARBITRARY (1 << 14)
@@ -94,14 +88,10 @@
#define SS_OP_3DES (2 << 4)
#define SS_OP_SHA1 (3 << 4)
#define SS_OP_MD5 (4 << 4)
-#define SS_OP_PRNG (5 << 4)
/* Data end bit - bit 2 */
#define SS_DATA_END (1 << 2)
-/* PRNG start bit - bit 1 */
-#define SS_PRNG_START (1 << 1)
-
/* SS Enable bit - bit 0 */
#define SS_DISABLED (0 << 0)
#define SS_ENABLED (1 << 0)
@@ -128,9 +118,6 @@
#define SS_RXFIFO_EMP_INT_ENABLE (1 << 2)
#define SS_TXFIFO_AVA_INT_ENABLE (1 << 0)
-#define SS_SEED_LEN 192
-#define SS_DATA_LEN 160
-
/*
* struct ss_variant - Describe SS hardware variant
* @sha1_in_be: The SHA1 digest is given by SS in BE, and so need to be inverted.
@@ -151,9 +138,6 @@ struct sun4i_ss_ctx {
char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
spinlock_t slock; /* control the use of the device */
-#ifdef CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG
- u32 seed[SS_SEED_LEN / BITS_PER_LONG];
-#endif
struct dentry *dbgfs_dir;
struct dentry *dbgfs_stats;
};
@@ -164,7 +148,6 @@ struct sun4i_ss_alg_template {
union {
struct skcipher_alg crypto;
struct ahash_alg hash;
- struct rng_alg rng;
} alg;
struct sun4i_ss_ctx *ss;
unsigned long stat_req;
@@ -231,6 +214,3 @@ int sun4i_ss_des_setkey(struct crypto_skcipher *tfm, const u8 *key,
unsigned int keylen);
int sun4i_ss_des3_setkey(struct crypto_skcipher *tfm, const u8 *key,
unsigned int keylen);
-int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
- unsigned int slen, u8 *dst, unsigned int dlen);
-int sun4i_ss_prng_seed(struct crypto_rng *tfm, const u8 *seed, unsigned int slen);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0335/1266] x86/mm: Fix check/use ordering in switch_mm_irqs_off()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0334/1266] crypto: sun4i-ss - Remove insecure and unused rng_alg Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0336/1266] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
` (663 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Hansen, Seth Forshee,
Eric Hagberg, Stephen Dolan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Dolan <sdolan@janestreet.com>
This is a stable-specific fix. There is no single upstream commit to
cherry-pick; the equivalent mainline fix is commit 83b0177a6c48
("x86/mm: Fix SMP ordering in switch_mm_irqs_off()"), which is in
v6.18 but does not apply to these trees because the surrounding code
was refactored.
The backports of commit fea4e317f9e7 ("x86/mm: Eliminate window where
TLB flushes may be inadvertently skipped") -- the fix for
CVE-2025-37964 -- to the 6.1, 6.6 and 6.12 trees ended up with two
code blocks in the wrong order relative to mainline. The fix depends
on setting cpu_tlbstate.loaded_mm to LOADED_MM_SWITCHING *before*
reading tlb_gen, so that a concurrent TLB shootdown either sees
LOADED_MM_SWITCHING and sends the IPI, or the switching CPU sees the
updated tlb_gen. In the stable trees the write of LOADED_MM_SWITCHING
was placed after the tlb_gen read, so the race window fea4e317f9e7 was
meant to close is still open and CVE-2025-37964 is unfixed there:
a process can be left running with stale TLB entries, which typically
manifests as rare, hard-to-bisect memory corruption or segfaults.
This has been confirmed by several independent parties:
- reproduced on 6.1.y/6.6.y/6.12.y with the test program in [1],
and confirmed fixed by this patch
- Seth Forshee saw segfaults on 6.12.y within ~30 minutes of running
a test workload; with this patch it ran 18 hours cleanly [2]
- Greg Thelen reports 6.6.y- and 6.12.y-based test failures fixed by
this patch [3]
Dave Hansen acked the patch [4] and has no objection to it going into
stable [5].
The patch below is against 6.12.y; the identical change applies to
6.1.y and 6.6.y. (The cpumask_test_cpu()/smp_mb() portion of the
mainline fix is not needed here because commit 209954cbc7d0
("x86/mm/tlb: Update mm_cpumask lazily") was never backported to these
trees.)
[1] https://lore.kernel.org/lkml/CAHDw0oGd0B4=uuv8NGqbUQ_ZVmSheU2bN70e4QhFXWvuAZdt2w@mail.gmail.com/
[2] https://lore.kernel.org/lkml/aZYWXe739XUJrBld@do-x1carbon/
[3] https://lore.kernel.org/lkml/CAHH2K0brx9omC9QYyB6Lio3t_1Lf8v=VaFoiaG23UgQ-aec89Q@mail.gmail.com/
[4] https://lore.kernel.org/lkml/281e8018-5506-4a79-8775-e0de7e58b95f@intel.com/
[5] https://lore.kernel.org/lkml/86421ee5-5332-46c2-bb48-d40310b818be@intel.com/
Fixes: fea4e317f9e7 ("x86/mm: Eliminate window where TLB flushes may be inadvertently skipped") # 6.1.y/6.6.y/6.12.y backports
Acked-by: Dave Hansen <dave.hansen@intel.com>
Tested-by: Seth Forshee <sforshee@kernel.org>
Tested-by: Eric Hagberg <ehagberg@janestreet.com>
Signed-off-by: Stephen Dolan <sdolan@janestreet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/tlb.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 20ce6a1bd6c57d..19e995f58d6321 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -612,6 +612,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
*/
cond_mitigation(tsk);
+ /*
+ * Indicate that CR3 is about to change. nmi_uaccess_okay()
+ * and others are sensitive to the window where mm_cpumask(),
+ * CR3 and cpu_tlbstate.loaded_mm are not all in sync.
+ */
+ this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING);
+ barrier();
+
/*
* Stop remote flushes for the previous mm.
* Skip kernel threads; we never send init_mm TLB flushing IPIs,
@@ -629,14 +637,6 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
next_tlb_gen = atomic64_read(&next->context.tlb_gen);
choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
-
- /*
- * Indicate that CR3 is about to change. nmi_uaccess_okay()
- * and others are sensitive to the window where mm_cpumask(),
- * CR3 and cpu_tlbstate.loaded_mm are not all in sync.
- */
- this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING);
- barrier();
}
new_lam = mm_lam_cr3_mask(next);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0336/1266] crypto: crypto4xx - Remove ahash-related code
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0335/1266] x86/mm: Fix check/use ordering in switch_mm_irqs_off() Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0337/1266] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
` (662 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Eric Biggers,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 97855e7f1ccf4917f305baab199edb9f2595ff5b upstream.
The hash implementation in crypto4xx has been disabled since 2009.
As nobody has tried to fix this remove all the dead code.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/amcc/crypto4xx_alg.c | 106 ---------------------------
drivers/crypto/amcc/crypto4xx_core.c | 43 +----------
drivers/crypto/amcc/crypto4xx_core.h | 7 --
3 files changed, 1 insertion(+), 155 deletions(-)
diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c
index ded73224273295..91cecec729f25e 100644
--- a/drivers/crypto/amcc/crypto4xx_alg.c
+++ b/drivers/crypto/amcc/crypto4xx_alg.c
@@ -12,9 +12,6 @@
#include <linux/interrupt.h>
#include <linux/spinlock_types.h>
#include <linux/scatterlist.h>
-#include <linux/crypto.h>
-#include <linux/hash.h>
-#include <crypto/internal/hash.h>
#include <linux/dma-mapping.h>
#include <crypto/algapi.h>
#include <crypto/aead.h>
@@ -616,106 +613,3 @@ int crypto4xx_decrypt_aes_gcm(struct aead_request *req)
{
return crypto4xx_crypt_aes_gcm(req, true);
}
-
-/*
- * HASH SHA1 Functions
- */
-static int crypto4xx_hash_alg_init(struct crypto_tfm *tfm,
- unsigned int sa_len,
- unsigned char ha,
- unsigned char hm)
-{
- struct crypto_alg *alg = tfm->__crt_alg;
- struct crypto4xx_alg *my_alg;
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(tfm);
- struct dynamic_sa_hash160 *sa;
- int rc;
-
- my_alg = container_of(__crypto_ahash_alg(alg), struct crypto4xx_alg,
- alg.u.hash);
- ctx->dev = my_alg->dev;
-
- /* Create SA */
- if (ctx->sa_in || ctx->sa_out)
- crypto4xx_free_sa(ctx);
-
- rc = crypto4xx_alloc_sa(ctx, sa_len);
- if (rc)
- return rc;
-
- crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
- sizeof(struct crypto4xx_ctx));
- sa = (struct dynamic_sa_hash160 *)ctx->sa_in;
- set_dynamic_sa_command_0(&sa->ctrl, SA_SAVE_HASH, SA_NOT_SAVE_IV,
- SA_NOT_LOAD_HASH, SA_LOAD_IV_FROM_SA,
- SA_NO_HEADER_PROC, ha, SA_CIPHER_ALG_NULL,
- SA_PAD_TYPE_ZERO, SA_OP_GROUP_BASIC,
- SA_OPCODE_HASH, DIR_INBOUND);
- set_dynamic_sa_command_1(&sa->ctrl, 0, SA_HASH_MODE_HASH,
- CRYPTO_FEEDBACK_MODE_NO_FB, SA_EXTENDED_SN_OFF,
- SA_SEQ_MASK_OFF, SA_MC_ENABLE,
- SA_NOT_COPY_PAD, SA_NOT_COPY_PAYLOAD,
- SA_NOT_COPY_HDR);
- /* Need to zero hash digest in SA */
- memset(sa->inner_digest, 0, sizeof(sa->inner_digest));
- memset(sa->outer_digest, 0, sizeof(sa->outer_digest));
-
- return 0;
-}
-
-int crypto4xx_hash_init(struct ahash_request *req)
-{
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- int ds;
- struct dynamic_sa_ctl *sa;
-
- sa = ctx->sa_in;
- ds = crypto_ahash_digestsize(
- __crypto_ahash_cast(req->base.tfm));
- sa->sa_command_0.bf.digest_len = ds >> 2;
- sa->sa_command_0.bf.load_hash_state = SA_LOAD_HASH_FROM_SA;
-
- return 0;
-}
-
-int crypto4xx_hash_update(struct ahash_request *req)
-{
- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- struct scatterlist dst;
- unsigned int ds = crypto_ahash_digestsize(ahash);
-
- sg_init_one(&dst, req->result, ds);
-
- return crypto4xx_build_pd(&req->base, ctx, req->src, &dst,
- req->nbytes, NULL, 0, ctx->sa_in,
- ctx->sa_len, 0, NULL);
-}
-
-int crypto4xx_hash_final(struct ahash_request *req)
-{
- return 0;
-}
-
-int crypto4xx_hash_digest(struct ahash_request *req)
-{
- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- struct scatterlist dst;
- unsigned int ds = crypto_ahash_digestsize(ahash);
-
- sg_init_one(&dst, req->result, ds);
-
- return crypto4xx_build_pd(&req->base, ctx, req->src, &dst,
- req->nbytes, NULL, 0, ctx->sa_in,
- ctx->sa_len, 0, NULL);
-}
-
-/*
- * SHA1 Algorithm
- */
-int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm)
-{
- return crypto4xx_hash_alg_init(tfm, SA_HASH160_LEN, SA_HASH_ALG_SHA1,
- SA_HASH_MODE_HASH);
-}
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index d553f3f1efbeea..e426127a8ac482 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -485,18 +485,6 @@ static void crypto4xx_copy_pkt_to_dst(struct crypto4xx_device *dev,
}
}
-static void crypto4xx_copy_digest_to_dst(void *dst,
- struct pd_uinfo *pd_uinfo,
- struct crypto4xx_ctx *ctx)
-{
- struct dynamic_sa_ctl *sa = (struct dynamic_sa_ctl *) ctx->sa_in;
-
- if (sa->sa_command_0.bf.hash_alg == SA_HASH_ALG_SHA1) {
- memcpy(dst, pd_uinfo->sr_va->save_digest,
- SA_HASH_ALG_SHA1_DIGEST_SIZE);
- }
-}
-
static void crypto4xx_ret_sg_desc(struct crypto4xx_device *dev,
struct pd_uinfo *pd_uinfo)
{
@@ -549,23 +537,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
skcipher_request_complete(req, 0);
}
-static void crypto4xx_ahash_done(struct crypto4xx_device *dev,
- struct pd_uinfo *pd_uinfo)
-{
- struct crypto4xx_ctx *ctx;
- struct ahash_request *ahash_req;
-
- ahash_req = ahash_request_cast(pd_uinfo->async_req);
- ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
-
- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx);
- crypto4xx_ret_sg_desc(dev, pd_uinfo);
-
- if (pd_uinfo->state & PD_ENTRY_BUSY)
- ahash_request_complete(ahash_req, -EINPROGRESS);
- ahash_request_complete(ahash_req, 0);
-}
-
static void crypto4xx_aead_done(struct crypto4xx_device *dev,
struct pd_uinfo *pd_uinfo,
struct ce_pd *pd)
@@ -642,9 +613,6 @@ static void crypto4xx_pd_done(struct crypto4xx_device *dev, u32 idx)
case CRYPTO_ALG_TYPE_AEAD:
crypto4xx_aead_done(dev, pd_uinfo, pd);
break;
- case CRYPTO_ALG_TYPE_AHASH:
- crypto4xx_ahash_done(dev, pd_uinfo);
- break;
}
}
@@ -915,8 +883,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
}
pd->pd_ctl.w = PD_CTL_HOST_READY |
- ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
- (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
PD_CTL_HASH_FINAL : 0);
pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
pd_uinfo->state = PD_ENTRY_INUSE | (is_busy ? PD_ENTRY_BUSY : 0);
@@ -1022,10 +989,6 @@ static int crypto4xx_register_alg(struct crypto4xx_device *sec_dev,
rc = crypto_register_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_AHASH:
- rc = crypto_register_ahash(&alg->alg.u.hash);
- break;
-
case CRYPTO_ALG_TYPE_RNG:
rc = crypto_register_rng(&alg->alg.u.rng);
break;
@@ -1051,10 +1014,6 @@ static void crypto4xx_unregister_alg(struct crypto4xx_device *sec_dev)
list_for_each_entry_safe(alg, tmp, &sec_dev->alg_list, entry) {
list_del(&alg->entry);
switch (alg->alg.type) {
- case CRYPTO_ALG_TYPE_AHASH:
- crypto_unregister_ahash(&alg->alg.u.hash);
- break;
-
case CRYPTO_ALG_TYPE_AEAD:
crypto_unregister_aead(&alg->alg.u.aead);
break;
diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h
index 56c10668c0ab0a..0d83cde84cca9a 100644
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -16,7 +16,6 @@
#include <linux/ratelimit.h>
#include <linux/mutex.h>
#include <linux/scatterlist.h>
-#include <crypto/internal/hash.h>
#include <crypto/internal/aead.h>
#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
@@ -135,7 +134,6 @@ struct crypto4xx_alg_common {
u32 type;
union {
struct skcipher_alg cipher;
- struct ahash_alg hash;
struct aead_alg aead;
struct rng_alg rng;
} u;
@@ -182,11 +180,6 @@ int crypto4xx_encrypt_noiv_block(struct skcipher_request *req);
int crypto4xx_decrypt_noiv_block(struct skcipher_request *req);
int crypto4xx_rfc3686_encrypt(struct skcipher_request *req);
int crypto4xx_rfc3686_decrypt(struct skcipher_request *req);
-int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm);
-int crypto4xx_hash_digest(struct ahash_request *req);
-int crypto4xx_hash_final(struct ahash_request *req);
-int crypto4xx_hash_update(struct ahash_request *req);
-int crypto4xx_hash_init(struct ahash_request *req);
/*
* Note: Only use this function to copy items that is word aligned.
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0337/1266] crypto: crypto4xx - Remove insecure and unused rng_alg
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0336/1266] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0338/1266] crypto: hisi-trng - Remove crypto_rng interface Greg Kroah-Hartman
` (661 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Christian Lamparter,
Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 7811ec9e973d2c9e465083699f0c8240b98cb8c4 upstream.
Remove crypto4xx_rng, as it is insecure and unused:
- It has only a 64-bit security strength, which is highly inadequate.
This can be seen by the fact that crypto4xx_hw_init() seeds it with
only 64 bits of entropy, and the fact that the original commit
mentions that it implements ANSI X9.17 Annex C.
Another issue was that this driver didn't implement the crypto_rng API
correctly, as crypto4xx_prng_generate() didn't return 0 on success.
- No user of this code is known. It's usable only theoretically via the
"rng" algorithm type of AF_ALG. But userspace actually just uses the
actual Linux RNG (/dev/random etc) instead. And rng_algs don't
contribute entropy to the actual Linux RNG either. (This may have
been confused with hwrng, which does contribute entropy.)
Fixes: d072bfa48853 ("crypto: crypto4xx - add prng crypto support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/amcc/crypto4xx_core.c | 87 -------------------------
drivers/crypto/amcc/crypto4xx_core.h | 4 --
drivers/crypto/amcc/crypto4xx_reg_def.h | 11 ----
3 files changed, 102 deletions(-)
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index e426127a8ac482..822c1ac2d5dd57 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -31,11 +31,9 @@
#include <crypto/ctr.h>
#include <crypto/gcm.h>
#include <crypto/sha1.h>
-#include <crypto/rng.h>
#include <crypto/scatterwalk.h>
#include <crypto/skcipher.h>
#include <crypto/internal/aead.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
#include "crypto4xx_reg_def.h"
#include "crypto4xx_core.h"
@@ -989,10 +987,6 @@ static int crypto4xx_register_alg(struct crypto4xx_device *sec_dev,
rc = crypto_register_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_RNG:
- rc = crypto_register_rng(&alg->alg.u.rng);
- break;
-
default:
rc = crypto_register_skcipher(&alg->alg.u.cipher);
break;
@@ -1018,10 +1012,6 @@ static void crypto4xx_unregister_alg(struct crypto4xx_device *sec_dev)
crypto_unregister_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_RNG:
- crypto_unregister_rng(&alg->alg.u.rng);
- break;
-
default:
crypto_unregister_skcipher(&alg->alg.u.cipher);
}
@@ -1080,69 +1070,6 @@ static irqreturn_t crypto4xx_ce_interrupt_handler_revb(int irq, void *data)
PPC4XX_TMO_ERR_INT);
}
-static int ppc4xx_prng_data_read(struct crypto4xx_device *dev,
- u8 *data, unsigned int max)
-{
- unsigned int i, curr = 0;
- u32 val[2];
-
- do {
- /* trigger PRN generation */
- writel(PPC4XX_PRNG_CTRL_AUTO_EN,
- dev->ce_base + CRYPTO4XX_PRNG_CTRL);
-
- for (i = 0; i < 1024; i++) {
- /* usually 19 iterations are enough */
- if ((readl(dev->ce_base + CRYPTO4XX_PRNG_STAT) &
- CRYPTO4XX_PRNG_STAT_BUSY))
- continue;
-
- val[0] = readl_be(dev->ce_base + CRYPTO4XX_PRNG_RES_0);
- val[1] = readl_be(dev->ce_base + CRYPTO4XX_PRNG_RES_1);
- break;
- }
- if (i == 1024)
- return -ETIMEDOUT;
-
- if ((max - curr) >= 8) {
- memcpy(data, &val, 8);
- data += 8;
- curr += 8;
- } else {
- /* copy only remaining bytes */
- memcpy(data, &val, max - curr);
- break;
- }
- } while (curr < max);
-
- return curr;
-}
-
-static int crypto4xx_prng_generate(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dstn, unsigned int dlen)
-{
- struct rng_alg *alg = crypto_rng_alg(tfm);
- struct crypto4xx_alg *amcc_alg;
- struct crypto4xx_device *dev;
- int ret;
-
- amcc_alg = container_of(alg, struct crypto4xx_alg, alg.u.rng);
- dev = amcc_alg->dev;
-
- mutex_lock(&dev->core_dev->rng_lock);
- ret = ppc4xx_prng_data_read(dev, dstn, dlen);
- mutex_unlock(&dev->core_dev->rng_lock);
- return ret;
-}
-
-
-static int crypto4xx_prng_seed(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen)
-{
- return 0;
-}
-
/*
* Supported Crypto Algorithms
*/
@@ -1312,18 +1239,6 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
.cra_module = THIS_MODULE,
},
} },
- { .type = CRYPTO_ALG_TYPE_RNG, .u.rng = {
- .base = {
- .cra_name = "stdrng",
- .cra_driver_name = "crypto4xx_rng",
- .cra_priority = 300,
- .cra_ctxsize = 0,
- .cra_module = THIS_MODULE,
- },
- .generate = crypto4xx_prng_generate,
- .seed = crypto4xx_prng_seed,
- .seedsize = 0,
- } },
};
/*
@@ -1401,7 +1316,6 @@ static int crypto4xx_probe(struct platform_device *ofdev)
core_dev->dev->core_dev = core_dev;
core_dev->dev->is_revb = is_revb;
core_dev->device = dev;
- mutex_init(&core_dev->rng_lock);
spin_lock_init(&core_dev->lock);
INIT_LIST_HEAD(&core_dev->dev->alg_list);
ratelimit_default_init(&core_dev->dev->aead_ratelimit);
@@ -1479,7 +1393,6 @@ static int crypto4xx_remove(struct platform_device *ofdev)
tasklet_kill(&core_dev->tasklet);
/* Un-register with Linux CryptoAPI */
crypto4xx_unregister_alg(core_dev->dev);
- mutex_destroy(&core_dev->rng_lock);
/* Free all allocated memory */
crypto4xx_stop_all(core_dev);
diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h
index 0d83cde84cca9a..d8224bbe89ca27 100644
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -14,10 +14,8 @@
#define __CRYPTO4XX_CORE_H__
#include <linux/ratelimit.h>
-#include <linux/mutex.h>
#include <linux/scatterlist.h>
#include <crypto/internal/aead.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
#include "crypto4xx_reg_def.h"
#include "crypto4xx_sa.h"
@@ -111,7 +109,6 @@ struct crypto4xx_core_device {
u32 irq;
struct tasklet_struct tasklet;
spinlock_t lock;
- struct mutex rng_lock;
};
struct crypto4xx_ctx {
@@ -135,7 +132,6 @@ struct crypto4xx_alg_common {
union {
struct skcipher_alg cipher;
struct aead_alg aead;
- struct rng_alg rng;
} u;
};
diff --git a/drivers/crypto/amcc/crypto4xx_reg_def.h b/drivers/crypto/amcc/crypto4xx_reg_def.h
index 1038061224da66..73d626308a8484 100644
--- a/drivers/crypto/amcc/crypto4xx_reg_def.h
+++ b/drivers/crypto/amcc/crypto4xx_reg_def.h
@@ -90,20 +90,9 @@
#define CRYPTO4XX_BYTE_ORDER_CFG 0x000600d8
#define CRYPTO4XX_ENDIAN_CFG 0x000600d8
-#define CRYPTO4XX_PRNG_STAT 0x00070000
-#define CRYPTO4XX_PRNG_STAT_BUSY 0x1
#define CRYPTO4XX_PRNG_CTRL 0x00070004
#define CRYPTO4XX_PRNG_SEED_L 0x00070008
#define CRYPTO4XX_PRNG_SEED_H 0x0007000c
-
-#define CRYPTO4XX_PRNG_RES_0 0x00070020
-#define CRYPTO4XX_PRNG_RES_1 0x00070024
-#define CRYPTO4XX_PRNG_RES_2 0x00070028
-#define CRYPTO4XX_PRNG_RES_3 0x0007002C
-
-#define CRYPTO4XX_PRNG_LFSR_L 0x00070030
-#define CRYPTO4XX_PRNG_LFSR_H 0x00070034
-
/*
* Initialize CRYPTO ENGINE registers, and memory bases.
*/
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0338/1266] crypto: hisi-trng - Remove crypto_rng interface
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0337/1266] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0339/1266] bpf: Support for hardening against JIT spraying Greg Kroah-Hartman
` (660 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 216a7795ec210bdabd5dad42323eee70bbfc8d90 upstream.
drivers/crypto/hisilicon/trng/trng.c exposes the same hardware through
two completely separate interfaces, crypto_rng and hwrng. However, the
implementation of this is buggy because it permits generation operations
from these interfaces to run concurrently with each other, accessing the
same registers. That is, hisi_trng_generate() synchronizes with itself
but not with hisi_trng_read(). This results in potential repetition of
output from the RNG, output of non-random values, etc.
Fortunately, there's actually no point in hardware RNG drivers
implementing the crypto_rng interface. It's not actually used by
anything besides the "rng" algorithm type of AF_ALG, which in turn is
not actually used in practice. Other crypto_rng hardware drivers are
likewise being phased out, leaving just the hwrng support.
Thus, remove it to simplify the code and avoid conflict (and confusion)
with the hwrng interface which is the one that actually matters.
Fixes: e4d9d10ef4be ("crypto: hisilicon/trng - add support for PRNG")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/Kconfig | 1 -
drivers/crypto/hisilicon/trng/trng.c | 298 +--------------------------
2 files changed, 2 insertions(+), 297 deletions(-)
diff --git a/drivers/crypto/hisilicon/Kconfig b/drivers/crypto/hisilicon/Kconfig
index 4137a8bf131f0c..107bfffaead2bd 100644
--- a/drivers/crypto/hisilicon/Kconfig
+++ b/drivers/crypto/hisilicon/Kconfig
@@ -79,6 +79,5 @@ config CRYPTO_DEV_HISI_TRNG
tristate "Support for HISI TRNG Driver"
depends on ARM64 && ACPI
select HW_RANDOM
- select CRYPTO_RNG
help
Support for HiSilicon TRNG Driver.
diff --git a/drivers/crypto/hisilicon/trng/trng.c b/drivers/crypto/hisilicon/trng/trng.c
index b2d9b5310b784c..6584ed051e0997 100644
--- a/drivers/crypto/hisilicon/trng/trng.c
+++ b/drivers/crypto/hisilicon/trng/trng.c
@@ -1,234 +1,27 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2019 HiSilicon Limited. */
-#include <crypto/internal/rng.h>
#include <linux/acpi.h>
-#include <linux/crypto.h>
#include <linux/err.h>
#include <linux/hw_random.h>
#include <linux/io.h>
#include <linux/iopoll.h>
#include <linux/kernel.h>
-#include <linux/list.h>
#include <linux/module.h>
-#include <linux/mutex.h>
#include <linux/platform_device.h>
#include <linux/random.h>
#define HISI_TRNG_REG 0x00F0
#define HISI_TRNG_BYTES 4
#define HISI_TRNG_QUALITY 512
-#define HISI_TRNG_VERSION 0x01B8
-#define HISI_TRNG_VER_V1 GENMASK(31, 0)
#define SLEEP_US 10
#define TIMEOUT_US 10000
-#define SW_DRBG_NUM_SHIFT 2
-#define SW_DRBG_KEY_BASE 0x082C
-#define SW_DRBG_SEED(n) (SW_DRBG_KEY_BASE - ((n) << SW_DRBG_NUM_SHIFT))
-#define SW_DRBG_SEED_REGS_NUM 12
-#define SW_DRBG_SEED_SIZE 48
-#define SW_DRBG_BLOCKS 0x0830
-#define SW_DRBG_INIT 0x0834
-#define SW_DRBG_GEN 0x083c
-#define SW_DRBG_STATUS 0x0840
-#define SW_DRBG_BLOCKS_NUM 4095
-#define SW_DRBG_DATA_BASE 0x0850
-#define SW_DRBG_DATA_NUM 4
-#define SW_DRBG_DATA(n) (SW_DRBG_DATA_BASE - ((n) << SW_DRBG_NUM_SHIFT))
-#define SW_DRBG_BYTES 16
-#define SW_DRBG_ENABLE_SHIFT 12
-#define SEED_SHIFT_24 24
-#define SEED_SHIFT_16 16
-#define SEED_SHIFT_8 8
-#define SW_MAX_RANDOM_BYTES 65520
-
-struct hisi_trng_list {
- struct mutex lock;
- struct list_head list;
- bool is_init;
-};
struct hisi_trng {
void __iomem *base;
- struct hisi_trng_list *trng_list;
- struct list_head list;
struct hwrng rng;
- u32 ver;
- u32 ctx_num;
- /* The bytes of the random number generated since the last seeding. */
- u32 random_bytes;
- struct mutex lock;
-};
-
-struct hisi_trng_ctx {
- struct hisi_trng *trng;
};
-static atomic_t trng_active_devs;
-static struct hisi_trng_list trng_devices;
-static int hisi_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait);
-
-static int hisi_trng_set_seed(struct hisi_trng *trng, const u8 *seed)
-{
- u32 val, seed_reg, i;
- int ret;
-
- writel(0x0, trng->base + SW_DRBG_BLOCKS);
-
- for (i = 0; i < SW_DRBG_SEED_SIZE;
- i += SW_DRBG_SEED_SIZE / SW_DRBG_SEED_REGS_NUM) {
- val = seed[i] << SEED_SHIFT_24;
- val |= seed[i + 1UL] << SEED_SHIFT_16;
- val |= seed[i + 2UL] << SEED_SHIFT_8;
- val |= seed[i + 3UL];
-
- seed_reg = (i >> SW_DRBG_NUM_SHIFT) % SW_DRBG_SEED_REGS_NUM;
- writel(val, trng->base + SW_DRBG_SEED(seed_reg));
- }
-
- writel(SW_DRBG_BLOCKS_NUM | (0x1 << SW_DRBG_ENABLE_SHIFT),
- trng->base + SW_DRBG_BLOCKS);
- writel(0x1, trng->base + SW_DRBG_INIT);
- ret = readl_relaxed_poll_timeout(trng->base + SW_DRBG_STATUS,
- val, val & BIT(0), SLEEP_US, TIMEOUT_US);
- if (ret) {
- pr_err("failed to init trng(%d)\n", ret);
- return -EIO;
- }
-
- trng->random_bytes = 0;
-
- return 0;
-}
-
-static int hisi_trng_seed(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen)
-{
- struct hisi_trng_ctx *ctx = crypto_rng_ctx(tfm);
- struct hisi_trng *trng = ctx->trng;
- int ret;
-
- if (slen < SW_DRBG_SEED_SIZE) {
- pr_err("slen(%u) is not matched with trng(%d)\n", slen,
- SW_DRBG_SEED_SIZE);
- return -EINVAL;
- }
-
- mutex_lock(&trng->lock);
- ret = hisi_trng_set_seed(trng, seed);
- mutex_unlock(&trng->lock);
-
- return ret;
-}
-
-static int hisi_trng_reseed(struct hisi_trng *trng)
-{
- u8 seed[SW_DRBG_SEED_SIZE];
- int size;
-
- if (!trng->random_bytes)
- return 0;
-
- size = hisi_trng_read(&trng->rng, seed, SW_DRBG_SEED_SIZE, false);
- if (size != SW_DRBG_SEED_SIZE)
- return -EIO;
-
- return hisi_trng_set_seed(trng, seed);
-}
-
-static int hisi_trng_get_bytes(struct hisi_trng *trng, u8 *dstn, unsigned int dlen)
-{
- u32 data[SW_DRBG_DATA_NUM];
- u32 currsize = 0;
- u32 val = 0;
- int ret;
- u32 i;
-
- ret = hisi_trng_reseed(trng);
- if (ret)
- return ret;
-
- do {
- ret = readl_relaxed_poll_timeout(trng->base + SW_DRBG_STATUS,
- val, val & BIT(1), SLEEP_US, TIMEOUT_US);
- if (ret) {
- pr_err("failed to generate random number(%d)!\n", ret);
- break;
- }
-
- for (i = 0; i < SW_DRBG_DATA_NUM; i++)
- data[i] = readl(trng->base + SW_DRBG_DATA(i));
-
- if (dlen - currsize >= SW_DRBG_BYTES) {
- memcpy(dstn + currsize, data, SW_DRBG_BYTES);
- currsize += SW_DRBG_BYTES;
- } else {
- memcpy(dstn + currsize, data, dlen - currsize);
- currsize = dlen;
- }
-
- trng->random_bytes += SW_DRBG_BYTES;
- writel(0x1, trng->base + SW_DRBG_GEN);
- } while (currsize < dlen);
-
- return ret;
-}
-
-static int hisi_trng_generate(struct crypto_rng *tfm, const u8 *src,
- unsigned int slen, u8 *dstn, unsigned int dlen)
-{
- struct hisi_trng_ctx *ctx = crypto_rng_ctx(tfm);
- struct hisi_trng *trng = ctx->trng;
- unsigned int currsize = 0;
- unsigned int block_size;
- int ret;
-
- if (!dstn || !dlen) {
- pr_err("output is error, dlen %u!\n", dlen);
- return -EINVAL;
- }
-
- do {
- block_size = min_t(unsigned int, dlen - currsize, SW_MAX_RANDOM_BYTES);
- mutex_lock(&trng->lock);
- ret = hisi_trng_get_bytes(trng, dstn + currsize, block_size);
- mutex_unlock(&trng->lock);
- if (ret)
- return ret;
- currsize += block_size;
- } while (currsize < dlen);
-
- return 0;
-}
-
-static int hisi_trng_init(struct crypto_tfm *tfm)
-{
- struct hisi_trng_ctx *ctx = crypto_tfm_ctx(tfm);
- struct hisi_trng *trng;
- u32 ctx_num = ~0;
-
- mutex_lock(&trng_devices.lock);
- list_for_each_entry(trng, &trng_devices.list, list) {
- if (trng->ctx_num < ctx_num) {
- ctx_num = trng->ctx_num;
- ctx->trng = trng;
- }
- }
- ctx->trng->ctx_num++;
- mutex_unlock(&trng_devices.lock);
-
- return 0;
-}
-
-static void hisi_trng_exit(struct crypto_tfm *tfm)
-{
- struct hisi_trng_ctx *ctx = crypto_tfm_ctx(tfm);
-
- mutex_lock(&trng_devices.lock);
- ctx->trng->ctx_num--;
- mutex_unlock(&trng_devices.lock);
-}
-
static int hisi_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
{
struct hisi_trng *trng;
@@ -260,42 +53,6 @@ static int hisi_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
return currsize;
}
-static struct rng_alg hisi_trng_alg = {
- .generate = hisi_trng_generate,
- .seed = hisi_trng_seed,
- .seedsize = SW_DRBG_SEED_SIZE,
- .base = {
- .cra_name = "stdrng",
- .cra_driver_name = "hisi_stdrng",
- .cra_priority = 300,
- .cra_ctxsize = sizeof(struct hisi_trng_ctx),
- .cra_module = THIS_MODULE,
- .cra_init = hisi_trng_init,
- .cra_exit = hisi_trng_exit,
- },
-};
-
-static void hisi_trng_add_to_list(struct hisi_trng *trng)
-{
- mutex_lock(&trng_devices.lock);
- list_add_tail(&trng->list, &trng_devices.list);
- mutex_unlock(&trng_devices.lock);
-}
-
-static int hisi_trng_del_from_list(struct hisi_trng *trng)
-{
- int ret = -EBUSY;
-
- mutex_lock(&trng_devices.lock);
- if (!trng->ctx_num) {
- list_del(&trng->list);
- ret = 0;
- }
- mutex_unlock(&trng_devices.lock);
-
- return ret;
-}
-
static int hisi_trng_probe(struct platform_device *pdev)
{
struct hisi_trng *trng;
@@ -305,70 +62,20 @@ static int hisi_trng_probe(struct platform_device *pdev)
if (!trng)
return -ENOMEM;
- platform_set_drvdata(pdev, trng);
-
trng->base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(trng->base))
return PTR_ERR(trng->base);
- trng->ctx_num = 0;
- trng->random_bytes = SW_MAX_RANDOM_BYTES;
- mutex_init(&trng->lock);
- trng->ver = readl(trng->base + HISI_TRNG_VERSION);
- if (!trng_devices.is_init) {
- INIT_LIST_HEAD(&trng_devices.list);
- mutex_init(&trng_devices.lock);
- trng_devices.is_init = true;
- }
-
- hisi_trng_add_to_list(trng);
- if (trng->ver != HISI_TRNG_VER_V1 &&
- atomic_inc_return(&trng_active_devs) == 1) {
- ret = crypto_register_rng(&hisi_trng_alg);
- if (ret) {
- dev_err(&pdev->dev,
- "failed to register crypto(%d)\n", ret);
- atomic_dec_return(&trng_active_devs);
- goto err_remove_from_list;
- }
- }
-
trng->rng.name = pdev->name;
trng->rng.read = hisi_trng_read;
trng->rng.quality = HISI_TRNG_QUALITY;
+
ret = devm_hwrng_register(&pdev->dev, &trng->rng);
- if (ret) {
+ if (ret)
dev_err(&pdev->dev, "failed to register hwrng: %d!\n", ret);
- goto err_crypto_unregister;
- }
-
- return ret;
-
-err_crypto_unregister:
- if (trng->ver != HISI_TRNG_VER_V1 &&
- atomic_dec_return(&trng_active_devs) == 0)
- crypto_unregister_rng(&hisi_trng_alg);
-
-err_remove_from_list:
- hisi_trng_del_from_list(trng);
return ret;
}
-static int hisi_trng_remove(struct platform_device *pdev)
-{
- struct hisi_trng *trng = platform_get_drvdata(pdev);
-
- /* Wait until the task is finished */
- while (hisi_trng_del_from_list(trng))
- ;
-
- if (trng->ver != HISI_TRNG_VER_V1 &&
- atomic_dec_return(&trng_active_devs) == 0)
- crypto_unregister_rng(&hisi_trng_alg);
-
- return 0;
-}
-
static const struct acpi_device_id hisi_trng_acpi_match[] = {
{ "HISI02B3", 0 },
{ }
@@ -377,7 +84,6 @@ MODULE_DEVICE_TABLE(acpi, hisi_trng_acpi_match);
static struct platform_driver hisi_trng_driver = {
.probe = hisi_trng_probe,
- .remove = hisi_trng_remove,
.driver = {
.name = "hisi-trng-v2",
.acpi_match_table = ACPI_PTR(hisi_trng_acpi_match),
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0339/1266] bpf: Support for hardening against JIT spraying
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0338/1266] crypto: hisi-trng - Remove crypto_rng interface Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0340/1266] x86/bugs: Enable IBPB flush on BPF JIT allocation Greg Kroah-Hartman
` (659 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 upstream.
The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 10 ++++++++++
kernel/bpf/core.c | 19 +++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 30fe140d488882..72926bc394ad56 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -22,6 +22,7 @@
#include <linux/vmalloc.h>
#include <linux/sockptr.h>
#include <crypto/sha1.h>
+#include <linux/static_call.h>
#include <linux/u64_stats_sync.h>
#include <net/sch_generic.h>
@@ -1041,6 +1042,15 @@ extern long bpf_jit_limit_max;
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+/*
+ * Flush the indirect branch predictors before reusing JIT memory, so that
+ * indirect jumps into a newly written program don't reuse predictions left
+ * behind by an old program that occupied the same space.
+ */
+void bpf_arch_pred_flush(void);
+DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush);
+DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
+
void bpf_jit_fill_hole_with_zero(void *area, unsigned int size);
struct bpf_binary_header *
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d708cf3e6207f9..0d8008711629c5 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -37,6 +37,7 @@
#include <linux/nospec.h>
#include <linux/bpf_mem_alloc.h>
#include <linux/memcontrol.h>
+#include <linux/static_call.h>
#include <asm/barrier.h>
#include <asm/unaligned.h>
@@ -858,6 +859,15 @@ void bpf_jit_fill_hole_with_zero(void *area, unsigned int size)
memset(area, 0, size);
}
+DEFINE_STATIC_CALL_NULL(bpf_arch_pred_flush, bpf_arch_pred_flush);
+
+/*
+ * Enabled once bpf_arch_pred_flush points at a real flush routine. Lets the
+ * pack allocator test "is a predictor flush wired up at all" with a cheap
+ * static branch instead of repeatedly querying the static call target.
+ */
+DEFINE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
+
#define BPF_PROG_SIZE_TO_NBITS(size) (round_up(size, BPF_PROG_CHUNK_SIZE) / BPF_PROG_CHUNK_SIZE)
static DEFINE_MUTEX(pack_mutex);
@@ -910,6 +920,14 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
mutex_lock(&pack_mutex);
if (size > BPF_PROG_PACK_SIZE) {
+ /*
+ * Allocations larger than a pack get their own pages, and
+ * predictors are not flushed for such allocation. This is only
+ * safe because cBPF programs (the unprivileged attack surface)
+ * are bounded well below a pack size.
+ */
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
size = round_up(size, PAGE_SIZE);
ptr = bpf_jit_alloc_exec(size);
if (ptr) {
@@ -933,6 +951,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
pos = 0;
found_free_area:
+ static_call_cond(bpf_arch_pred_flush)();
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0340/1266] x86/bugs: Enable IBPB flush on BPF JIT allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0339/1266] bpf: Support for hardening against JIT spraying Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0341/1266] bpf: Restrict JIT predictor flush to cBPF Greg Kroah-Hartman
` (658 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Dave Hansen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream.
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
[ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable
moved to spectre_v2_select_mitigation() because there is no
spectre_v2_apply_mitigation()]
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/nospec-branch.h | 4 +++
arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++---
2 files changed, 49 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index fb469ace38393f..c7d019b0ef4aa5 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -418,6 +418,10 @@ extern void srso_alias_untrain_ret(void);
extern void entry_untrain_ret(void);
extern void entry_ibpb(void);
+#ifdef CONFIG_BPF_JIT
+extern void bpf_arch_ibpb(void);
+#endif
+
#ifdef CONFIG_X86_64
extern void clear_bhb_loop(void);
#endif
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index ef1d3a5024ed4b..32a27c19acde57 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -16,6 +16,7 @@
#include <linux/sched/smt.h>
#include <linux/pgtable.h>
#include <linux/bpf.h>
+#include <linux/filter.h>
#include <asm/spec-ctrl.h>
#include <asm/cmdline.h>
@@ -1360,8 +1361,21 @@ static inline const char *spectre_v2_module_string(void)
{
return spectre_v2_bad_module ? " - vulnerable module loaded" : "";
}
+
+/*
+ * The "retpoline sequence" is the "call;mov;ret" sequence that
+ * replaces normal indirect branch instructions. Differentiate
+ * *the* retpoline sequence from the LFENCE-prefixed indirect
+ * branches that simply use the retpoline infrastructure.
+ */
+static inline bool retpoline_seq_enabled(void)
+{
+ return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE);
+}
+
#else
static inline const char *spectre_v2_module_string(void) { return ""; }
+static inline bool retpoline_seq_enabled(void) { return false; }
#endif
#define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n"
@@ -1835,8 +1849,7 @@ static void __init bhi_select_mitigation(void)
return;
/* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */
- if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
- !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) {
+ if (retpoline_seq_enabled()) {
spec_ctrl_disable_kernel_rrsba();
if (rrsba_disabled)
return;
@@ -1858,6 +1871,27 @@ static void __init bhi_select_mitigation(void)
pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n");
}
+#ifdef CONFIG_BPF_JIT
+static void __bpf_arch_ibpb(void *unused)
+{
+ entry_ibpb();
+}
+
+void bpf_arch_ibpb(void)
+{
+ on_each_cpu(__bpf_arch_ibpb, NULL, 1);
+}
+
+static bool __init cpu_wants_ibpb_bpf(void)
+{
+ /* A genuine retpoline already neutralizes ring0 indirect predictions */
+ if (retpoline_seq_enabled())
+ return false;
+
+ return boot_cpu_has(X86_FEATURE_IBPB);
+}
+#endif
+
static void __init spectre_v2_select_mitigation(void)
{
enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -2041,6 +2075,14 @@ static void __init spectre_v2_select_mitigation(void)
pr_info("Enabling Restricted Speculation for firmware calls\n");
}
+#ifdef CONFIG_BPF_JIT
+ if (cpu_wants_ibpb_bpf()) {
+ static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb);
+ static_branch_enable(&bpf_pred_flush_enabled);
+ pr_info("Enabling IBPB for BPF\n");
+ }
+#endif
+
/* Set up IBPB and STIBP depending on the general spectre V2 command */
spectre_v2_cmd = cmd;
}
@@ -3210,9 +3252,7 @@ static const char *spectre_bhi_state(void)
return "; BHI: BHI_DIS_S";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP))
return "; BHI: SW loop, KVM: SW loop";
- else if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
- !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) &&
- rrsba_disabled)
+ else if (retpoline_seq_enabled() && rrsba_disabled)
return "; BHI: Retpoline";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT))
return "; BHI: Vulnerable, KVM: SW loop";
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0341/1266] bpf: Restrict JIT predictor flush to cBPF
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0340/1266] x86/bugs: Enable IBPB flush on BPF JIT allocation Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0342/1266] bpf: Skip redundant IBPB in pack allocator Greg Kroah-Hartman
` (657 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit 0bb99f2cfaae6822d734d69722de30af823efdf3 upstream.
Currently predictor flush on memory reuse is done for all BPF JIT
allocations, but only cBPF programs can be loaded by an unprivileged user.
eBPF is privileged by default, and flushing predictors for all CPUs on
every eBPF reuse penalizes the common case for no security benefit.
eBPF allocations can be frequent on busy systems, only flush predictors
for cBPF programs. Trampoline and dispatcher allocations also skip the
flush as they are eBPF-only.
[pawan: backport dropped "was_classic" hunk for arches that do not
support pack allocator]
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/net/bpf_jit_core.c | 3 ++-
arch/x86/net/bpf_jit_comp.c | 3 ++-
include/linux/filter.h | 5 +++--
kernel/bpf/core.c | 13 ++++++++-----
kernel/bpf/dispatcher.c | 2 +-
5 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index 7b70ccb7fec345..8d8c5eb2e8dacb 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -123,7 +123,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_jit_binary_pack_alloc(prog_size + extable_size,
&jit_data->ro_image, sizeof(u32),
&jit_data->header, &jit_data->image,
- bpf_fill_ill_insns);
+ bpf_fill_ill_insns,
+ bpf_prog_was_classic(prog));
if (!jit_data->ro_header) {
prog = orig_prog;
goto out_offset;
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 0be138fbd0a058..8028a5a4ab6457 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -2927,7 +2927,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* allocate module memory for x86 insns and extable */
header = bpf_jit_binary_pack_alloc(roundup(proglen, align) + extable_size,
&image, align, &rw_header, &rw_image,
- jit_fill_hole);
+ jit_fill_hole,
+ bpf_prog_was_classic(prog));
if (!header) {
prog = orig_prog;
goto out_addrs;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 72926bc394ad56..f2e351cc543d62 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1065,7 +1065,7 @@ void bpf_jit_free(struct bpf_prog *fp);
struct bpf_binary_header *
bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);
-void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns);
+void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic);
void bpf_prog_pack_free(struct bpf_binary_header *hdr);
static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp)
@@ -1079,7 +1079,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image,
unsigned int alignment,
struct bpf_binary_header **rw_hdr,
u8 **rw_image,
- bpf_jit_fill_hole_t bpf_fill_ill_insns);
+ bpf_jit_fill_hole_t bpf_fill_ill_insns,
+ bool was_classic);
int bpf_jit_binary_pack_finalize(struct bpf_prog *prog,
struct bpf_binary_header *ro_header,
struct bpf_binary_header *rw_header);
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 0d8008711629c5..509f1b9c2b2e28 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -911,7 +911,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
return pack;
}
-void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
+void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic)
{
unsigned int nbits = BPF_PROG_SIZE_TO_NBITS(size);
struct bpf_prog_pack *pack;
@@ -926,7 +926,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
* safe because cBPF programs (the unprivileged attack surface)
* are bounded well below a pack size.
*/
- if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ if (was_classic && static_branch_unlikely(&bpf_pred_flush_enabled))
pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
size = round_up(size, PAGE_SIZE);
ptr = bpf_jit_alloc_exec(size);
@@ -951,7 +951,9 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
pos = 0;
found_free_area:
- static_call_cond(bpf_arch_pred_flush)();
+ /* Flush only for cBPF as it may contain a crafted gadget */
+ if (static_branch_unlikely(&bpf_pred_flush_enabled) && was_classic)
+ static_call_cond(bpf_arch_pred_flush)();
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
@@ -1111,7 +1113,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,
unsigned int alignment,
struct bpf_binary_header **rw_header,
u8 **rw_image,
- bpf_jit_fill_hole_t bpf_fill_ill_insns)
+ bpf_jit_fill_hole_t bpf_fill_ill_insns,
+ bool was_classic)
{
struct bpf_binary_header *ro_header;
u32 size, hole, start;
@@ -1124,7 +1127,7 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,
if (bpf_jit_charge_modmem(size))
return NULL;
- ro_header = bpf_prog_pack_alloc(size, bpf_fill_ill_insns);
+ ro_header = bpf_prog_pack_alloc(size, bpf_fill_ill_insns, was_classic);
if (!ro_header) {
bpf_jit_uncharge_modmem(size);
return NULL;
diff --git a/kernel/bpf/dispatcher.c b/kernel/bpf/dispatcher.c
index fa3e9225aedc0a..b3f164e31c6bb4 100644
--- a/kernel/bpf/dispatcher.c
+++ b/kernel/bpf/dispatcher.c
@@ -145,7 +145,7 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
mutex_lock(&d->mutex);
if (!d->image) {
- d->image = bpf_prog_pack_alloc(PAGE_SIZE, bpf_jit_fill_hole_with_zero);
+ d->image = bpf_prog_pack_alloc(PAGE_SIZE, bpf_jit_fill_hole_with_zero, false);
if (!d->image)
goto out;
d->rw_image = bpf_jit_alloc_exec(PAGE_SIZE);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0342/1266] bpf: Skip redundant IBPB in pack allocator
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0341/1266] bpf: Restrict JIT predictor flush to cBPF Greg Kroah-Hartman
@ 2026-07-21 15:12 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0343/1266] bpf: Prefer packs that wont trigger an IBPB flush on allocation Greg Kroah-Hartman
` (656 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit a23c1c5396a91680703360d1ee28a44657c503c4 upstream.
bpf_prog_pack_alloc() issues IBPB on all CPUs on every cBPF allocation,
even when reusing chunks from an existing pack where no new memory was
touched since the last IBPB.
Since IBPB on all CPUs is heavy, Dave Hansen suggested to track allocation
since last IBPB, and only issue IBPB at reuse for the chunks that have not
seen an IBPB since they were last freed.
Track per-pack whether an IBPB is needed via arch_flush_needed. Set it when
allocating a chunk, reset on IBPB flush. On reuse, conditionally issue the
flush. Since IBPB invalidates all BTB entries, clear the flag on all packs
after flushing.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 509f1b9c2b2e28..a2e5684d623996 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -851,6 +851,7 @@ int bpf_jit_add_poke_descriptor(struct bpf_prog *prog,
struct bpf_prog_pack {
struct list_head list;
void *ptr;
+ bool arch_flush_needed;
unsigned long bitmap[];
};
@@ -906,6 +907,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
bitmap_zero(pack->bitmap, BPF_PROG_PACK_SIZE / BPF_PROG_CHUNK_SIZE);
list_add_tail(&pack->list, &pack_list);
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pack->arch_flush_needed = true;
set_vm_flush_reset_perms(pack->ptr);
set_memory_rox((unsigned long)pack->ptr, BPF_PROG_PACK_SIZE / PAGE_SIZE);
return pack;
@@ -952,8 +955,15 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
found_free_area:
/* Flush only for cBPF as it may contain a crafted gadget */
- if (static_branch_unlikely(&bpf_pred_flush_enabled) && was_classic)
+ if (static_branch_unlikely(&bpf_pred_flush_enabled) &&
+ pack->arch_flush_needed &&
+ was_classic) {
+ struct bpf_prog_pack *p;
+
static_call_cond(bpf_arch_pred_flush)();
+ list_for_each_entry(p, &pack_list, list)
+ p->arch_flush_needed = false;
+ }
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
@@ -991,6 +1001,9 @@ void bpf_prog_pack_free(struct bpf_binary_header *hdr)
"bpf_prog_pack bug: missing bpf_arch_text_invalidate?\n");
bitmap_clear(pack->bitmap, pos, nbits);
+
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pack->arch_flush_needed = true;
if (bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
BPF_PROG_CHUNK_COUNT, 0) == 0) {
list_del(&pack->list);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0343/1266] bpf: Prefer packs that wont trigger an IBPB flush on allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-07-21 15:12 ` [PATCH 6.6 0342/1266] bpf: Skip redundant IBPB in pack allocator Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0344/1266] bpf: Prefer dirty packs for eBPF allocations Greg Kroah-Hartman
` (655 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit a9b1f19a6a673ba06820898d0f1ad02883ea1639 upstream.
Currently BPF pack allocator picks the chunks from the first available
pack. While this is okay, it naturally leads to more frequent flushes
when there are multiple packs in the system that weren't used since the
last flush.
As an optimization prefer allocating the new programs from packs that
are unused since last flush. When all packs are dirty, allocation forces
a flush and marks all packs clean.
Below are some future optimizations ideas:
1. Currently, the "dirty" tracking is only done at the pack-level.
Flush frequency can further be reduced with chunk-level tracking.
This requires a new bitmap per-pack to track the dirty state.
2. IBPB flush is done on all CPUs, even if only a single CPU ran the
BPF program. On a system with hundreds of CPUs this could be a
major bottleneck forcing hundreds of IPIs to deliver the flush.
The solution is to track the CPUs where a BPF program ran, and
issue IBPB only on those CPUs.
3. Avoid IBPB when flush is already done at other sources (e.g.
context switch).
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index a2e5684d623996..7dc59570cd25a5 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -917,8 +917,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic)
{
unsigned int nbits = BPF_PROG_SIZE_TO_NBITS(size);
- struct bpf_prog_pack *pack;
- unsigned long pos;
+ struct bpf_prog_pack *pack, *fallback_pack = NULL;
+ unsigned long pos, fallback_pos = 0;
void *ptr = NULL;
mutex_lock(&pack_mutex);
@@ -943,8 +943,29 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
list_for_each_entry(pack, &pack_list, list) {
pos = bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
nbits, 0);
- if (pos < BPF_PROG_CHUNK_COUNT)
+ if (pos >= BPF_PROG_CHUNK_COUNT)
+ continue;
+ /* Flush not enabled, use any pack */
+ if (!static_branch_unlikely(&bpf_pred_flush_enabled))
goto found_free_area;
+ /*
+ * cBPF reuse of a dirty pack triggers a flush, so prefer a
+ * clean pack for cBPF. eBPF never flushes, so pick the first
+ * free pack, dirty or clean.
+ */
+ if (!was_classic || !pack->arch_flush_needed)
+ goto found_free_area;
+ if (!fallback_pack) {
+ fallback_pack = pack;
+ fallback_pos = pos;
+ }
+ }
+
+ /* No preferred pack found */
+ if (fallback_pack) {
+ pack = fallback_pack;
+ pos = fallback_pos;
+ goto found_free_area;
}
pack = alloc_new_pack(bpf_fill_ill_insns);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0344/1266] bpf: Prefer dirty packs for eBPF allocations
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0343/1266] bpf: Prefer packs that wont trigger an IBPB flush on allocation Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0345/1266] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
` (654 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Daniel Borkmann,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit b72e29e0f7ee329d89f86db8700c8ea99b4a370a upstream.
The pack allocator only flushes predictors when reusing a dirty pack for
cBPF, eBPF allocations never trigger a flush. Currently, eBPF picks the
first free pack, which could be a clean pack. As an optimization, leaving
a clean pack for cBPF can avoid flushes.
Prefer dirty packs for eBPF and keep clean packs free for cBPF. This
mirrors the existing cBPF preference for clean packs: each program kind
prefers the pack that avoids an extra flush, and falls back to the other
kind only when no preferred pack has room. eBPF reuse of a dirty pack is
harmless since eBPF being privileged does not flush.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 7dc59570cd25a5..4669a57265ad75 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -950,10 +950,10 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
goto found_free_area;
/*
* cBPF reuse of a dirty pack triggers a flush, so prefer a
- * clean pack for cBPF. eBPF never flushes, so pick the first
- * free pack, dirty or clean.
+ * clean pack for cBPF. eBPF never flushes, so steer it to a
+ * dirty pack and keep clean packs free for cBPF.
*/
- if (!was_classic || !pack->arch_flush_needed)
+ if (was_classic ^ pack->arch_flush_needed)
goto found_free_area;
if (!fallback_pack) {
fallback_pack = pack;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0345/1266] media: uvcvideo: Avoid partial metadata buffers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0344/1266] bpf: Prefer dirty packs for eBPF allocations Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0346/1266] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
` (653 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Hans de Goede,
Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit a15b773fe4ffa450b56347cc506b2d1405600f5d upstream.
If the metadata queue that is empty receives a new buffer while we are
in the middle of processing a frame, the first metadata buffer will
contain partial information.
Avoid this by tracking the state of the metadata buffer and making sure
that it is in sync with the data buffer.
Now that we are at it, make sure that we skip buffers of size 1 or 0.
They are not allowed by the spec... but it is a simple check to add and
better be safe than sorry.
Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260417-uvc-meta-partial-v2-2-31d274af7d2d@chromium.org
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1122,7 +1122,9 @@ static void uvc_video_stats_stop(struct
* uvc_video_decode_end will never be called with a NULL buffer.
*/
static int uvc_video_decode_start(struct uvc_streaming *stream,
- struct uvc_buffer *buf, const u8 *data, int len)
+ struct uvc_buffer *buf,
+ struct uvc_buffer *meta_buf,
+ const u8 *data, int len)
{
u8 header_len;
u8 fid;
@@ -1195,6 +1197,8 @@ static int uvc_video_decode_start(struct
/* TODO: Handle PTS and SCR. */
buf->state = UVC_BUF_STATE_ACTIVE;
+ if (meta_buf)
+ meta_buf->state = UVC_BUF_STATE_ACTIVE;
}
/*
@@ -1411,7 +1415,7 @@ static void uvc_video_decode_meta(struct
ktime_t time;
const u8 *scr;
- if (!meta_buf || length == 2)
+ if (length <= 2 || !meta_buf || meta_buf->state != UVC_BUF_STATE_ACTIVE)
return;
has_pts = mem[1] & UVC_STREAM_PTS;
@@ -1528,7 +1532,7 @@ static void uvc_video_decode_isoc(struct
/* Decode the payload header. */
mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
do {
- ret = uvc_video_decode_start(stream, buf, mem,
+ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
urb->iso_frame_desc[i].actual_length);
if (ret == -EAGAIN)
uvc_video_next_buffers(stream, &buf, &meta_buf);
@@ -1577,7 +1581,8 @@ static void uvc_video_decode_bulk(struct
*/
if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) {
do {
- ret = uvc_video_decode_start(stream, buf, mem, len);
+ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
+ len);
if (ret == -EAGAIN)
uvc_video_next_buffers(stream, &buf, &meta_buf);
} while (ret == -EAGAIN);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0346/1266] media: uvcvideo: Fix buffer sequence in frame gaps
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0345/1266] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0347/1266] media: uvcvideo: Fix sequence number when no EOF Greg Kroah-Hartman
` (652 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ricardo Ribalda,
Hans de Goede, Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit 2f24ac8dd87983a55f0498898f34a5f2b735b802 upstream.
In UVC, the FID flips with every frame. For every FID flip, we increase
the stream sequence number.
Now, if a FID flips multiple times and there is no data transferred between
the flips, the buffer sequence number will be set to the value of the
stream sequence number after the first flip.
Userspace uses the buffer sequence number to determine if there have been
missing frames. With the current behaviour, userspace will think that the
gap is in the wrong location.
This patch modifies uvc_video_decode_start() to provide the correct buffer
sequence number and timestamp.
Cc: stable@kernel.org
Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1151,6 +1151,19 @@ static int uvc_video_decode_start(struct
stream->sequence++;
if (stream->sequence)
uvc_video_stats_update(stream);
+
+ /*
+ * On a FID flip initialize sequence number and timestamp.
+ *
+ * The driver already takes care of injecting FID flips for
+ * UVC_QUIRK_STREAM_NO_FID and UVC_QUIRK_MJPEG_NO_EOF.
+ */
+ if (buf) {
+ buf->buf.field = V4L2_FIELD_NONE;
+ buf->buf.sequence = stream->sequence;
+ buf->buf.vb2_buf.timestamp =
+ ktime_to_ns(uvc_video_get_time());
+ }
}
uvc_video_clock_decode(stream, buf, data, len);
@@ -1191,10 +1204,6 @@ static int uvc_video_decode_start(struct
return -ENODATA;
}
- buf->buf.field = V4L2_FIELD_NONE;
- buf->buf.sequence = stream->sequence;
- buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time());
-
/* TODO: Handle PTS and SCR. */
buf->state = UVC_BUF_STATE_ACTIVE;
if (meta_buf)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0347/1266] media: uvcvideo: Fix sequence number when no EOF
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0346/1266] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0348/1266] dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties Greg Kroah-Hartman
` (651 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Hans de Goede,
Ricardo Ribalda, Laurent Pinchart, Hans de Goede, Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit f078966ca1fb1b3865d8e6bbe2705cfd277fc637 upstream.
If the driver could not detect the EOF, the sequence number is increased
twice:
1) When we enter uvc_video_decode_start() with the old buffer and FID has
flipped => We return -EAGAIN and last_fid is not flipped
2) When we enter uvc_video_decode_start() with the new buffer.
Fix this issue by moving the new frame detection logic earlier in
uvc_video_decode_start().
This also has some nice side affects:
- The error status from the new packet will no longer get propagated
to the previous frame-buffer.
- uvc_video_clock_decode() will no longer update the previous frame
buf->stf with info from the new packet.
- uvc_video_clock_decode() and uvc_video_stats_decode() will no longer
get called twice for the same packet.
Cc: stable@kernel.org
Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost")
Reported-by: Hans de Goede <hansg@kernel.org>
Closes: https://lore.kernel.org/linux-media/CANiDSCuj4cPuB5_v2xyvAagA5FjoN8V5scXiFFOeD3aKDMqkCg@mail.gmail.com/T/#me39fb134e8c2c085567a31548c3403eb639625e4
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 92 +++++++++++++++++++-------------------
1 file changed, 47 insertions(+), 45 deletions(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1144,6 +1144,53 @@ static int uvc_video_decode_start(struct
fid = data[1] & UVC_STREAM_FID;
/*
+ * Mark the buffer as done if we're at the beginning of a new frame.
+ * End of frame detection is better implemented by checking the EOF
+ * bit (FID bit toggling is delayed by one frame compared to the EOF
+ * bit), but some devices don't set the bit at end of frame (and the
+ * last payload can be lost anyway). We thus must check if the FID has
+ * been toggled.
+ *
+ * stream->last_fid is initialized to -1, and buf->bytesused to 0,
+ * so the first isochronous frame will never trigger an end of frame
+ * detection.
+ *
+ * Empty buffers (bytesused == 0) don't trigger end of frame detection
+ * as it doesn't make sense to return an empty buffer. This also
+ * avoids detecting end of frame conditions at FID toggling if the
+ * previous payload had the EOF bit set.
+ */
+ if (fid != stream->last_fid && buf && buf->bytesused != 0) {
+ uvc_dbg(stream->dev, FRAME,
+ "Frame complete (FID bit toggled)\n");
+ buf->state = UVC_BUF_STATE_READY;
+
+ return -EAGAIN;
+ }
+
+ /*
+ * Some cameras, when running two parallel streams (one MJPEG alongside
+ * another non-MJPEG stream), are known to lose the EOF packet for a frame.
+ * We can detect the end of a frame by checking for a new SOI marker, as
+ * the SOI always lies on the packet boundary between two frames for
+ * these devices.
+ */
+ if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF &&
+ (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG ||
+ stream->cur_format->fcc == V4L2_PIX_FMT_JPEG) &&
+ buf && buf->bytesused != 0) {
+ const u8 *packet = data + header_len;
+
+ if (len >= header_len + 2 &&
+ packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI) {
+ buf->state = UVC_BUF_STATE_READY;
+ buf->error = 1;
+ stream->last_fid ^= UVC_STREAM_FID;
+ return -EAGAIN;
+ }
+ }
+
+ /*
* Increase the sequence number regardless of any buffer states, so
* that discontinuous sequence numbers always indicate lost frames.
*/
@@ -1210,51 +1257,6 @@ static int uvc_video_decode_start(struct
meta_buf->state = UVC_BUF_STATE_ACTIVE;
}
- /*
- * Mark the buffer as done if we're at the beginning of a new frame.
- * End of frame detection is better implemented by checking the EOF
- * bit (FID bit toggling is delayed by one frame compared to the EOF
- * bit), but some devices don't set the bit at end of frame (and the
- * last payload can be lost anyway). We thus must check if the FID has
- * been toggled.
- *
- * stream->last_fid is initialized to -1, so the first isochronous
- * frame will never trigger an end of frame detection.
- *
- * Empty buffers (bytesused == 0) don't trigger end of frame detection
- * as it doesn't make sense to return an empty buffer. This also
- * avoids detecting end of frame conditions at FID toggling if the
- * previous payload had the EOF bit set.
- */
- if (fid != stream->last_fid && buf->bytesused != 0) {
- uvc_dbg(stream->dev, FRAME,
- "Frame complete (FID bit toggled)\n");
- buf->state = UVC_BUF_STATE_READY;
- return -EAGAIN;
- }
-
- /*
- * Some cameras, when running two parallel streams (one MJPEG alongside
- * another non-MJPEG stream), are known to lose the EOF packet for a frame.
- * We can detect the end of a frame by checking for a new SOI marker, as
- * the SOI always lies on the packet boundary between two frames for
- * these devices.
- */
- if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF &&
- (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG ||
- stream->cur_format->fcc == V4L2_PIX_FMT_JPEG)) {
- const u8 *packet = data + header_len;
-
- if (len >= header_len + 2 &&
- packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI &&
- buf->bytesused != 0) {
- buf->state = UVC_BUF_STATE_READY;
- buf->error = 1;
- stream->last_fid ^= UVC_STREAM_FID;
- return -EAGAIN;
- }
- }
-
stream->last_fid = fid;
return header_len;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0348/1266] dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0347/1266] media: uvcvideo: Fix sequence number when no EOF Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0349/1266] dt-bindings: power: imx93: Add MIPI PHY power domain Greg Kroah-Hartman
` (650 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Rob Herring (Arm),
Jernej Skrabec, Nicolas Dufresne, Hans Verkuil
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@kernel.org>
commit 018f2dc3a42098d3b04edd1480adc51d268adb14 upstream.
The Allwinner video engine sits behind the MBUS that is represented as
an interconnect.
Make sure that the interconnect properties are valid in the binding.
Fixes: d41662e52a03 ("media: dt-bindings: media: allwinner,sun4i-a10-video-engine: Add R40 compatible")
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml
+++ b/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml
@@ -63,6 +63,16 @@ properties:
CMA pool to use for buffers allocation instead of the default
CMA pool.
+ # FIXME: This should be made required eventually once every SoC will
+ # have the MBUS declared.
+ interconnects:
+ maxItems: 1
+
+ # FIXME: This should be made required eventually once every SoC will
+ # have the MBUS declared.
+ interconnect-names:
+ const: dma-mem
+
required:
- compatible
- reg
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0349/1266] dt-bindings: power: imx93: Add MIPI PHY power domain
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0348/1266] dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0350/1266] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
` (649 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoniu Zhou, Frank Li,
Krzysztof Kozlowski, Peng Fan, Ulf Hansson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
commit 6aa38ef0eab32df5409b72d62509de6ba09cea50 upstream.
Add MIPI PHY power domain for shared PHY resources used by both
MIPI DSI and CSI blocks.
Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Fixes: e9aa77d413c9 ("soc: imx: add i.MX93 media blk ctrl driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/dt-bindings/power/fsl,imx93-power.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/dt-bindings/power/fsl,imx93-power.h
+++ b/include/dt-bindings/power/fsl,imx93-power.h
@@ -11,5 +11,6 @@
#define IMX93_MEDIABLK_PD_PXP 2
#define IMX93_MEDIABLK_PD_LCDIF 3
#define IMX93_MEDIABLK_PD_ISI 4
+#define IMX93_MEDIABLK_PD_MIPI_PHY 5
#endif
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0350/1266] serial: msm: Disable DMA for kernel console UART
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0349/1266] dt-bindings: power: imx93: Add MIPI PHY power domain Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0351/1266] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
` (648 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Stephan Gerhold,
Konrad Dybcio
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 22dd2777e6c180e1c945b00f6d18550979436324 upstream.
At the moment, concurrent writes from userspace and the kernel to the
console can trigger a race condition that results in an infinite loop of
the same messages printed over and over again. This is most likely to
happen during system startup or shutdown when the init system starts/stops
a large number of system services that interact with various kernel code.
When userspace writes to the TTY device, the driver initiates an
asynchronous DMA transfer and releases the port lock. At the same moment,
the kernel printk path might grab the port lock and re-configure the UART
controller for PIO, without waiting for the DMA operation to complete. It
seems like this collision results in zero progress being reported for the
DMA engine, so the same text is printed to the console over and over again.
For the kernel console, we want a reliable output path that will be
functional even during crashes etc. So rather than implementing complex
code to synchronize the kernel console write routines with the userspace
DMA write routines, simply disable DMA for the console UART instance.
Similar checks exist in many other serial drivers, e.g. 8250_port.c,
imx.c, sh-sci.c etc.
Cc: stable <stable@kernel.org>
Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706-serial-msm-console-dma-collision-v1-1-3179b8cb1d89@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/msm_serial.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -1221,7 +1221,8 @@ static int msm_startup(struct uart_port
data |= MSM_UART_MR1_AUTO_RFR_LEVEL0 & rfr_level;
msm_write(port, data, MSM_UART_MR1);
- if (msm_port->is_uartdm) {
+ /* Disable DMA for console to prevent PIO/DMA collisions */
+ if (msm_port->is_uartdm && !uart_console(port)) {
msm_request_tx_dma(msm_port, msm_port->uart.mapbase);
msm_request_rx_dma(msm_port, msm_port->uart.mapbase);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0351/1266] serial: 8250_omap: clear rx_running on zero-length DMA completes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0350/1266] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0352/1266] rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc Greg Kroah-Hartman
` (647 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Matthias Feser, Moteen Shah
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
commit 061b627ba534230a18ec4d7251562af12325d06a upstream.
On AM33xx RX DMA only triggers when the FIFO reaches the
configured threshold (typically 48 bytes). For smaller bursts
no DMA request is issued and the FIFO is drained by RX timeout.
In this case __dma_rx_do_complete() can legitimately see count == 0.
The current code exits early in this case and does not clear
dma->rx_running, leaving the DMA state inconsistent. This can
prevent RX DMA from restarting and may cause
omap_8250_rx_dma_flush() to fail, marking DMA as broken.
Fix this by clearing dma->rx_running once the DMA transfer has
completed or been terminated, even if no data was transferred.
Fixes: a5fd8945a478 ("serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done")
Cc: stable <stable@kernel.org>
Signed-off-by: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_omap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -953,11 +953,12 @@ static void __dma_rx_do_complete(struct
dev_err(p->port.dev, "teardown incomplete\n");
}
}
+
+ dma->rx_running = 0;
if (!count)
goto out;
ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
- dma->rx_running = 0;
p->port.icount.rx += ret;
p->port.icount.buf_overrun += count - ret;
out:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0352/1266] rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0351/1266] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0353/1266] rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Greg Kroah-Hartman
` (646 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, Jeffrey Altman,
David Howells, Jiayuan Chen, Marc Dionne, linux-afs, stable,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Altman <jaltman@auristor.com>
commit 16c8ae9735c5bd7e54dd7478d6348e0fc860842d upstream.
rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.
In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.
To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.
This issue was identified with assistance of a private
sashiko instance.
Fixes: d2bc90cf6c75cb ("rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg")
Reported-by: Simon Horman <simon.horman@redhat.com>
Signed-off-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jiayuan Chen <jiayuan.chen@linux.dev>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260609140911.838677-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/recvmsg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -157,7 +157,7 @@ static int rxrpc_verify_data(struct rxrp
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
int ret;
- if (sp->len > call->rx_dec_bsize) {
+ if (sp->len > call->rx_dec_bsize || !call->rx_dec_buffer) {
/* Make sure we can hold a 1412-byte jumbo subpacket and make
* sure that the buffer size is aligned to a crypto blocksize.
*/
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0353/1266] rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0352/1266] rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0354/1266] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
` (645 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Jeffrey Altman, Simon Horman, linux-afs, stable, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c upstream.
Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released
call if MSG_PEEK is in force (the function holds a ref on the call
irrespective of whether MSG_PEEK is specified or not).
Fixes: 962fb1f651c2 ("rxrpc: Fix recv-recv race of completed call")
Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-11-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rxrpc/recvmsg.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -429,8 +429,7 @@ try_again:
if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
rxrpc_see_call(call, rxrpc_call_see_already_released);
mutex_unlock(&call->user_mutex);
- if (!(flags & MSG_PEEK))
- rxrpc_put_call(call, rxrpc_call_put_recvmsg);
+ rxrpc_put_call(call, rxrpc_call_put_recvmsg);
goto try_again;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0354/1266] afs: Fix netns teardown to cancel the preallocation charger
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0353/1266] rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0355/1266] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
` (644 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, David Howells,
Li Daming, Ren Wei, Marc Dionne, Jeffrey Altman, linux-afs,
stable, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 47694fbc9d24ab6bf210f91e8efe06a10a478064 upstream.
Fix the teardown of an afs network namespace to make sure it cancels the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before incoming calls are disabled (i.e. listen 0).
Also, if net->live is false because the afs netns is being deleted, make
afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid
requeuing the charger.
(This was found by AI review).
Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
Reported-by: Simon Horman <horms@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260609140911.838677-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/rxrpc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -109,6 +109,7 @@ void afs_close_socket(struct afs_net *ne
{
_enter("");
+ cancel_work_sync(&net->charge_preallocation_work);
kernel_listen(net->socket, 0);
flush_workqueue(afs_async_calls);
@@ -727,7 +728,7 @@ void afs_charge_preallocation(struct wor
container_of(work, struct afs_net, charge_preallocation_work);
struct afs_call *call = net->spare_incoming_call;
- for (;;) {
+ while (READ_ONCE(net->live)) {
if (!call) {
call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL);
if (!call)
@@ -772,7 +773,8 @@ static void afs_rx_new_call(struct sock
{
struct afs_net *net = afs_sock2net(sk);
- queue_work(afs_wq, &net->charge_preallocation_work);
+ if (net->live)
+ queue_work(afs_wq, &net->charge_preallocation_work);
}
/*
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0355/1266] afs: fix NULL pointer dereference in afs_get_tree()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0354/1266] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0356/1266] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
` (643 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matvey Kovalev, David Howells,
Marc Dionne, linux-afs, Christian Brauner (Amutable)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matvey Kovalev <matvey.kovalev@ispras.ru>
commit 0b70716081c6462be9b2928ad736d0d527b09678 upstream.
afs_alloc_sbi() uses kzalloc for memory allocation. And, if
ctx->dyn_root is not null, as->cell and as->volume are null.
In trace_afs_get_tree() they are dereferenced.
KASAN error message:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
04/01/2014
RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550
include/trace/events/afs.h:1365
Call Trace:
trace_afs_get_tree include/trace/events/afs.h:1365 [inline]
afs_get_tree+0x922/0x1350 fs/afs/super.c:599
vfs_get_tree+0x8e/0x300 fs/super.c:1572
do_new_mount fs/namespace.c:3011 [inline]
path_mount+0x14a5/0x2220 fs/namespace.c:3341
do_mount fs/namespace.c:3354 [inline]
__do_sys_mount fs/namespace.c:3562 [inline]
__se_sys_mount fs/namespace.c:3539 [inline]
__x64_sys_mount+0x283/0x300 fs/namespace.c:3539
do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 80548b03991f5 ("afs: Add more tracepoints")
Cc: stable@vger.kernel.org
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-4-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -597,7 +597,8 @@ static int afs_get_tree(struct fs_contex
}
fc->root = dget(sb->s_root);
- trace_afs_get_tree(as->cell, as->volume);
+ if (!ctx->dyn_root)
+ trace_afs_get_tree(as->cell, as->volume);
_leave(" = 0 [%p]", sb);
return 0;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0356/1266] afs: Fix further netns teardown to cancel the preallocation charger
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0355/1266] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0357/1266] fbcon: fix NULL pointer dereference for a console without vc_data Greg Kroah-Hartman
` (642 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, David Howells,
Li Daming, Ren Wei, Marc Dionne, Jeffrey Altman, Simon Horman,
linux-afs, stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream.
When an afs network namespace is torn down, it cancels and waits for the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before disabling incoming (i.e. listen 0), but there's a small window in
which it can be requeued by an incoming call wending through the I/O
thread.
Fix this by cancelling the charger work item again after reducing the
listen backlog to zero.
Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/rxrpc.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -110,8 +110,13 @@ void afs_close_socket(struct afs_net *ne
_enter("");
cancel_work_sync(&net->charge_preallocation_work);
+ /* Future work items should now see ->live is false. */
+
kernel_listen(net->socket, 0);
+
+ /* Make sure work items are no longer running. */
flush_workqueue(afs_async_calls);
+ cancel_work_sync(&net->charge_preallocation_work);
if (net->spare_incoming_call) {
afs_put_call(net->spare_incoming_call);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0357/1266] fbcon: fix NULL pointer dereference for a console without vc_data
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0356/1266] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0358/1266] clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() Greg Kroah-Hartman
` (641 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+42525d636f430fd5d983,
Ian Bridges, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
commit 5fae9a928482d4845bca169a3a098789203a1ca4 upstream.
fbcon_new_modelist() runs when a framebuffer's modelist changes. For each
console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and
passes the vc_num to fbcon_set_disp(). This assumes a console with a mode
set has a vc_data, but it can be NULL. fbcon_set_disp() sets
fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the
mode set after the vc_data is freed. fbcon_new_modelist() then dereferences
the NULL vc_data.
Keep fb_display[i].mode set only while the console has a vc_data. Check
vc_data before setting the mode in fbcon_set_disp(), and clear the mode in
fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips
such consoles.
Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1183,6 +1183,7 @@ static void fbcon_deinit(struct vc_data
int idx;
fbcon_free_font(p);
+ p->mode = NULL;
idx = con2fb_map[vc->vc_num];
if (idx == -1)
@@ -1361,14 +1362,14 @@ static void fbcon_set_disp(struct fb_inf
p = &fb_display[unit];
- if (var_to_display(p, var, info))
- return;
-
vc = vc_cons[unit].d;
if (!vc)
return;
+ if (var_to_display(p, var, info))
+ return;
+
default_mode = vc->vc_display_fg;
svc = *default_mode;
t = &fb_display[svc->vc_num];
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0358/1266] clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0357/1266] fbcon: fix NULL pointer dereference for a console without vc_data Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0359/1266] drm/rockchip: Test for imported buffers with drm_gem_is_imported() Greg Kroah-Hartman
` (640 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Ni, Daniel Lezcano,
Chen-Yu Tsai, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit fed9f727cc3f91dde8278961269419083502b40e ]
The devm_reset_control_get_optional_exclusive() function may return an
ERR_PTR in case of genuine reset control acquisition errors, not just
NULL which indicates the legitimate absence of an optional reset.
Add an IS_ERR() check after the call in sun5i_timer_probe(). On error,
return the error code to ensure proper failure handling rather than
proceeding with invalid pointers.
Fixes: 7e5bac610d2f ("clocksource/drivers/sun5i: Convert to platform device driver")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Acked-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260205084037.3661261-1-nichen@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-sun5i.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 69fee3540d375f..e9efe03dc126be 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -286,6 +286,9 @@ static int sun5i_timer_probe(struct platform_device *pdev)
}
rstc = devm_reset_control_get_optional_exclusive(dev, NULL);
+ if (IS_ERR(rstc))
+ return dev_err_probe(dev, PTR_ERR(rstc),
+ "failed to get reset\n");
if (rstc)
reset_control_deassert(rstc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0359/1266] drm/rockchip: Test for imported buffers with drm_gem_is_imported()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0358/1266] clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0360/1266] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
` (639 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Sandy Huang,
Heiko Stübner, Andy Yan, linux-rockchip, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 9fc0da81916250f343599a4dd259f097196bf0fb ]
Instead of testing import_attach for imported GEM buffers, invoke
drm_gem_is_imported() to do the test. The test itself does not change.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Sandy Huang <hjc@rock-chips.com>
Cc: Heiko Stübner <heiko@sntech.de>
Cc: Andy Yan <andy.yan@rock-chips.com>
Cc: linux-rockchip@lists.infradead.org
Fixes: b57aa47d39e9 ("drm/gem: Test for imported GEM buffers with helper")
Closes: https://lore.kernel.org/dri-devel/38d09d34.4354.196379aa560.Coremail.andyshrk@163.com/
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260227133113.235940-11-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index 93ed841f5dceae..04879e23797fb7 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -332,7 +332,7 @@ void rockchip_gem_free_object(struct drm_gem_object *obj)
struct rockchip_drm_private *private = drm->dev_private;
struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
- if (obj->import_attach) {
+ if (drm_gem_is_imported(obj)) {
if (private->domain) {
rockchip_gem_iommu_unmap(rk_obj);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0360/1266] drm/tidss: Drop extra drm_mode_config_reset() call
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0359/1266] drm/rockchip: Test for imported buffers with drm_gem_is_imported() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0361/1266] drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() Greg Kroah-Hartman
` (638 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Tomi Valkeinen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit f468fef38716f667e805e0fa2c497c6b9c325bb9 ]
We are calling drm_mode_config_reset() twice at probe time. There's no
reason for this and the second call can be removed, reducing work at
probe time slightly.
Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://patch.msgid.link/20260311-tidss-minor-fixes-v2-1-cb4479784458@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_kms.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
index d096d8d2bc8f84..3b8133be544ebf 100644
--- a/drivers/gpu/drm/tidss/tidss_kms.c
+++ b/drivers/gpu/drm/tidss/tidss_kms.c
@@ -268,8 +268,6 @@ int tidss_modeset_init(struct tidss_device *tidss)
if (ret)
return ret;
- drm_mode_config_reset(ddev);
-
dev_dbg(tidss->dev, "%s done\n", __func__);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0361/1266] drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0360/1266] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0362/1266] drm/radeon: fix integer overflow in radeon_align_pitch() Greg Kroah-Hartman
` (637 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Kasselman, Alex Deucher,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <werner@verivus.ai>
[ Upstream commit fc3659f178d4a65599167d5a648bbeef4b0d4446 ]
amdgpu_gem_align_pitch() is passed u32 width and cpp from dumb buffer
creation but uses signed int internally. The round-up add and the
aligned * cpp multiplication can overflow, returning zero or a negative
pitch. A zero pitch propagates to a zero-sized GEM object allocation
that reaches userspace via DRM_IOCTL_MODE_CREATE_DUMB.
Switch the helper to unsigned int and use check_add_overflow() /
check_mul_overflow() so wraparound returns zero. Reject a zero pitch
or size in amdgpu_mode_dumb_create() rather than allocating a zero-
byte BO.
Fixes: 8e911ab770f7 ("drm: amdgpu: Replace drm_fb_get_bpp_depth() with drm_format_plane_cpp()")
Signed-off-by: Werner Kasselman <werner@verivus.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index a1b15d0d6c4893..73a00f30da9ced 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -27,6 +27,7 @@
*/
#include <linux/ktime.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/pagemap.h>
#include <linux/pci.h>
#include <linux/dma-buf.h>
@@ -878,13 +879,14 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data,
return r;
}
-static int amdgpu_gem_align_pitch(struct amdgpu_device *adev,
- int width,
- int cpp,
- bool tiled)
+static unsigned int amdgpu_gem_align_pitch(struct amdgpu_device *adev,
+ unsigned int width,
+ unsigned int cpp,
+ bool tiled)
{
- int aligned = width;
- int pitch_mask = 0;
+ unsigned int aligned = width;
+ unsigned int pitch_mask = 0;
+ unsigned int pitch;
switch (cpp) {
case 1:
@@ -899,9 +901,12 @@ static int amdgpu_gem_align_pitch(struct amdgpu_device *adev,
break;
}
- aligned += pitch_mask;
+ if (check_add_overflow(aligned, pitch_mask, &aligned))
+ return 0;
aligned &= ~pitch_mask;
- return aligned * cpp;
+ if (check_mul_overflow(aligned, cpp, &pitch))
+ return 0;
+ return pitch;
}
int amdgpu_mode_dumb_create(struct drm_file *file_priv,
@@ -928,8 +933,12 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
args->pitch = amdgpu_gem_align_pitch(adev, args->width,
DIV_ROUND_UP(args->bpp, 8), 0);
+ if (!args->pitch)
+ return -EINVAL;
args->size = (u64)args->pitch * args->height;
args->size = ALIGN(args->size, PAGE_SIZE);
+ if (!args->size)
+ return -EINVAL;
domain = amdgpu_bo_get_preferred_domain(adev,
amdgpu_display_supported_domains(adev, flags));
r = amdgpu_gem_object_create(adev, args->size, 0, domain, flags,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0362/1266] drm/radeon: fix integer overflow in radeon_align_pitch()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0361/1266] drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0363/1266] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
` (636 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Kasselman, Alex Deucher,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Kasselman <werner@verivus.ai>
[ Upstream commit ce3b24eb3ee8f82de851535f516bf21f83e82259 ]
radeon_align_pitch() has the same kind of overflow issue as the old
amdgpu helper: both the alignment round-up add and the final
'aligned * cpp' calculation can overflow signed int.
If that wraps, radeon_mode_dumb_create() can end up returning an
invalid pitch or creating a zero-sized dumb buffer.
Fix this by using check_add_overflow() for the alignment round-up and
check_mul_overflow() for the final pitch calculation, returning 0 on
overflow. Also reject zero pitch and size in
radeon_mode_dumb_create().
Found via AST-based call-graph analysis using sqry.
Fixes: ff72145badb8 ("drm: dumb scanout create/mmap for intel/radeon (v3)")
Signed-off-by: Werner Kasselman <werner@verivus.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_gem.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 96934fee7e9432..03600671370cfa 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -27,6 +27,7 @@
*/
#include <linux/iosys-map.h>
+#include <linux/overflow.h>
#include <linux/pci.h>
#include <drm/drm_device.h>
@@ -809,6 +810,7 @@ int radeon_align_pitch(struct radeon_device *rdev, int width, int cpp, bool tile
int aligned = width;
int align_large = (ASIC_IS_AVIVO(rdev)) || tiled;
int pitch_mask = 0;
+ int pitch;
switch (cpp) {
case 1:
@@ -823,9 +825,12 @@ int radeon_align_pitch(struct radeon_device *rdev, int width, int cpp, bool tile
break;
}
- aligned += pitch_mask;
+ if (check_add_overflow(aligned, pitch_mask, &aligned))
+ return 0;
aligned &= ~pitch_mask;
- return aligned * cpp;
+ if (check_mul_overflow(aligned, cpp, &pitch))
+ return 0;
+ return pitch;
}
int radeon_mode_dumb_create(struct drm_file *file_priv,
@@ -839,8 +844,12 @@ int radeon_mode_dumb_create(struct drm_file *file_priv,
args->pitch = radeon_align_pitch(rdev, args->width,
DIV_ROUND_UP(args->bpp, 8), 0);
+ if (!args->pitch)
+ return -EINVAL;
args->size = (u64)args->pitch * args->height;
args->size = ALIGN(args->size, PAGE_SIZE);
+ if (!args->size)
+ return -EINVAL;
r = radeon_gem_object_create(rdev, args->size, 0,
RADEON_GEM_DOMAIN_VRAM, 0,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0363/1266] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0362/1266] drm/radeon: fix integer overflow in radeon_align_pitch() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0364/1266] libbpf: Report error when a negative kprobe offset is specified Greg Kroah-Hartman
` (635 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 82f1d6042611d45b8b9de423bbcb4e0ced9ec62b ]
radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.
If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.
Free data before returning the error.
Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 8626171e9a6db2..537d9e21dc528f 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -354,8 +354,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
/* restore the saved ring content */
r = radeon_ring_lock(rdev, ring, size);
- if (r)
+ if (r) {
+ kvfree(data);
return r;
+ }
for (i = 0; i < size; ++i) {
radeon_ring_write(ring, data[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0364/1266] libbpf: Report error when a negative kprobe offset is specified
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0363/1266] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0365/1266] Documentation: proc: fix section numbering in table of contents Greg Kroah-Hartman
` (634 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Tomlin, Mykyta Yatsenko,
Kumar Kartikeya Dwivedi, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Tomlin <atomlin@atomlin.com>
[ Upstream commit ad35d8018669fd2eea76e3f74eb050fd3d2fb690 ]
In attach_kprobe(), the parsing logic uses sscanf() to extract the
target function name and offset from the section definition. Currently,
if a user specifies a negative offset (e.g., SEC("kprobe/func+-100")),
the input is not explicitly caught and reported as an error.
This commit updates the logic to explicitly notify the user when a
negative integer is provided. To facilitate this check, the offset
variable is changed from unsigned long to long so that sscanf()
can accurately capture a negative input for evaluation.
If a negative offset is detected, the loader will now print an
informative warning stating that the offset must be non-negative,
and return -EINVAL.
Additionally, free(func) is called in this new error path to prevent
a memory leak, as the function name string is dynamically allocated
by sscanf().
Fixes: e3f9bc35ea7e9 ("libbpf: Allow decimal offset for kprobes")
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/bpf/20260419030944.1423642-1-atomlin@atomlin.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/libbpf.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 802ae6dbddfa31..946ca07968a975 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -10926,7 +10926,7 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf_link **link)
{
DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, opts);
- unsigned long offset = 0;
+ long offset = 0;
const char *func_name;
char *func;
int n;
@@ -10948,6 +10948,13 @@ static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf
pr_warn("kprobe name is invalid: %s\n", func_name);
return -EINVAL;
}
+
+ if (offset < 0) {
+ free(func);
+ pr_warn("kprobe offset must be a non-negative integer: %li\n", offset);
+ return -EINVAL;
+ }
+
if (opts.retprobe && offset != 0) {
free(func);
pr_warn("kretprobes do not support offset specification\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0365/1266] Documentation: proc: fix section numbering in table of contents
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0364/1266] libbpf: Report error when a negative kprobe offset is specified Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0366/1266] arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S Greg Kroah-Hartman
` (633 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baolin Liu, Randy Dunlap,
Jonathan Corbet, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baolin Liu <liubaolin@kylinos.cn>
[ Upstream commit 97a7bd8c2c58a6d820df563d1d0f68aafec45477 ]
Commit e24ccaaf7ec4 ("block: remove last remaining traces of IDE
documentation") removed the IDE section but left its table of
contents entry behind.
Fix the stale entry and renumber the following sections.
Fixes: e24ccaaf7ec4 ("block: remove last remaining traces of IDE documentation")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260424090654.19229-1-liubaolin12138@163.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/filesystems/proc.rst | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst
index 2b59cff8be1798..0a186efa0cec53 100644
--- a/Documentation/filesystems/proc.rst
+++ b/Documentation/filesystems/proc.rst
@@ -23,13 +23,13 @@ fixes/update part 1.1 Stefani Seibold <stefani@seibold.net> June 9 2009
1 Collecting System Information
1.1 Process-Specific Subdirectories
1.2 Kernel data
- 1.3 IDE devices in /proc/ide
- 1.4 Networking info in /proc/net
- 1.5 SCSI info
- 1.6 Parallel port info in /proc/parport
- 1.7 TTY info in /proc/tty
- 1.8 Miscellaneous kernel statistics in /proc/stat
- 1.9 Ext4 file system parameters
+ 1.3 Networking info in /proc/net
+ 1.4 SCSI info
+ 1.5 Parallel port info in /proc/parport
+ 1.6 TTY info in /proc/tty
+ 1.7 Miscellaneous kernel statistics in /proc/stat
+ 1.8 Ext4 file system parameters
+ 1.9 /proc/consoles - Shows registered system consoles
2 Modifying System Parameters
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0366/1266] arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0365/1266] Documentation: proc: fix section numbering in table of contents Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0367/1266] arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning Greg Kroah-Hartman
` (632 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diederik de Haas, Heiko Stuebner,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diederik de Haas <diederik@cknow-tech.com>
[ Upstream commit c83c4a09d4c01c91d6c52d6d4d77a06892a3e83b ]
According to the NanoPi R5S 2204 schematic on page 6, GPIO0_C4 is for
GMAC0_INT/PMEB_GPIO0_C4, while GPIO0_C5 is for GMAC0_RSTn_GPIO0_C5.
While the 'reset-gpios' property was set correctly, the corresponding
pinctrl didn't match that.
Next to fixing the pinctrl definition, also change the node name and
phandle to match what is used in the schematic.
Fixes: c6629b9a6738 ("arm64: dts: rockchip: Add FriendlyElec Nanopi R5S")
Signed-off-by: Diederik de Haas <diederik@cknow-tech.com>
Link: https://patch.msgid.link/20260401131551.734456-2-diederik@cknow-tech.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts b/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts
index b6ad8328c7ebc4..b9f4b6e63d47d2 100644
--- a/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dts
@@ -77,7 +77,7 @@ &mdio0 {
rgmii_phy0: ethernet-phy@1 {
compatible = "ethernet-phy-ieee802.3-c22";
reg = <1>;
- pinctrl-0 = <ð_phy0_reset_pin>;
+ pinctrl-0 = <&gmac0_rstn_gpio0_c5_pin>;
pinctrl-names = "default";
};
};
@@ -111,8 +111,8 @@ &pcie3x2 {
&pinctrl {
gmac0 {
- eth_phy0_reset_pin: eth-phy0-reset-pin {
- rockchip,pins = <0 RK_PC4 RK_FUNC_GPIO &pcfg_pull_up>;
+ gmac0_rstn_gpio0_c5_pin: gmac0-rstn-gpio0-c5-pin {
+ rockchip,pins = <0 RK_PC5 RK_FUNC_GPIO &pcfg_pull_up>;
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0367/1266] arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0366/1266] arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0368/1266] wifi: cfg80211: fix grammar in MLO group key error message Greg Kroah-Hartman
` (631 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, David Heidelberg,
Krzysztof Kozlowski, Bjorn Andersson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit f20a82aacd7f381084391a8d1f0f58defa91974c ]
Add necessary properties for ports node in SDM845 DB845c Navigation
mezzanine overlay to fix W=1 DTC warning:
sdm845-db845c-navigation-mezzanine.dtso:19.10-24.5: Warning (unit_address_vs_reg): /fragment@0/__overlay__/ports/port@0: node has a unit name, but no reg or ranges property
Fixes: 30df676a31b7 ("arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine riser to dtso")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260405-dts-qcom-w-1-fixes-v2-5-1f2c7b74a93f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso
index 51f1a4883ab8f0..df1907560c525c 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso
+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c-navigation-mezzanine.dtso
@@ -16,7 +16,12 @@
status = "okay";
ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
port@0 {
+ reg = <0>;
+
csiphy0_ep: endpoint {
data-lanes = <0 1 2 3>;
remote-endpoint = <&ov8856_ep>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0368/1266] wifi: cfg80211: fix grammar in MLO group key error message
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0367/1266] arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0369/1266] arm64: tegra: Fix Tegra234 MGBE PTP clock Greg Kroah-Hartman
` (630 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Louis Kotze, Johannes Berg,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Kotze <loukot@gmail.com>
[ Upstream commit 9dcc1af3bbf5441f71a1e51b8d81bdf38a249607 ]
The error message emitted by nl80211_validate_key_link_id() when a group
key install on an MLO wdev is missing the link ID reads "link ID must
for MLO group key", which is missing the words "be set". This makes the
error harder to grep and parse in userspace logs, and is reported
verbatim by wpa_supplicant via its nl80211 extack relay, e.g.:
wpa_supplicant: nl80211: kernel reports: link ID must for MLO group key
The sibling error strings in the same helper already use grammatical
phrasing ("link ID not allowed for pairwise key", "invalid link ID for
MLO group key", "link ID not allowed for non-MLO group key"). Fix this
one to match.
No functional change.
Fixes: e7a7b84e3317 ("wifi: cfg80211: Add link_id parameter to various key operations for MLO")
Signed-off-by: Louis Kotze <loukot@gmail.com>
Link: https://patch.msgid.link/20260414122728.92234-1-loukot@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 9f2e84af6f8b46..e4a490d12b504e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4456,7 +4456,7 @@ static int nl80211_validate_key_link_id(struct genl_info *info,
if (wdev->valid_links) {
if (link_id == -1) {
GENL_SET_ERR_MSG(info,
- "link ID must for MLO group key");
+ "link ID must be set for MLO group key");
return -EINVAL;
}
if (!(wdev->valid_links & BIT(link_id))) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0369/1266] arm64: tegra: Fix Tegra234 MGBE PTP clock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0368/1266] wifi: cfg80211: fix grammar in MLO group key error message Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0370/1266] dt-bindings: pinctrl: nvidia,tegra234: Add missing required block Greg Kroah-Hartman
` (629 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jon Hunter, Krzysztof Kozlowski,
Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <jonathanh@nvidia.com>
[ Upstream commit 8f0cc929a4bad534c5a860a53d88912cf16d9c9c ]
The Tegra MGBE PTP clock is incorrectly named as 'ptp-ref' and not
'ptp_ref' and this causing the initialisation of the PTP clock to fail.
The device-tree binding doc for the device and the Tegra MGBE driver
have been updated to use the correct name and so update the device-tree
for Tegra234 as well.
Fixes: 610cdf3186bc ("arm64: tegra: Add MGBE nodes on Tegra234")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
index bcc36055ef97e6..d1d7f6a50e11f2 100644
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -1447,7 +1447,7 @@ ethernet@6800000 {
<&bpmp TEGRA234_CLK_MGBE0_RX_PCS_M>,
<&bpmp TEGRA234_CLK_MGBE0_RX_PCS>,
<&bpmp TEGRA234_CLK_MGBE0_TX_PCS>;
- clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m",
+ clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m",
"rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m",
"rx-pcs", "tx-pcs";
resets = <&bpmp TEGRA234_RESET_MGBE0_MAC>,
@@ -1481,7 +1481,7 @@ ethernet@6900000 {
<&bpmp TEGRA234_CLK_MGBE1_RX_PCS_M>,
<&bpmp TEGRA234_CLK_MGBE1_RX_PCS>,
<&bpmp TEGRA234_CLK_MGBE1_TX_PCS>;
- clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m",
+ clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m",
"rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m",
"rx-pcs", "tx-pcs";
resets = <&bpmp TEGRA234_RESET_MGBE1_MAC>,
@@ -1515,7 +1515,7 @@ ethernet@6a00000 {
<&bpmp TEGRA234_CLK_MGBE2_RX_PCS_M>,
<&bpmp TEGRA234_CLK_MGBE2_RX_PCS>,
<&bpmp TEGRA234_CLK_MGBE2_TX_PCS>;
- clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m",
+ clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m",
"rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m",
"rx-pcs", "tx-pcs";
resets = <&bpmp TEGRA234_RESET_MGBE2_MAC>,
@@ -1549,7 +1549,7 @@ ethernet@6b00000 {
<&bpmp TEGRA234_CLK_MGBE3_RX_PCS_M>,
<&bpmp TEGRA234_CLK_MGBE3_RX_PCS>,
<&bpmp TEGRA234_CLK_MGBE3_TX_PCS>;
- clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m",
+ clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m",
"rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m",
"rx-pcs", "tx-pcs";
resets = <&bpmp TEGRA234_RESET_MGBE3_MAC>,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0370/1266] dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0369/1266] arm64: tegra: Fix Tegra234 MGBE PTP clock Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0371/1266] drm/amdkfd: Validate CRIU-restored IDs before idr_alloc Greg Kroah-Hartman
` (628 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Rob Herring (Arm), Linus Walleij, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit 61b5deb5a968f7a82124f9b2591a6a151ed7273a ]
Binding should require 'reg' property, because address space cannot be
missing in the hardware and is already needed by the Linux drivers.
Require also 'compatible' by convention, although it is not strictly
necessary.
Fixes: 857982138b79 ("dt-bindings: pinctrl: Document Tegra234 pin controllers")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bindings/pinctrl/nvidia,tegra234-pinmux-aon.yaml | 4 ++++
.../devicetree/bindings/pinctrl/nvidia,tegra234-pinmux.yaml | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux-aon.yaml b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux-aon.yaml
index f3deda9f7127fd..3c19147af91e37 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux-aon.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux-aon.yaml
@@ -55,6 +55,10 @@ patternProperties:
drive_soc_gpio27_pee6, drive_ao_retention_n_pee2,
drive_vcomp_alert_pee1, drive_hdmi_cec_pgg0 ]
+required:
+ - compatible
+ - reg
+
unevaluatedProperties: false
examples:
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux.yaml b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux.yaml
index 17b865ecfcdaa0..4f79dbc1bde66e 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra234-pinmux.yaml
@@ -112,6 +112,10 @@ patternProperties:
drive_sdmmc1_dat2_pj4, drive_sdmmc1_dat1_pj3,
drive_sdmmc1_dat0_pj2 ]
+required:
+ - compatible
+ - reg
+
unevaluatedProperties: false
examples:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0371/1266] drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0370/1266] dt-bindings: pinctrl: nvidia,tegra234: Add missing required block Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0372/1266] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
` (627 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Felix Kuehling,
David Yat Sin, Rajneesh Bhardwaj, Srinivasan Shanmugam,
Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit 85043dd49c2f51a37b22618168e3ae59ab92f0d6 ]
The KFD CRIU restore flow restores previously saved object IDs from
userspace.
For event restore:
kfd_criu_restore_event()
-> create_signal_event() / create_other_event()
-> allocate_event_notification_slot()
-> idr_alloc(..., *restore_id, *restore_id + 1, ...)
For BO restore:
criu_restore_memory_of_gpu()
-> idr_alloc(..., bo_priv->idr_handle, ...)
In both cases, the restored ID comes from userspace-provided CRIU data.
idr_alloc() expects the ID range values to fit within signed int
limits. If a restored ID is larger than INT_MAX, it can trigger a WARN
in the IDR layer.
A kernel WARN is undesirable because it prints a warning trace and may
cause a panic or reboot on systems with panic_on_warn enabled.
Smatch reported these paths as allowing unchecked userspace values to
reach idr_alloc().
Add INT_MAX validation before using restored IDs in:
- kfd_criu_restore_event()
- criu_restore_memory_of_gpu()
If the restored ID is invalid, return -EINVAL.
This prevents invalid restore data from reaching the IDR layer and
avoids WARN-triggering paths, while keeping valid restore behavior
unchanged.
Fixes: 40e8a766a761 ("drm/amdkfd: CRIU checkpoint and restore events")
Reported-by: Dan Carpenter <error27@gmail.com>
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Cc: David Yat Sin <david.yatsin@amd.com>
Cc: Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: David Yat Sin <david.yatsin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 5 +++++
2 files changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 1b39ecc544f96f..de6495c2b2f4ac 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -2327,6 +2327,9 @@ static int criu_restore_memory_of_gpu(struct kfd_process_device *pdd,
const bool criu_resume = true;
u64 offset;
+ if (bo_priv->idr_handle > INT_MAX)
+ return -EINVAL;
+
if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL) {
if (bo_bucket->size !=
kfd_doorbell_process_slice(pdd->dev->kfd))
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index c98a08c269ae74..5ffd17ac8e1cf3 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -479,6 +479,11 @@ int kfd_criu_restore_event(struct file *devkfd,
}
*priv_data_offset += sizeof(*ev_priv);
+ if (ev_priv->event_id > INT_MAX) {
+ ret = -EINVAL;
+ goto exit;
+ }
+
if (ev_priv->user_handle) {
ret = kfd_kmap_event_page(p, ev_priv->user_handle);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0372/1266] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0371/1266] drm/amdkfd: Validate CRIU-restored IDs before idr_alloc Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0373/1266] wifi: rtw89: Correct data type for scan index to avoid infinite loop Greg Kroah-Hartman
` (626 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki (Intel),
Saravana Kannan, Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit e9506871a8ea304cde48ff4a57226df2aadddae3 ]
dev_has_sync_state() reads dev->driver twice without holding
device_lock() -- once for the NULL check and once to dereference
->sync_state. Some callers only hold device_links_write_lock, which
doesn't prevent a concurrent unbind from clearing dev->driver via
device_unbind_cleanup().
Fix it by reading dev->driver exactly once with READ_ONCE(), pairing
with the WRITE_ONCE() in device_set_driver().
Link: https://lore.kernel.org/driver-core/DHW8QPU1VU1F.3P6PH69HLFBYC@kernel.org/
Fixes: ac338acf514e ("driver core: Add dev_has_sync_state()")
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Saravana Kannan <saravanak@kernel.org>
Link: https://patch.msgid.link/20260418162221.1121873-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/device.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/device.h b/include/linux/device.h
index 2a9017eec15c24..f4b321236c66f4 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1125,9 +1125,12 @@ static inline struct device_node *dev_of_node(struct device *dev)
static inline bool dev_has_sync_state(struct device *dev)
{
+ struct device_driver *drv;
+
if (!dev)
return false;
- if (dev->driver && dev->driver->sync_state)
+ drv = READ_ONCE(dev->driver);
+ if (drv && drv->sync_state)
return true;
if (dev->bus && dev->bus->sync_state)
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0373/1266] wifi: rtw89: Correct data type for scan index to avoid infinite loop
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0372/1266] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0374/1266] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
` (625 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shin-Yi Lin, Ping-Ke Shih,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin-Yi Lin <isaiah@realtek.com>
[ Upstream commit 08fdcb529df6df3562dd2b0035f88dd5be8b3c68 ]
A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.
The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,
leading to a system panic.
RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends
the low 8 bits of RBX into RAX.
RBX (the counter i) has reached a huge value: 0x137466a1.
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]
Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]
Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f
84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01
<0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49
RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202
RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000
RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130
RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080
R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870
R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80
FS: 0000000000000000(0000) GS:ffff8a014f962000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0
Call Trace:
<TASK>
rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core]
rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core]
? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core]
rtw89_ops_hw_scan+0xae/0x120 [rtw89_core]
drv_hw_scan+0xbb/0x180 [mac80211]
__ieee80211_start_scan+0x2fc/0x750 [mac80211]
ieee80211_request_scan+0xe/0x20 [mac80211]
ieee80211_scan+0x123/0x190 [mac80211]
rdev_scan+0x40/0x110 [cfg80211]
cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211]
By objdump with source:
for (i = 0; i < req->n_6ghz_params; i++) {
5fbc0: 83 c3 01 add $0x1,%ebx --> i++
5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter
fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax
* RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161)
Fixes: c6aa9a9c4725 ("wifi: rtw89: add RNR support for 6 GHz scan")
Signed-off-by: Shin-Yi Lin <isaiah@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260420034051.17666-7-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/fw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 539537360914c6..48ed0e5dbed8fe 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -3641,7 +3641,7 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev,
struct sk_buff *skb;
bool found;
int ret = 0;
- u8 i;
+ u32 i;
if (!req->n_6ghz_params)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0374/1266] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0373/1266] wifi: rtw89: Correct data type for scan index to avoid infinite loop Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0375/1266] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
` (624 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Ping-Ke Shih,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6 ]
In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit
descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both
firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),
causing an out-of-bounds read from the pre-allocated DMA buffer when
skb_put_data copies new_len bytes. The USB transport already validates
this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the
PCIe path does not.
Add a check that new_len does not exceed the DMA buffer size.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260421111434.3389674-1-tristmd@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index bd6d8b2af2420e..1da0bc436d8f8a 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -1074,6 +1074,11 @@ static u32 rtw_pci_rx_napi(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,
* discard the frame if none available
*/
new_len = pkt_stat.pkt_len + pkt_offset;
+ if (unlikely(new_len > RTK_PCI_RX_BUF_SIZE)) {
+ rtw_dbg(rtwdev, RTW_DBG_RX,
+ "oversized RX packet: %u\n", new_len);
+ goto next_rp;
+ }
new = dev_alloc_skb(new_len);
if (WARN_ONCE(!new, "rx routine starvation\n"))
goto next_rp;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0375/1266] kconfig: fix potential NULL pointer dereference in conf_askvalue
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0374/1266] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0376/1266] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
` (623 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xingjing Deng, Nathan Chancellor,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingjing Deng <micro6947@gmail.com>
[ Upstream commit b9d21c32dca2167a614e66c9e27999b9e1c33d55 ]
In conf_askvalue(), the 'def' argument (retrieved via sym_get_string_value)
can be NULL. While current call sites ensure that 'def' is valid,
calling printf("%s\n", def) is technically undefined behavior and could
lead to a segmentation fault on certain libc implementations if the
function were called with a NULL pointer in the future.
Improve the robustness of conf_askvalue() by providing an empty string
as a fallback.
Additionally, remove the redundant re-initialization of the 'line'
buffer inside the !sym_is_changeable(sym) block, as it is already
properly initialized at the function entry.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xingjing Deng <micro6947@gmail.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260306021709.27068-1-micro6947@gmail.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/conf.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 662a5e7c37c285..6c4ff012a05ebd 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -323,9 +323,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
line[1] = 0;
if (!sym_is_changeable(sym)) {
- printf("%s\n", def);
- line[0] = '\n';
- line[1] = 0;
+ printf("%s\n", def ?: "");
return 0;
}
@@ -333,7 +331,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
case oldconfig:
case syncconfig:
if (sym_has_value(sym)) {
- printf("%s\n", def);
+ printf("%s\n", def ?: "");
return 0;
}
/* fall through */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0376/1266] wifi: ath9k: fix OOB access from firmware tx status queue ID
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0375/1266] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0377/1266] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
` (622 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani,
Toke Høiland-Jørgensen, Jeff Johnson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 ]
ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.
Add a bounds check on ts.qid before using it as an array index.
Fixes: fce041beb03f ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260415222343.1540564-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 4e939dcac1c9dc..c1807356bea76b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2754,6 +2754,11 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
continue;
}
+ if (ts.qid >= ATH9K_NUM_TX_QUEUES) {
+ ath_dbg(common, XMIT, "invalid qid %d\n", ts.qid);
+ continue;
+ }
+
txq = &sc->tx.txq[ts.qid];
ath_txq_lock(sc, txq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0377/1266] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0376/1266] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0378/1266] watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH Greg Kroah-Hartman
` (621 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman (TI),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 2bc564f46b00dc4f4331fc337277ff3f5fac8a4e ]
The cpu_endpoint in mcasp0 specifies the TLV320AIC3106 codec as the
bitclock and frame master, but the phandles point to the codec's port
node (codec_port) rather than its endpoint node (codec_endpoint).
audio-graph-card calls simple_util_parse_daifmt() with ep_codec set to
the endpoint node (codec_endpoint). The function resolves the
bitclock-master phandle and checks whether it equals ep_codec. Since
codec_port is the parent of codec_endpoint, not the endpoint itself, the
comparison always evaluates to false. This causes the mcasp0 CPU side to
be silently configured as bitclock and frame master instead of the codec,
which is the opposite of the intended configuration.
Fix by pointing bitclock-master and frame-master to codec_endpoint.
Fixes: e5f89dbdebc5 ("ARM: dts: am335x-sl50: use audio-graph-card for sound")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://patch.msgid.link/20260325223411.123666-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-sl50.dts b/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
index 1115c812f6c8be..b22e5c6453314d 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
@@ -557,8 +557,8 @@ cpu_endpoint: endpoint {
remote-endpoint = <&codec_endpoint>;
dai-format = "dsp_b";
- bitclock-master = <&codec_port>;
- frame-master = <&codec_port>;
+ bitclock-master = <&codec_endpoint>;
+ frame-master = <&codec_endpoint>;
bitclock-inversion;
clocks = <&audio_mclk>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0378/1266] watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0377/1266] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0379/1266] watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 Greg Kroah-Hartman
` (620 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yingjie Gao, Guenter Roeck,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingjie Gao <gaoyingjie@uniontech.com>
[ Upstream commit 4f675f036cd5e9cfbe6df5f24f8338158af96a4b ]
Commit 009637de1f65 ("watchdog: sp5100_tco: support Hygon FCH/SCH
(Server Controller Hub)") added Hygon vendor matching to the efch
layout selection, but newer Hygon 0x790b SMBus devices still need the
efch_mmio path.
The efch_mmio path enables EFCH_PM_DECODEEN_WDT_TMREN before probing the
watchdog MMIO block. If firmware leaves that bit clear and the driver
picks the legacy efch path instead, probe falls back to the alternate
window and fails with "Watchdog hardware is disabled".
Select efch_mmio for Hygon 0x790b devices with revision 0x51 or later,
matching the equivalent AMD behavior and allowing the watchdog to
initialize on those systems.
Fixes: 009637de1f65 ("watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)")
Signed-off-by: Yingjie Gao <gaoyingjie@uniontech.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20260402071617.634563-2-gaoyingjie@uniontech.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/sp5100_tco.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
index 2bd3dc25cb0304..7e99c3b1f3676b 100644
--- a/drivers/watchdog/sp5100_tco.c
+++ b/drivers/watchdog/sp5100_tco.c
@@ -92,7 +92,8 @@ static enum tco_reg_layout tco_reg_layout(struct pci_dev *dev)
dev->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS &&
dev->revision < 0x40) {
return sp5100;
- } else if (dev->vendor == PCI_VENDOR_ID_AMD &&
+ } else if ((dev->vendor == PCI_VENDOR_ID_AMD ||
+ dev->vendor == PCI_VENDOR_ID_HYGON) &&
sp5100_tco_pci->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
sp5100_tco_pci->revision >= AMD_ZEN_SMBUS_PCI_REV) {
return efch_mmio;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0379/1266] watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0378/1266] watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0380/1266] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
` (619 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrei Simion, Balakrishnan Sambath,
Alexandre Belloni, Guenter Roeck, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
[ Upstream commit e8bc610b14a99d24b0916635102cc52ba41def9b ]
The driver hardcoded AT91_WDT_WDDIS (bit 15) in wdt_enabled and the
probe initial state readout. SAM9X60 and SAMA7G5 use bit 12
(AT91_SAM9X60_WDDIS), causing incorrect WDDIS detection.
Introduce a per-device wddis_mask field to select the correct WDDIS
bit based on the compatible string.
Fixes: 266da53c35fc ("watchdog: sama5d4: readout initial state")
Co-developed-by: Andrei Simion <andrei.simion@microchip.com>
Signed-off-by: Andrei Simion <andrei.simion@microchip.com>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20260302113310.133989-2-balakrishnan.s@microchip.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/sama5d4_wdt.c | 48 +++++++++++++++-------------------
1 file changed, 21 insertions(+), 27 deletions(-)
diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
index 13e72918338a20..704b786cc2ec63 100644
--- a/drivers/watchdog/sama5d4_wdt.c
+++ b/drivers/watchdog/sama5d4_wdt.c
@@ -30,6 +30,7 @@ struct sama5d4_wdt {
void __iomem *reg_base;
u32 mr;
u32 ir;
+ u32 wddis_mask;
unsigned long last_ping;
bool need_irq;
bool sam9x60_support;
@@ -48,7 +49,10 @@ MODULE_PARM_DESC(nowayout,
"Watchdog cannot be stopped once started (default="
__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-#define wdt_enabled (!(wdt->mr & AT91_WDT_WDDIS))
+static inline bool wdt_enabled(struct sama5d4_wdt *wdt)
+{
+ return !(wdt->mr & wdt->wddis_mask);
+}
#define wdt_read(wdt, field) \
readl_relaxed((wdt)->reg_base + (field))
@@ -81,12 +85,9 @@ static int sama5d4_wdt_start(struct watchdog_device *wdd)
{
struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
- if (wdt->sam9x60_support) {
+ if (wdt->sam9x60_support)
writel_relaxed(wdt->ir, wdt->reg_base + AT91_SAM9X60_IER);
- wdt->mr &= ~AT91_SAM9X60_WDDIS;
- } else {
- wdt->mr &= ~AT91_WDT_WDDIS;
- }
+ wdt->mr &= ~wdt->wddis_mask;
wdt_write(wdt, AT91_WDT_MR, wdt->mr);
return 0;
@@ -96,12 +97,9 @@ static int sama5d4_wdt_stop(struct watchdog_device *wdd)
{
struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
- if (wdt->sam9x60_support) {
+ if (wdt->sam9x60_support)
writel_relaxed(wdt->ir, wdt->reg_base + AT91_SAM9X60_IDR);
- wdt->mr |= AT91_SAM9X60_WDDIS;
- } else {
- wdt->mr |= AT91_WDT_WDDIS;
- }
+ wdt->mr |= wdt->wddis_mask;
wdt_write(wdt, AT91_WDT_MR, wdt->mr);
return 0;
@@ -117,7 +115,7 @@ static int sama5d4_wdt_ping(struct watchdog_device *wdd)
}
static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
- unsigned int timeout)
+ unsigned int timeout)
{
struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
u32 value = WDT_SEC2TICKS(timeout);
@@ -140,8 +138,8 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
* If the watchdog is enabled, then the timeout can be updated. Else,
* wait that the user enables it.
*/
- if (wdt_enabled)
- wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
+ if (wdt_enabled(wdt))
+ wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~wdt->wddis_mask);
wdd->timeout = timeout;
@@ -184,10 +182,7 @@ static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt)
{
const char *tmp;
- if (wdt->sam9x60_support)
- wdt->mr = AT91_SAM9X60_WDDIS;
- else
- wdt->mr = AT91_WDT_WDDIS;
+ wdt->mr = wdt->wddis_mask;
if (!of_property_read_string(np, "atmel,watchdog-type", &tmp) &&
!strcmp(tmp, "software"))
@@ -213,15 +208,11 @@ static int sama5d4_wdt_init(struct sama5d4_wdt *wdt)
* If the watchdog is already running, we can safely update it.
* Else, we have to disable it properly.
*/
- if (!wdt_enabled) {
+ if (!wdt_enabled(wdt)) {
reg = wdt_read(wdt, AT91_WDT_MR);
- if (wdt->sam9x60_support && (!(reg & AT91_SAM9X60_WDDIS)))
- wdt_write_nosleep(wdt, AT91_WDT_MR,
- reg | AT91_SAM9X60_WDDIS);
- else if (!wdt->sam9x60_support &&
- (!(reg & AT91_WDT_WDDIS)))
+ if (!(reg & wdt->wddis_mask))
wdt_write_nosleep(wdt, AT91_WDT_MR,
- reg | AT91_WDT_WDDIS);
+ reg | wdt->wddis_mask);
}
if (wdt->sam9x60_support) {
@@ -273,6 +264,9 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
of_device_is_compatible(dev->of_node, "microchip,sama7g5-wdt"))
wdt->sam9x60_support = true;
+ wdt->wddis_mask = wdt->sam9x60_support ? AT91_SAM9X60_WDDIS
+ : AT91_WDT_WDDIS;
+
watchdog_set_drvdata(wdd, wdt);
regs = devm_platform_ioremap_resource(pdev, 0);
@@ -306,8 +300,8 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
watchdog_init_timeout(wdd, wdt_timeout, dev);
reg = wdt_read(wdt, AT91_WDT_MR);
- if (!(reg & AT91_WDT_WDDIS)) {
- wdt->mr &= ~AT91_WDT_WDDIS;
+ if (!(reg & wdt->wddis_mask)) {
+ wdt->mr &= ~wdt->wddis_mask;
set_bit(WDOG_HW_RUNNING, &wdd->status);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0380/1266] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0379/1266] watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0381/1266] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
` (618 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Guenter Roeck, Baolin Wang,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 96b3cfc3b8ad0524d12fed1e08bc5df3ff345f64 ]
The driver uses devm_add_action_or_reset() to register sprd_wdt_disable()
as a managed cleanup action.
When devm_watchdog_register_device() fails, the devm core will invoke
the cleanup action automatically.
The explicit sprd_wdt_disable() call in the error path is therefore
redundant and results in adouble cleanup.
Fixes: 78d9bfad2e89 ("watchdog: sprd_wdt: Convert to use device managed functions and other improvements")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260223-sprd_wdt-v1-1-2e71f9a76ecb@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/sprd_wdt.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index 4e689b6ff1418c..aacf04616fefe2 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -320,10 +320,9 @@ static int sprd_wdt_probe(struct platform_device *pdev)
watchdog_init_timeout(&wdt->wdd, 0, dev);
ret = devm_watchdog_register_device(dev, &wdt->wdd);
- if (ret) {
- sprd_wdt_disable(wdt);
+ if (ret)
return ret;
- }
+
platform_set_drvdata(pdev, wdt);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0381/1266] media: cedrus: Fix failure to clean up hardware on probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0380/1266] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0382/1266] media: v4l2-common: Add YUV24 format info Greg Kroah-Hartman
` (617 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Andrey Skvortsov,
Paul Kocialkowski, Nicolas Dufresne, Hans Verkuil, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit f0a22f1d602ed499a192284de5e811a73421f0c7 ]
If V4L2 device fails to register, then SRAM still be claimed and as a
result driver will not be able to probe again.
cedrus 1c0e000.video-codec: Failed to claim SRAM
cedrus 1c0e000.video-codec: Failed to probe hardware
cedrus 1c0e000.video-codec: probe with driver cedrus failed with error -16
cedrus_hw_remove undoes everything that was previously done by
cedrus_hw_probe, such as disabling runtime power management and
releasing the claimed SRAM and reserved memory region.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
Acked-by: Paul Kocialkowski <paulk@sys-base.io>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 8e248d4a0aecfc..a0f9f4a5b03a12 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -478,7 +478,7 @@ static int cedrus_probe(struct platform_device *pdev)
ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
if (ret) {
dev_err(&pdev->dev, "Failed to register V4L2 device\n");
- return ret;
+ goto err_hw;
}
vfd = &dev->vfd;
@@ -539,6 +539,8 @@ static int cedrus_probe(struct platform_device *pdev)
v4l2_m2m_release(dev->m2m_dev);
err_v4l2:
v4l2_device_unregister(&dev->v4l2_dev);
+err_hw:
+ cedrus_hw_remove(dev);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0382/1266] media: v4l2-common: Add YUV24 format info
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0381/1266] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0383/1266] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
` (616 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nas Chung, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nas Chung <nas.chung@chipsnmedia.com>
[ Upstream commit 968b741872914a15363af0daf24ed2e82ec355f3 ]
The YUV24 format is missing an entry in the v4l2_format_info().
The YUV24 format is the packed YUV 4:4:4 formats with 8 bits
per component.
Fixes: 0376a51fbe5e ("media: v4l: Add packed YUV444 24bpp pixel format")
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-common.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c
index b37507e093399c..da6dc7e737ef17 100644
--- a/drivers/media/v4l2-core/v4l2-common.c
+++ b/drivers/media/v4l2-core/v4l2-common.c
@@ -262,6 +262,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format)
{ .format = V4L2_PIX_FMT_VYUY, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_Y212, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 4, 0, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_YUV48_12, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 6, 0, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
+ { .format = V4L2_PIX_FMT_YUV24, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 3, 0, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
{ .format = V4L2_PIX_FMT_MT2110T, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 5, 10, 0, 0 }, .bpp_div = { 4, 4, 1, 1 }, .hdiv = 2, .vdiv = 2,
.block_w = { 16, 8, 0, 0 }, .block_h = { 32, 16, 0, 0 }},
{ .format = V4L2_PIX_FMT_MT2110R, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 5, 10, 0, 0 }, .bpp_div = { 4, 4, 1, 1 }, .hdiv = 2, .vdiv = 2,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0383/1266] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0382/1266] media: v4l2-common: Add YUV24 format info Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0384/1266] arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc Greg Kroah-Hartman
` (615 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Andre Przywara,
Linus Walleij, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 334f7bcbdc79dc8e5b938ac3372453a5368221cf ]
In the error path of sunxi_pmx_request(), the code calls
regulator_put(s_reg->regulator) to release the regulator. However,
s_reg->regulator is only assigned after a successful regulator_enable().
This causes a memory leak: the regulator obtained via regulator_get()
is never properly released when regulator_enable() fails.
Fixes: dc1445584177 ("pinctrl: sunxi: Fix and simplify pin bank regulator handling")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index fc11c3d55fa8c0..c5b954c9537dbc 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -880,7 +880,7 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
return 0;
out:
- regulator_put(s_reg->regulator);
+ regulator_put(reg);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0384/1266] arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0383/1266] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0385/1266] arm64: dts: imx8x-colibri: Correct SODIMM PAD settings Greg Kroah-Hartman
` (614 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weixin Guo, Heiko Stuebner,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weixin Guo <2298701336@qq.com>
[ Upstream commit 460bac478c5fe69054ffc60d607bba03bcaf909b ]
The RK809 PMIC interrupt pin on the Firefly ROC-RK3566-PC (Station M2)
is physically connected to GPIO0_A3 (RK_PA3) according to the board's
schematic.
Currently, the PMIC node incorrectly specifies RK_PA7 for the interrupt,
which prevents the PMIC from correctly signaling interrupts. (Note that
the pinctrl node 'pmic_int' correctly configures RK_PA3).
Fix this by updating the interrupts property to use RK_PA3.
Fixes: 30ac9b4e25d8 ("arm64: dts: rockchip: add dts for Firefly Station M2 rk3566")
Signed-off-by: Weixin Guo <2298701336@qq.com>
Link: https://patch.msgid.link/tencent_5035EEE630C845B1B51DEA4284DE23DCCE06@qq.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
index 68a72ac24cd4b4..5d0bcabc51964c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
@@ -244,7 +244,7 @@ rk809: pmic@20 {
compatible = "rockchip,rk809";
reg = <0x20>;
interrupt-parent = <&gpio0>;
- interrupts = <RK_PA7 IRQ_TYPE_LEVEL_LOW>;
+ interrupts = <RK_PA3 IRQ_TYPE_LEVEL_LOW>;
clock-output-names = "rk808-clkout1", "rk808-clkout2";
assigned-clocks = <&cru I2S1_MCLKOUT_TX>;
assigned-clock-parents = <&cru CLK_I2S1_8CH_TX>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0385/1266] arm64: dts: imx8x-colibri: Correct SODIMM PAD settings
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0384/1266] arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0386/1266] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() Greg Kroah-Hartman
` (613 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Daniel Baluta,
Alexander Stein, Frank Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 0a03ee38a262cab0d9754e9947d565e089a9f7a5 ]
SION is BIT(30), not BIT(26). Correct it.
Fixes: 7ece3cbc8b1ef ("arm64: dts: colibri-imx8x: Add atmel pinctrl groups")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi b/arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi
index 49d105eb476919..b7986605119efb 100644
--- a/arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8x-colibri.dtsi
@@ -383,12 +383,12 @@ pinctrl_adc0: adc0grp {
*/
pinctrl_atmel_adap: atmeladaptergrp {
fsl,pins = <IMX8QXP_UART1_RX_LSIO_GPIO0_IO22 0x21>, /* SODIMM 30 */
- <IMX8QXP_UART1_TX_LSIO_GPIO0_IO21 0x4000021>; /* SODIMM 28 */
+ <IMX8QXP_UART1_TX_LSIO_GPIO0_IO21 0x40000021>; /* SODIMM 28 */
};
/* Atmel MXT touchsceen + boards with built-in Capacitive Touch Connector */
pinctrl_atmel_conn: atmelconnectorgrp {
- fsl,pins = <IMX8QXP_QSPI0B_DATA2_LSIO_GPIO3_IO20 0x4000021>, /* SODIMM 107 */
+ fsl,pins = <IMX8QXP_QSPI0B_DATA2_LSIO_GPIO3_IO20 0x40000021>, /* SODIMM 107 */
<IMX8QXP_QSPI0B_SS1_B_LSIO_GPIO3_IO24 0x21>; /* SODIMM 106 */
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0386/1266] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0385/1266] arm64: dts: imx8x-colibri: Correct SODIMM PAD settings Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0387/1266] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
` (612 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 30a45c0bffdd62350261e2f2689fdba426a33578 ]
udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().
Fixes: 5602c48cf875 ("vxlan: change vxlan to use UDP socket GRO")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260502031401.3557229-7-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan/vxlan_core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 958d3be4f99086..1a3a00476a9368 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -680,14 +680,18 @@ static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
struct sk_buff *skb,
struct gro_remcsum *grc)
{
- struct sk_buff *p;
struct vxlanhdr *vh, *vh2;
unsigned int hlen, off_vx;
- struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
+ struct vxlan_sock *vs;
+ struct sk_buff *p;
__be32 flags;
skb_gro_remcsum_init(grc);
+ vs = rcu_dereference_sk_user_data(sk);
+ if (!vs)
+ return NULL;
+
off_vx = skb_gro_offset(skb);
hlen = off_vx + sizeof(*vh);
vh = skb_gro_header(skb, hlen, off_vx);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0387/1266] crypto: atmel-sha204a - fix blocking and non-blocking rng logic
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0386/1266] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0388/1266] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
` (611 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Lothar Rubusch,
Thorsten Blum, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lothar Rubusch <l.rubusch@gmail.com>
[ Upstream commit 319400fc5ee15db5793aa45f854968141326effc ]
The blocking and non-blocking paths were failing to provide valid entropy
due to improper buffer management. Reading the buffer starting from byte 1,
only fetch the 32 bytes of random data from the return message.
Tested on an Atmel SHA204A device.
Before (here for blocking), tests showed repeatedly reading reduced bytes.
$ head -c 32 /dev/hwrng | hexdump -C
00000000 02 28 85 b3 47 40 f2 ee 00 00 00 00 00 00 00 00 |.(..G@..........|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000020
After, the result will be similar to the following:
$ head -c 32 /dev/hwrng | hexdump -C
00000000 5a fc 3f 13 14 68 fe 06 68 0a bd 04 83 6e 09 69 |Z.?..h..h....n.i|
00000010 75 ff cf 87 10 84 3b c9 c1 df ae eb 45 53 4c c3 |u.....;.....ESL.|
00000020
Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com>
Tested-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-sha204a.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c
index 2cf5407818f146..68e9e2897e7fd8 100644
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -47,8 +47,8 @@ static int atmel_sha204a_rng_read_nonblocking(struct hwrng *rng, void *data,
if (rng->priv) {
work_data = (struct atmel_i2c_work_data *)rng->priv;
- max = min(sizeof(work_data->cmd.data), max);
- memcpy(data, &work_data->cmd.data, max);
+ max = min(RANDOM_RSP_SIZE - CMD_OVERHEAD_SIZE, max);
+ memcpy(data, &work_data->cmd.data[RSP_DATA_IDX], max);
rng->priv = 0;
} else {
work_data = kmalloc(sizeof(*work_data), GFP_ATOMIC);
@@ -86,8 +86,8 @@ static int atmel_sha204a_rng_read(struct hwrng *rng, void *data, size_t max,
if (ret)
return ret;
- max = min(sizeof(cmd.data), max);
- memcpy(data, cmd.data, max);
+ max = min(RANDOM_RSP_SIZE - CMD_OVERHEAD_SIZE, max);
+ memcpy(data, &cmd.data[RSP_DATA_IDX], max);
return max;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0388/1266] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0387/1266] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0389/1266] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
` (610 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Lukas Wunner,
Vitaly Chikunov, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 2d7b2cfc59998baf5e8622a24dc28f69a5212e06 ]
The ->curve_oid check in ecrdsa_param_curve() rejects the valid enum
value 0 (OID_id_dsa_with_sha1), but look_up_OID() returns OID__NR on
lookup failure. Compare ->curve_oid with OID__NR instead to ensure that
only unknown OIDs return -EINVAL.
Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ecrdsa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/ecrdsa.c b/crypto/ecrdsa.c
index 3811f3805b5d88..38271526d1f8d8 100644
--- a/crypto/ecrdsa.c
+++ b/crypto/ecrdsa.c
@@ -153,7 +153,7 @@ int ecrdsa_param_curve(void *context, size_t hdrlen, unsigned char tag,
struct ecrdsa_ctx *ctx = context;
ctx->curve_oid = look_up_OID(value, vlen);
- if (!ctx->curve_oid)
+ if (ctx->curve_oid == OID__NR)
return -EINVAL;
ctx->curve = get_curve_by_oid(ctx->curve_oid);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0389/1266] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0388/1266] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0390/1266] dlm: fix add msg handle in send_queue ordered Greg Kroah-Hartman
` (609 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi, Herbert Xu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit f7dd32c5179d7755de18e21d5674b08f9e5cb180 ]
pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
Call Trace:
<TASK>
__sha256_update (lib/crypto/sha256.c:208)
crypto_sha256_update (crypto/sha256.c:142)
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
__do_sys_kexec_file_load (kernel/kexec_file.c:406)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
Fixes: af316fc442ef ("pefile: Digest the PE binary and compare to the PKCS#7 data")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/verify_pefile.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index f440767bd72763..e20a106e7443c1 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -305,6 +305,8 @@ static int pefile_digest_pe_contents(const void *pebuf, unsigned int pelen,
if (pelen > hashed_bytes) {
tmp = hashed_bytes + ctx->certs_size;
+ if (tmp <= hashed_bytes || pelen < tmp)
+ return -ELIBBAD;
ret = crypto_shash_update(desc,
pebuf + hashed_bytes,
pelen - tmp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0390/1266] dlm: fix add msg handle in send_queue ordered
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0389/1266] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0391/1266] nilfs2: fix backing_dev_info reference leak Greg Kroah-Hartman
` (608 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Aring, David Teigland,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit d2248cb70c070f8f04762872772e155b59016f17 ]
In a benchmark scenario triggering a lot of requests that triggers a lot
of DLM messages on the network it can be that the mh->seq is not ordered
according the oldest seq number. This ordering is required by
dlm_receive_ack as "before(mh->seq, seq)" will stop to check for older
sequence numbers that are ordered in the tail of "node->send_queue".
The side effects of not having it correct ordered regarding
"before(mh->seq, seq)" are refcounting issues and use-after free.
I only was able to reproduce this issue in a experimental DLM branch
and a user space DLM benchmark that uses io_uring. After changing this I
don't experienced any refcounting with the sending buffer issues anymore.
Fixes: 489d8e559c659 ("fs: dlm: add reliable connection if reconnect")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/midcomms.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c
index 2247ebb61be1ee..6a6ccf2f8db52e 100644
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -970,10 +970,10 @@ static void midcomms_new_msg_cb(void *data)
atomic_inc(&mh->node->send_queue_cnt);
spin_lock_bh(&mh->node->send_queue_lock);
+ /* need to be locked with list_add_tail_rcu() because list is ordered */
+ mh->seq = atomic_fetch_inc(&mh->node->seq_send);
list_add_tail_rcu(&mh->list, &mh->node->send_queue);
spin_unlock_bh(&mh->node->send_queue_lock);
-
- mh->seq = atomic_fetch_inc(&mh->node->seq_send);
}
static struct dlm_msg *dlm_midcomms_get_msg_3_2(struct dlm_mhandle *mh, int nodeid,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0391/1266] nilfs2: fix backing_dev_info reference leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0390/1266] dlm: fix add msg handle in send_queue ordered Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0392/1266] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
` (607 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Ryusuke Konishi,
Viacheslav Dubeyko, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ Upstream commit 665f192a2a11384cb7dc1be5f87d16438522a4ed ]
setup_bdev_super() already initializes sb->s_bdev and takes a
reference on the block device backing_dev_info when assigning sb->s_bdi.
nilfs_fill_super() takes another reference to the same
backing_dev_info and stores it in sb->s_bdi again. The extra
reference is not paired with a matching bdi_put(), since
generic_shutdown_super() releases sb->s_bdi only once.
Drop the redundant bdi_get() in nilfs_fill_super(). The single
reference taken by setup_bdev_super() is enough and is released
during superblock shutdown.
Fixes: c1e012ea9e83 ("nilfs2: use setup_bdev_super to de-duplicate the mount code")
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/super.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index a5d1fa4e7552f6..e14039ac792fe0 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -1086,8 +1086,6 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent)
sb->s_time_gran = 1;
sb->s_max_links = NILFS_LINK_MAX;
- sb->s_bdi = bdi_get(sb->s_bdev->bd_disk->bdi);
-
err = load_nilfs(nilfs, sb);
if (err)
goto failed_nilfs;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0392/1266] iommu/amd: Fix a stale comment about which legacy mode is user visible
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0391/1266] nilfs2: fix backing_dev_info reference leak Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0393/1266] arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host Greg Kroah-Hartman
` (606 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Vasant Hegde,
Wei Wang, Joerg Roedel, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit 4bf53c2d0c08bbdaa32f2114281f1ddab61902bf ]
Update a stale comment about which of the legacy modes is visible to the
user, i.e. can be forced via amd_iommu_intr=legacy.
Fixes: b74aa02d7a30 ("iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Wei Wang <wei.w.wang@hotmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/amd_iommu_types.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index 2571a782b7b61d..d81defd49949ce 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -926,12 +926,13 @@ static inline int get_hpet_devid(int id)
}
enum amd_iommu_intr_mode_type {
- AMD_IOMMU_GUEST_IR_LEGACY,
-
- /* This mode is not visible to users. It is used when
- * we cannot fully enable vAPIC and fallback to only support
- * legacy interrupt remapping via 128-bit IRTE.
+ /*
+ * The legacy format mode is not visible to users to prevent the user
+ * from crashing x2APIC systems, which for all intents and purposes
+ * require 128-bit IRTEs. The legacy format will be forced as needed
+ * when hardware doesn't support 128-bit IRTEs.
*/
+ AMD_IOMMU_GUEST_IR_LEGACY,
AMD_IOMMU_GUEST_IR_LEGACY_GA,
AMD_IOMMU_GUEST_IR_VAPIC,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0393/1266] arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0392/1266] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0394/1266] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
` (605 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit 533275a4b5240a2bf2c592bd4536560388306d26 ]
The DMA bounce buffer is attached to the PCIe host controller, i.e. all
PCIe DMA transfers should use it.
Move it from the PCIe (WiFi) device node down to the PCIe host
controller node.
Fixes: 0dca9f0b3e63 ("arm64: dts: mediatek: asurada: Enable PCIe and add WiFi")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
index 54e3ec168fa9a4..0788db329b785e 100644
--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
@@ -494,6 +494,7 @@ flash@0 {
&pcie {
pinctrl-names = "default";
pinctrl-0 = <&pcie_pins>;
+ memory-region = <&wifi_restricted_dma_region>;
pcie0: pcie@0,0 {
device_type = "pci";
@@ -508,7 +509,6 @@ pcie0: pcie@0,0 {
wifi: wifi@0,0 {
reg = <0x10000 0 0 0 0x100000>,
<0x10000 0 0x100000 0 0x100000>;
- memory-region = <&wifi_restricted_dma_region>;
};
};
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0394/1266] clk: scmi: Fix clock rate rounding
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0393/1266] arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0395/1266] arm64: dts: qcom: sm8450: Fix ICE reg size Greg Kroah-Hartman
` (604 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Turquette, Stephen Boyd,
linux-clk, Cristian Marussi, Florian Fainelli, Geert Uytterhoeven,
Brian Masney, Sudeep Holla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <cristian.marussi@arm.com>
[ Upstream commit d0c81a38d06d446d341532700b3a4a43d3b00eb1 ]
While the do_div() helper used for rounding expects its divisor argument
to be a 32bits quantity, the currently provided divisor parameter is a
64bit value that, as a consequence, is silently truncated and a possible
source of bugs.
Fix by using the proper div64_ul helper.
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Fixes: 7a8655e19bdb ("clk: scmi: Fix the rounding of clock rate")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260508153300.2224715-2-cristian.marussi@arm.com
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-scmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
index fdec715c9ba9b3..096b0691661961 100644
--- a/drivers/clk/clk-scmi.c
+++ b/drivers/clk/clk-scmi.c
@@ -9,9 +9,9 @@
#include <linux/device.h>
#include <linux/err.h>
#include <linux/of.h>
+#include <linux/math64.h>
#include <linux/module.h>
#include <linux/scmi_protocol.h>
-#include <asm/div64.h>
static const struct scmi_clk_proto_ops *scmi_proto_clk_ops;
@@ -61,7 +61,7 @@ static long scmi_clk_round_rate(struct clk_hw *hw, unsigned long rate,
ftmp = rate - fmin;
ftmp += clk->info->range.step_size - 1; /* to round up */
- do_div(ftmp, clk->info->range.step_size);
+ ftmp = div64_ul(ftmp, clk->info->range.step_size);
return ftmp * clk->info->range.step_size + fmin;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0395/1266] arm64: dts: qcom: sm8450: Fix ICE reg size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0394/1266] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0396/1266] drm/hisilicon/hibmc: move display contrl config to hibmc_probe() Greg Kroah-Hartman
` (603 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuldeep Singh, Harshal Dev,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
[ Upstream commit 7fb3d0512dacc0d09217eb45057357f00298203d ]
The ICE register region size was originally described incorrectly when
the ICE hardware was first introduced. The same value was later carried
over unchanged when the ICE node was split out from the UFS node into
its own DT entry.
Correct the register size to match the hardware specification.
Fixes: 276ee34a40c1 ("arm64: dts: qcom: sm8450: add Inline Crypto Engine registers and clock")
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260402-ice_dt_reg_fix-v1-2-74e4c2129238@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
index c1c62c6d34bd1d..e6c6db754abb62 100644
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -4223,7 +4223,7 @@ ufs_mem_phy_lanes: phy@1d87400 {
ice: crypto@1d88000 {
compatible = "qcom,sm8450-inline-crypto-engine",
"qcom,inline-crypto-engine";
- reg = <0 0x01d88000 0 0x8000>;
+ reg = <0 0x01d88000 0 0x18000>;
clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0396/1266] drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0395/1266] arm64: dts: qcom: sm8450: Fix ICE reg size Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0397/1266] drm/hisilicon/hibmc: use clock to look up the PLL value Greg Kroah-Hartman
` (602 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin He, Yongbang Shi,
Thomas Zimmermann, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin He <helin52@huawei.com>
[ Upstream commit de2a56c71f9b223922ea8fe0192d3c1fa2954608 ]
If there's no VGA output, this encoder modeset won't be called, which
will cause displaying data from GPU being cut off. It's actually a
common display config for DP and VGA, so move the vdac encoder modeset
to driver load stage.
Removed invalid bit configurations from `hibmc_display_ctrl`
Fixes: 5294967f4ae4 ("drm/hisilicon/hibmc: Add support for VDAC")
Signed-off-by: Lin He <helin52@huawei.com>
Signed-off-by: Yongbang Shi <shiyongbang@huawei.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260509032302.2057227-4-shiyongbang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 11 ++++++++++
.../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 22 -------------------
2 files changed, 11 insertions(+), 22 deletions(-)
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
index 96f960bcfd82d3..e36cc8593df85b 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
@@ -174,6 +174,15 @@ void hibmc_set_current_gate(struct hibmc_drm_private *priv, unsigned int gate)
writel(gate, mmio + gate_reg);
}
+static void hibmc_display_ctrl(struct hibmc_drm_private *priv)
+{
+ u32 reg;
+
+ reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE);
+ reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1);
+ writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE);
+}
+
static void hibmc_hw_config(struct hibmc_drm_private *priv)
{
u32 reg;
@@ -205,6 +214,8 @@ static void hibmc_hw_config(struct hibmc_drm_private *priv)
reg |= HIBMC_MSCCTL_LOCALMEM_RESET(1);
writel(reg, priv->mmio + HIBMC_MISC_CTRL);
+
+ hibmc_display_ctrl(priv);
}
static int hibmc_hw_map(struct hibmc_drm_private *priv)
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c
index 8c6d2ea2a4729f..6dc5a9fc429fff 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c
@@ -66,26 +66,6 @@ static const struct drm_connector_funcs hibmc_connector_funcs = {
.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
};
-static void hibmc_encoder_mode_set(struct drm_encoder *encoder,
- struct drm_display_mode *mode,
- struct drm_display_mode *adj_mode)
-{
- u32 reg;
- struct drm_device *dev = encoder->dev;
- struct hibmc_drm_private *priv = to_hibmc_drm_private(dev);
-
- reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE);
- reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1);
- reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1);
- reg |= HIBMC_DISPLAY_CONTROL_FPEN(1);
- reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1);
- writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE);
-}
-
-static const struct drm_encoder_helper_funcs hibmc_encoder_helper_funcs = {
- .mode_set = hibmc_encoder_mode_set,
-};
-
int hibmc_vdac_init(struct hibmc_drm_private *priv)
{
struct drm_device *dev = &priv->dev;
@@ -108,8 +88,6 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv)
return ret;
}
- drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs);
-
ret = drm_connector_init_with_ddc(dev, connector,
&hibmc_connector_funcs,
DRM_MODE_CONNECTOR_VGA,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0397/1266] drm/hisilicon/hibmc: use clock to look up the PLL value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0396/1266] drm/hisilicon/hibmc: move display contrl config to hibmc_probe() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0398/1266] evm: terminate and bound the evm_xattrs read buffer Greg Kroah-Hartman
` (601 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin He, Yongbang Shi,
Thomas Zimmermann, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin He <helin52@huawei.com>
[ Upstream commit 99ef3a4f1c1813cabd50bb3e8522e85e00838bb2 ]
In the past, we use width and height to look up our PLL value.
But actually the actual clock check is also necessnary. There are
some resolutions that width and height same, but its clock different.
Add the clock check when using pll_table to determine the PLL value.
Fixes: da52605eea8f ("drm/hisilicon/hibmc: Add support for display engine")
Signed-off-by: Lin He <helin52@huawei.com>
Signed-off-by: Yongbang Shi <shiyongbang@huawei.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260509032302.2057227-5-shiyongbang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 80 +++++++++++--------
1 file changed, 45 insertions(+), 35 deletions(-)
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
index 89bed78f14666a..db7fce4e8cc344 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c
@@ -32,26 +32,43 @@ struct hibmc_display_panel_pll {
struct hibmc_dislay_pll_config {
u64 hdisplay;
u64 vdisplay;
+ int clock;
u32 pll1_config_value;
u32 pll2_config_value;
};
static const struct hibmc_dislay_pll_config hibmc_pll_table[] = {
- {640, 480, CRT_PLL1_HS_25MHZ, CRT_PLL2_HS_25MHZ},
- {800, 600, CRT_PLL1_HS_40MHZ, CRT_PLL2_HS_40MHZ},
- {1024, 768, CRT_PLL1_HS_65MHZ, CRT_PLL2_HS_65MHZ},
- {1152, 864, CRT_PLL1_HS_80MHZ_1152, CRT_PLL2_HS_80MHZ},
- {1280, 768, CRT_PLL1_HS_80MHZ, CRT_PLL2_HS_80MHZ},
- {1280, 720, CRT_PLL1_HS_74MHZ, CRT_PLL2_HS_74MHZ},
- {1280, 960, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
- {1280, 1024, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
- {1440, 900, CRT_PLL1_HS_106MHZ, CRT_PLL2_HS_106MHZ},
- {1600, 900, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
- {1600, 1200, CRT_PLL1_HS_162MHZ, CRT_PLL2_HS_162MHZ},
- {1920, 1080, CRT_PLL1_HS_148MHZ, CRT_PLL2_HS_148MHZ},
- {1920, 1200, CRT_PLL1_HS_193MHZ, CRT_PLL2_HS_193MHZ},
+ {640, 480, 25000, CRT_PLL1_HS_25MHZ, CRT_PLL2_HS_25MHZ},
+ {800, 600, 40000, CRT_PLL1_HS_40MHZ, CRT_PLL2_HS_40MHZ},
+ {1024, 768, 65000, CRT_PLL1_HS_65MHZ, CRT_PLL2_HS_65MHZ},
+ {1152, 864, 78750, CRT_PLL1_HS_80MHZ_1152, CRT_PLL2_HS_80MHZ},
+ {1280, 768, 80000, CRT_PLL1_HS_80MHZ, CRT_PLL2_HS_80MHZ},
+ {1280, 720, 74375, CRT_PLL1_HS_74MHZ, CRT_PLL2_HS_74MHZ},
+ {1280, 960, 108000, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
+ {1280, 1024, 108000, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
+ {1440, 900, 105952, CRT_PLL1_HS_106MHZ, CRT_PLL2_HS_106MHZ},
+ {1600, 900, 108000, CRT_PLL1_HS_108MHZ, CRT_PLL2_HS_108MHZ},
+ {1600, 1200, 162500, CRT_PLL1_HS_162MHZ, CRT_PLL2_HS_162MHZ},
+ {1920, 1080, 148750, CRT_PLL1_HS_148MHZ, CRT_PLL2_HS_148MHZ},
+ {1920, 1200, 193750, CRT_PLL1_HS_193MHZ, CRT_PLL2_HS_193MHZ},
};
+static int hibmc_get_best_clock_idx(const struct drm_display_mode *mode)
+{
+ int i, diff;
+
+ for (i = 0; i < ARRAY_SIZE(hibmc_pll_table); i++) {
+ if (hibmc_pll_table[i].hdisplay == mode->hdisplay &&
+ hibmc_pll_table[i].vdisplay == mode->vdisplay) {
+ diff = abs(mode->clock - hibmc_pll_table[i].clock);
+ if (diff < mode->clock / 100) /* tolerance 1/100 */
+ return i;
+ }
+ }
+
+ return -MODE_CLOCK_RANGE;
+}
+
static int hibmc_plane_atomic_check(struct drm_plane *plane,
struct drm_atomic_state *state)
{
@@ -214,19 +231,15 @@ static enum drm_mode_status
hibmc_crtc_mode_valid(struct drm_crtc *crtc,
const struct drm_display_mode *mode)
{
- size_t i = 0;
int vrefresh = drm_mode_vrefresh(mode);
if (vrefresh < 59 || vrefresh > 61)
return MODE_NOCLOCK;
- for (i = 0; i < ARRAY_SIZE(hibmc_pll_table); i++) {
- if (hibmc_pll_table[i].hdisplay == mode->hdisplay &&
- hibmc_pll_table[i].vdisplay == mode->vdisplay)
- return MODE_OK;
- }
+ if (hibmc_get_best_clock_idx(mode) >= 0)
+ return MODE_OK;
- return MODE_BAD;
+ return MODE_CLOCK_RANGE;
}
static u32 format_pll_reg(void)
@@ -281,23 +294,20 @@ static void set_vclock_hisilicon(struct drm_device *dev, u64 pll)
writel(val, priv->mmio + CRT_PLL1_HS);
}
-static void get_pll_config(u64 x, u64 y, u32 *pll1, u32 *pll2)
+static void get_pll_config(struct drm_display_mode *mode, u32 *pll1, u32 *pll2)
{
- size_t i;
- size_t count = ARRAY_SIZE(hibmc_pll_table);
-
- for (i = 0; i < count; i++) {
- if (hibmc_pll_table[i].hdisplay == x &&
- hibmc_pll_table[i].vdisplay == y) {
- *pll1 = hibmc_pll_table[i].pll1_config_value;
- *pll2 = hibmc_pll_table[i].pll2_config_value;
- return;
- }
+ int idx;
+
+ idx = hibmc_get_best_clock_idx(mode);
+ if (idx < 0) {
+ /* if found none, we use default value */
+ *pll1 = CRT_PLL1_HS_25MHZ;
+ *pll2 = CRT_PLL2_HS_25MHZ;
+ return;
}
- /* if found none, we use default value */
- *pll1 = CRT_PLL1_HS_25MHZ;
- *pll2 = CRT_PLL2_HS_25MHZ;
+ *pll1 = hibmc_pll_table[idx].pll1_config_value;
+ *pll2 = hibmc_pll_table[idx].pll2_config_value;
}
/*
@@ -319,7 +329,7 @@ static u32 display_ctrl_adjust(struct drm_device *dev,
x = mode->hdisplay;
y = mode->vdisplay;
- get_pll_config(x, y, &pll1, &pll2);
+ get_pll_config(mode, &pll1, &pll2);
writel(pll2, priv->mmio + CRT_PLL2_HS);
set_vclock_hisilicon(dev, pll1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0398/1266] evm: terminate and bound the evm_xattrs read buffer
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0397/1266] drm/hisilicon/hibmc: use clock to look up the PLL value Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0399/1266] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
` (600 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Roberto Sassu,
Mimi Zohar, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 11143a19f5b8dc8f414deab87571134f9f447313 ]
evm_read_xattrs() allocates size + 1 bytes, fills them from the list of
enabled xattrs, and then passes strlen(temp) to
simple_read_from_buffer(). When no configured xattrs are enabled, the
fill loop stores nothing and temp[0] remains uninitialized, so strlen()
reads beyond initialized memory.
Explicitly terminate the buffer after allocation, use snprintf() for
each formatted line, and pass the accumulated length, without risk of
truncation, to simple_read_from_buffer().
Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/evm/evm_secfs.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index 9b907c2fee60b6..07c6982e1faca8 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -128,8 +128,8 @@ static ssize_t evm_read_xattrs(struct file *filp, char __user *buf,
size_t count, loff_t *ppos)
{
char *temp;
- int offset = 0;
- ssize_t rc, size = 0;
+ size_t offset = 0, size = 0;
+ ssize_t rc;
struct xattr_list *xattr;
if (*ppos != 0)
@@ -152,16 +152,22 @@ static ssize_t evm_read_xattrs(struct file *filp, char __user *buf,
return -ENOMEM;
}
+ temp[size] = '\0';
+
+ /*
+ * No truncation possible: size is computed over the same enabled
+ * xattrs under xattr_list_mutex, so offset never exceeds size.
+ */
list_for_each_entry(xattr, &evm_config_xattrnames, list) {
if (!xattr->enabled)
continue;
- sprintf(temp + offset, "%s\n", xattr->name);
- offset += strlen(xattr->name) + 1;
+ offset += snprintf(temp + offset, size + 1 - offset, "%s\n",
+ xattr->name);
}
mutex_unlock(&xattr_list_mutex);
- rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
+ rc = simple_read_from_buffer(buf, count, ppos, temp, offset);
kfree(temp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0399/1266] thermal: hwmon: Fix critical temperature attribute removal
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0398/1266] evm: terminate and bound the evm_xattrs read buffer Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0400/1266] clk: scpi: Unregister child clock providers on remove Greg Kroah-Hartman
` (599 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit c2114dbda05354dbcf4dfbb30a2c623e8611c43a ]
Since the return value of thermal_zone_crit_temp_valid() depends on
the behavior of the thermal zone .get_crit_temp() callback which
may change over time in theory, thermal_remove_hwmon_sysfs() may
attempt to remove a critical temperature attribute that has not
been created, passing a pointer to an uninitialized attribute
structure to device_remove_file().
To avoid that, set a flag in struct thermal_hwmon_temp after creating
a critical temperature attribute and use the value of that flag to
decide whether or not the attribute needs to be removed.
Fixes: e8db5d6736a7 ("thermal: hwmon: Make the check for critical temp valid consistent")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2437056.ElGaqSPkdT@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/thermal_hwmon.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index c3ae44659b8170..0e0c4061792cc5 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -40,6 +40,7 @@ struct thermal_hwmon_temp {
struct thermal_zone_device *tz;
struct thermal_hwmon_attr temp_input; /* hwmon sys attr */
struct thermal_hwmon_attr temp_crit; /* hwmon sys attr */
+ bool temp_crit_present;
};
static LIST_HEAD(thermal_hwmon_list);
@@ -197,6 +198,8 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
&temp->temp_crit.attr);
if (result)
goto unregister_input;
+
+ temp->temp_crit_present = true;
}
mutex_lock(&thermal_hwmon_list_lock);
@@ -241,7 +244,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
}
device_remove_file(hwmon->device, &temp->temp_input.attr);
- if (thermal_zone_crit_temp_valid(tz))
+ if (temp->temp_crit_present)
device_remove_file(hwmon->device, &temp->temp_crit.attr);
mutex_lock(&thermal_hwmon_list_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0400/1266] clk: scpi: Unregister child clock providers on remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0399/1266] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0401/1266] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
` (598 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Sudeep Holla,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit b79d9b5747d961516c35ef4d5e91efa579fd3e9a ]
SCPI clock providers are registered for each child node in
scpi_clk_add(), but scpi_clocks_remove() unregisters the parent node on
each iteration.
of_clk_del_provider() matches providers by the node used at registration
time, so passing the parent node leaves the child providers registered.
This leaks the provider allocations and the node references held by the
clock provider core.
Pass the child node to of_clk_del_provider() so the remove path matches
the probe path.
Fixes: cd52c2a4b5c4 ("clk: add support for clocks provided by SCP(System Control Processor)")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Link: https://patch.msgid.link/20260513090900.5323-1-sozdayvek@gmail.com
(sudeep.holla: Updated commit title and message a bit)
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-scpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
index 108b697bd317dc..5ab46a537b5d31 100644
--- a/drivers/clk/clk-scpi.c
+++ b/drivers/clk/clk-scpi.c
@@ -256,7 +256,7 @@ static void scpi_clocks_remove(struct platform_device *pdev)
}
for_each_available_child_of_node(np, child)
- of_clk_del_provider(np);
+ of_clk_del_provider(child);
}
static int scpi_clocks_probe(struct platform_device *pdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0401/1266] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0400/1266] clk: scpi: Unregister child clock providers on remove Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0402/1266] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
` (597 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
Toke Høiland-Jørgensen, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e300c7d470ad2726d6abf7d11b31b5d9912d9cf0 ]
hfsc_dump_class_stats() runs without qdisc spinlock being held.
Add READ_ONCE()/WRITE_ONCE() annotations around:
- cl->level
- cl->cl_vtperiod
- cl->cl_total
- cl->cl_cumul
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260513080853.1383975-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 1ac51d02499195..11ae998cda3a85 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -715,7 +715,7 @@ init_vf(struct hfsc_class *cl, unsigned int len)
rtsc_min(&cl->cl_virtual, &cl->cl_fsc, cl->cl_vt, cl->cl_total);
cl->cl_vtadj = 0;
- cl->cl_vtperiod++; /* increment vt period */
+ WRITE_ONCE(cl->cl_vtperiod, cl->cl_vtperiod + 1); /* increment vt period */
cl->cl_parentperiod = cl->cl_parent->cl_vtperiod;
if (cl->cl_parent->cl_nactive == 0)
cl->cl_parentperiod++;
@@ -757,7 +757,7 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time)
go_passive = 1;
for (; cl->cl_parent != NULL; cl = cl->cl_parent) {
- cl->cl_total += len;
+ WRITE_ONCE(cl->cl_total, cl->cl_total + len);
if (!(cl->cl_flags & HFSC_FSC) || cl->cl_nactive == 0)
continue;
@@ -847,7 +847,7 @@ hfsc_adjust_levels(struct hfsc_class *cl)
if (p->level >= level)
level = p->level + 1;
}
- cl->level = level;
+ WRITE_ONCE(cl->level, level);
} while ((cl = cl->cl_parent) != NULL);
}
@@ -1337,10 +1337,10 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
__u32 qlen;
qdisc_qstats_qlen_backlog(cl->qdisc, &qlen, &cl->qstats.backlog);
- xstats.level = cl->level;
- xstats.period = cl->cl_vtperiod;
- xstats.work = cl->cl_total;
- xstats.rtwork = cl->cl_cumul;
+ xstats.level = READ_ONCE(cl->level);
+ xstats.period = READ_ONCE(cl->cl_vtperiod);
+ xstats.work = READ_ONCE(cl->cl_total);
+ xstats.rtwork = READ_ONCE(cl->cl_cumul);
if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 ||
gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
@@ -1453,15 +1453,15 @@ hfsc_change_qdisc(struct Qdisc *sch, struct nlattr *opt,
static void
hfsc_reset_class(struct hfsc_class *cl)
{
- cl->cl_total = 0;
- cl->cl_cumul = 0;
+ WRITE_ONCE(cl->cl_total, 0);
+ WRITE_ONCE(cl->cl_cumul, 0);
cl->cl_d = 0;
cl->cl_e = 0;
cl->cl_vt = 0;
cl->cl_vtadj = 0;
cl->cl_cvtmin = 0;
cl->cl_cvtoff = 0;
- cl->cl_vtperiod = 0;
+ WRITE_ONCE(cl->cl_vtperiod, 0);
cl->cl_parentperiod = 0;
cl->cl_f = 0;
cl->cl_myf = 0;
@@ -1627,7 +1627,7 @@ hfsc_dequeue(struct Qdisc *sch)
bstats_update(&cl->bstats, skb);
update_vf(cl, qdisc_pkt_len(skb), cur_time);
if (realtime)
- cl->cl_cumul += qdisc_pkt_len(skb);
+ WRITE_ONCE(cl->cl_cumul, cl->cl_cumul + qdisc_pkt_len(skb));
if (cl->cl_flags & HFSC_RSC) {
if (cl->qdisc->q.qlen != 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0402/1266] crypto: ccp - Treat zero-length cert chain as query for blob lengths
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0401/1266] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
@ 2026-07-21 15:13 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0403/1266] spi: hisi-kunpeng: Use dev_err_probe() for host registration failure Greg Kroah-Hartman
` (596 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Tom Lendacky,
Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit ef8c9dacda2871accd64e3eda951fef6b788b1ea ]
When handling a PDH export, treat a zero-length userspace cert chain buffer
as a request to query the length of the relevant blobs. Failure to account
for the zero-length buffer trips a BUG_ON() when running with
CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the
ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation).
kernel BUG at arch/x86/mm/physaddr.c:28 !
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded
Tainted: G W 6.18.16-smp-DEV #1 NONE
Tainted: [W]=WARN
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025
RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28
RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293
RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600
RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010
RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000
R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000
FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0
Call Trace:
<TASK>
[<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308
[<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556
[<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline]
[<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline]
[<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
[<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline]
[<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98
[<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fd3158eac39
</TASK>
Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting
the physical address is just arithmetic, and the PSP errors out before
trying to write to the garbage address (which it must, otherwise querying
the blob lengths would clobber memory at pfn=0).
Fixes: 76a2b524a4b1 ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 9844ac4f9b86bd..1735729123397a 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -1016,7 +1016,8 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
/* Userspace wants to query the certificate length. */
if (!input.pdh_cert_address ||
!input.pdh_cert_len ||
- !input.cert_chain_address)
+ !input.cert_chain_address ||
+ !input.cert_chain_len)
goto cmd;
input_pdh_cert_address = (void __user *)input.pdh_cert_address;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0403/1266] spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-07-21 15:13 ` [PATCH 6.6 0402/1266] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0404/1266] net/sched: sch_htb: do not change sch->flags in htb_dump() Greg Kroah-Hartman
` (595 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qiang Ma, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Ma <maqianga@uniontech.com>
[ Upstream commit 59b991990a04b1d1ce95373983b7c8b65bdf7acc ]
When the SPI core registers the Kunpeng controller it may need to acquire
chip-select GPIO descriptors. If the GPIO provider has not probed yet,
spi_register_controller() returns -EPROBE_DEFER.
On a Kunpeng system this currently prints an alarming error even though the
next deferred-probe retry succeeds:
hisi-kunpeng-spi HISI03E1:00: failed to register spi host, ret=-517
hisi-kunpeng-spi HISI03E1:00: hw version:0x30 max-freq:12500 kHz
Use dev_err_probe() so that -EPROBE_DEFER is reported through the deferred
probe mechanism instead of as a hard error, while preserving normal error
reporting for real registration failures.
Fixes: c770d8631e18 ("spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs")
Signed-off-by: Qiang Ma <maqianga@uniontech.com>
Link: https://patch.msgid.link/20260515102620.1926930-1-maqianga@uniontech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-hisi-kunpeng.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-hisi-kunpeng.c b/drivers/spi/spi-hisi-kunpeng.c
index 77526f7940688d..6afa37d10c7c1b 100644
--- a/drivers/spi/spi-hisi-kunpeng.c
+++ b/drivers/spi/spi-hisi-kunpeng.c
@@ -518,10 +518,8 @@ static int hisi_spi_probe(struct platform_device *pdev)
}
ret = spi_register_controller(host);
- if (ret) {
- dev_err(dev, "failed to register spi host, ret=%d\n", ret);
- return ret;
- }
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to register spi host\n");
if (hisi_spi_debugfs_init(hs))
dev_info(dev, "failed to create debugfs dir\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0404/1266] net/sched: sch_htb: do not change sch->flags in htb_dump()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0403/1266] spi: hisi-kunpeng: Use dev_err_probe() for host registration failure Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0405/1266] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
` (594 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9b949fa69129e4b694ed11ee3be6d6edd4a9b8f4 ]
htb_dump() runs without holding qdisc spinlock.
It is illegal to touch sch->flags with non locked RMW,
as concurrent readers might see intermediate wrong values.
Set TCQ_F_OFFLOADED in control path (htb_init()) instead.
Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260514095935.3926276-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_htb.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c8a426062923ac..2388c1213e1d26 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1148,6 +1148,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt,
* parts (especially calling ndo_setup_tc) on errors.
*/
q->offload = true;
+ sch->flags |= TCQ_F_OFFLOADED;
return 0;
}
@@ -1208,11 +1209,6 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
struct nlattr *nest;
struct tc_htb_glob gopt;
- if (q->offload)
- sch->flags |= TCQ_F_OFFLOADED;
- else
- sch->flags &= ~TCQ_F_OFFLOADED;
-
sch->qstats.overlimits = q->overlimits;
/* Its safe to not acquire qdisc lock. As we hold RTNL,
* no change can happen on the qdisc parameters.
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0405/1266] net/sched: sch_htb: annotate data-races (I)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0404/1266] net/sched: sch_htb: do not change sch->flags in htb_dump() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0406/1266] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
` (593 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e54c33503bf7cebb1c1790251ce90f1252678081 ]
htb_dump() runs without holding qdisc spinlock.
Add missing READ_ONCE()/WRITE_ONCE() annotations around
q->overlimits and q->direct_pkts.
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260514095935.3926276-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_htb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 2388c1213e1d26..f1b903b3671748 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -568,7 +568,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff)
if (new_mode == HTB_CANT_SEND) {
cl->overlimits++;
- q->overlimits++;
+ WRITE_ONCE(q->overlimits, q->overlimits + 1);
}
if (cl->prio_activity) { /* not necessary: speed optimization */
@@ -628,7 +628,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
/* enqueue to helper queue */
if (q->direct_queue.qlen < q->direct_qlen) {
__qdisc_enqueue_tail(skb, &q->direct_queue);
- q->direct_pkts++;
+ WRITE_ONCE(q->direct_pkts, q->direct_pkts + 1);
} else {
return qdisc_drop(skb, sch, to_free);
}
@@ -1209,12 +1209,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
struct nlattr *nest;
struct tc_htb_glob gopt;
- sch->qstats.overlimits = q->overlimits;
+ sch->qstats.overlimits = READ_ONCE(q->overlimits);
/* Its safe to not acquire qdisc lock. As we hold RTNL,
* no change can happen on the qdisc parameters.
*/
- gopt.direct_pkts = q->direct_pkts;
+ gopt.direct_pkts = READ_ONCE(q->direct_pkts);
gopt.version = HTB_VER;
gopt.rate2quantum = q->rate2quantum;
gopt.defcls = q->defcls;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0406/1266] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0405/1266] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0407/1266] IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier Greg Kroah-Hartman
` (592 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Ido Schimmel,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 627ac78f2741e2ebd2225e2e953b6964a8a9182f ]
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD
via addrconf_dad_end(), which drops ifp->lock on return. The lock
is re-acquired after net_info_ratelimited(). A concurrent
ipv6_del_addr() can take the lock in that window, set ifp->state
to DEAD and run list_del_rcu(&ifp->if_list).
addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:
and schedules a new dad_work. The work calls ipv6_del_addr()
again, hitting the already-poisoned list entry:
general protection fault: 0000 [#1] SMP NOPTI
CPU: 4 PID: 217 Comm: kworker/4:1
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ipv6_del_addr+0xe9/0x280
RAX: dead000000000122
Call Trace:
addrconf_dad_stop+0x113/0x140
addrconf_dad_work+0x28c/0x430
process_one_work+0x1eb/0x3b0
worker_thread+0x4d/0x400
kthread+0x104/0x140
ret_from_fork+0x35/0x40
Fold the addrconf_dad_end() logic into addrconf_dad_failure() under
a single ifp->lock critical section. The STABLE_PRIVACY branch
temporarily drops ifp->lock around address regeneration, so at
lock_errdad: verify the state is still POSTDAD before transitioning
to ERRDAD; bail out otherwise to avoid overwriting a state set by
another path while the lock was released.
Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing to workqueue")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260513025509.3776405-1-lilinmao@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d752776da51fd8..5f32793a29eafa 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2138,16 +2138,18 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
struct inet6_dev *idev = ifp->idev;
struct net *net = dev_net(idev->dev);
- if (addrconf_dad_end(ifp)) {
+ spin_lock_bh(&ifp->lock);
+
+ if (ifp->state != INET6_IFADDR_STATE_DAD) {
+ spin_unlock_bh(&ifp->lock);
in6_ifa_put(ifp);
return;
}
+ ifp->state = INET6_IFADDR_STATE_POSTDAD;
net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n",
ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
- spin_lock_bh(&ifp->lock);
-
if (ifp->flags & IFA_F_STABLE_PRIVACY) {
struct in6_addr new_addr;
struct inet6_ifaddr *ifp2;
@@ -2195,6 +2197,11 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
in6_ifa_put(ifp2);
lock_errdad:
spin_lock_bh(&ifp->lock);
+ if (ifp->state != INET6_IFADDR_STATE_POSTDAD) {
+ spin_unlock_bh(&ifp->lock);
+ in6_ifa_put(ifp);
+ return;
+ }
}
errdad:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0407/1266] IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0406/1266] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0408/1266] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
` (591 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prathamesh Deshpande,
Leon Romanovsky, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
[ Upstream commit e79389115b9d27287ff6230a9750675106ed7668 ]
mlx5_ib_alloc_transport_domain() allocates a transport domain and then
may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked.
Fix this by deallocating the TD when mlx5_ib_enable_lb() returns an
error. Also return 0 explicitly in the no-loopback-capability success
branch, and move dev->lb.mutex initialization to mlx5_ib_stage_init_init().
Fixes: 146d2f1af324 ("IB/mlx5: Allocate a Transport Domain for each ucontext")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 5408ee2b33ec3c..d523bc9052ede3 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1785,9 +1785,13 @@ static int mlx5_ib_alloc_transport_domain(struct mlx5_ib_dev *dev, u32 *tdn,
if ((MLX5_CAP_GEN(dev->mdev, port_type) != MLX5_CAP_PORT_TYPE_ETH) ||
(!MLX5_CAP_GEN(dev->mdev, disable_local_lb_uc) &&
!MLX5_CAP_GEN(dev->mdev, disable_local_lb_mc)))
- return err;
+ return 0;
+
+ err = mlx5_ib_enable_lb(dev, true, false);
+ if (err)
+ mlx5_cmd_dealloc_transport_domain(dev->mdev, *tdn, uid);
- return mlx5_ib_enable_lb(dev, true, false);
+ return err;
}
static void mlx5_ib_dealloc_transport_domain(struct mlx5_ib_dev *dev, u32 tdn,
@@ -3791,6 +3795,8 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
dev->port[i].roce.last_port_state = IB_PORT_DOWN;
}
+ mutex_init(&dev->lb.mutex);
+
err = mlx5r_cmd_query_special_mkeys(dev);
if (err)
return err;
@@ -4006,11 +4012,6 @@ static int mlx5_ib_stage_caps_init(struct mlx5_ib_dev *dev)
if (err)
return err;
- if ((MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_ETH) &&
- (MLX5_CAP_GEN(dev->mdev, disable_local_lb_uc) ||
- MLX5_CAP_GEN(dev->mdev, disable_local_lb_mc)))
- mutex_init(&dev->lb.mutex);
-
if (MLX5_CAP_GEN_64(dev->mdev, general_obj_types) &
MLX5_GENERAL_OBJ_TYPES_CAP_VIRTIO_NET_Q) {
err = mlx5_ib_init_var_table(dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0408/1266] RDMA/hns: Fix arithmetic overflow in calc_hem_config()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0407/1266] IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0409/1266] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
` (590 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Chesnokov, Leon Romanovsky,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
[ Upstream commit a38e4410af9ad8b7ad2217254da06cd4dc21f0ed ]
If bt_num is 3 or 2, then the expressions like
l0_idx * chunk_ba_num + l1_idx are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.
Cast the first operand to u64 to ensure the arithmetic
is performed in 64-bit.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2f49de21f3e9 ("RDMA/hns: Optimize mhop get flow for multi-hop addressing")
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
Link: https://patch.msgid.link/20260413091527.39990-1-Alexander.Chesnokov@kaspersky.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hem.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index f13016dc8016a5..d6fcb1a4bd4fca 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -355,14 +355,14 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
bt_num = hns_roce_get_bt_num(table->type, mhop->hop_num);
switch (bt_num) {
case 3:
- index->l1 = l0_idx * chunk_ba_num + l1_idx;
+ index->l1 = (u64)l0_idx * chunk_ba_num + l1_idx;
index->l0 = l0_idx;
- index->buf = l0_idx * chunk_ba_num * chunk_ba_num +
- l1_idx * chunk_ba_num + l2_idx;
+ index->buf = (u64)l0_idx * chunk_ba_num * chunk_ba_num +
+ (u64)l1_idx * chunk_ba_num + l2_idx;
break;
case 2:
index->l0 = l0_idx;
- index->buf = l0_idx * chunk_ba_num + l1_idx;
+ index->buf = (u64)l0_idx * chunk_ba_num + l1_idx;
break;
case 1:
index->buf = l0_idx;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0409/1266] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0408/1266] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0410/1266] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
` (589 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prathamesh Deshpande, Yishai Hadas,
Leon Romanovsky, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
[ Upstream commit 43f8f7946814c8e5f464518246fdbc69b6e32326 ]
MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
before initializing the fields used by the shared error path.
If eventfd_ctx_fdget() then fails, the unwind path dereferences
event_sub->ev_file in uverbs_uobject_put() and calls
subscribe_event_xa_dealloc() with an unset xa_key_level1.
subscribe_event_xa_alloc() creates the XA entry exactly once for a given
key_level1, on the first occurrence of that key. The unwind path must
therefore call subscribe_event_xa_dealloc() exactly once for it as well.
Enforce that by adding devx_key_in_sub_list() and calling
subscribe_event_xa_dealloc() only when the last matching pending entry is
being cleaned up.
Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
Link: https://patch.msgid.link/20260428224319.37682-1-prathameshdeshpande7@gmail.com
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/devx.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 388c95562a927a..0aee5738e2984e 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1851,6 +1851,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
return err;
}
+static bool devx_key_in_sub_list(struct list_head *list, u32 key_level1)
+{
+ struct devx_event_subscription *s;
+
+ list_for_each_entry(s, list, event_list)
+ if (s->xa_key_level1 == key_level1)
+ return true;
+
+ return false;
+}
+
static void
subscribe_event_xa_dealloc(struct mlx5_devx_event_table *devx_event_table,
u32 key_level1,
@@ -2098,10 +2109,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
event_sub = kzalloc(sizeof(*event_sub), GFP_KERNEL);
if (!event_sub) {
+ if (!devx_key_in_sub_list(&sub_list, key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ key_level1,
+ obj,
+ obj_id);
err = -ENOMEM;
goto err;
}
+ event_sub->ev_file = ev_file;
+ event_sub->xa_key_level1 = key_level1;
list_add_tail(&event_sub->event_list, &sub_list);
uverbs_uobject_get(&ev_file->uobj);
if (use_eventfd) {
@@ -2116,9 +2134,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
}
event_sub->cookie = cookie;
- event_sub->ev_file = ev_file;
- /* May be needed upon cleanup the devx object/subscription */
- event_sub->xa_key_level1 = key_level1;
event_sub->xa_key_level2 = obj_id;
INIT_LIST_HEAD(&event_sub->obj_list);
}
@@ -2163,10 +2178,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
list_for_each_entry_safe(event_sub, tmp_sub, &sub_list, event_list) {
list_del(&event_sub->event_list);
- subscribe_event_xa_dealloc(devx_event_table,
- event_sub->xa_key_level1,
- obj,
- obj_id);
+ if (!devx_key_in_sub_list(&sub_list, event_sub->xa_key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ event_sub->xa_key_level1,
+ obj,
+ obj_id);
if (event_sub->eventfd)
eventfd_ctx_put(event_sub->eventfd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0410/1266] RDMA/srpt: fix integer overflow in immediate data length check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0409/1266] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0411/1266] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
` (588 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carlos Bilbao (Lambda),
Sara Venkatesh, Bart Van Assche, Leon Romanovsky, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sara Venkatesh <sarajvenkatesh@gmail.com>
[ Upstream commit eb4ecdf631fe00e8020bf461503cb9b7017ed796 ]
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data")
Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com>
Link: https://patch.msgid.link/20260504080036.3482415-1-sarajvenkatesh@gmail.com
Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 4bebc34a2929b1..13e1fc5e2759ad 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1129,9 +1129,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
void *data = (void *)srp_cmd + imm_data_offset;
uint32_t len = be32_to_cpu(imm_buf->len);
- uint32_t req_size = imm_data_offset + len;
+ uint32_t req_size;
- if (req_size > srp_max_req_size) {
+ if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
+ req_size > srp_max_req_size) {
pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
imm_data_offset, len, srp_max_req_size);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0411/1266] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0410/1266] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0412/1266] firmware: arm_scmi: Read sensor config as 32-bit value Greg Kroah-Hartman
` (587 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Andy Shevchenko,
Sakari Ailus, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 4e8156bd9517fa18c3613ea39c222c7035f0221e ]
atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
temporary variable raw_black_frame, which must be released via
ia_css_frame_free() before the function returns. However, if
sh_css_set_black_frame() fails, the function returns immediately without
performing this cleanup, leading to a memory leak.
Fix this by assigning the return value of sh_css_set_black_frame() to
ret. This ensures that the error code is propagated while allowing the
execution to fall through to the ia_css_frame_free() cleanup call.
The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is based on the
LLVM framework and is specifically designed to detect memory management
issues. It is currently under active development and not yet publicly
available.
We performed build testing on x86_64 with allyesconfig. Since triggering
this error path in atomisp requires specific Intel Atom ISP hardware and
firmware, we were unable to perform runtime testing and instead verified
the fix according to the code logic.
Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 0803b296e9acc7..96b56f87c42269 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -3486,10 +3486,8 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
if (ret)
return ret;
- if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
- raw_black_frame) != 0)
- return -ENOMEM;
-
+ ret = sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
+ raw_black_frame);
ia_css_frame_free(raw_black_frame);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0412/1266] firmware: arm_scmi: Read sensor config as 32-bit value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0411/1266] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0413/1266] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
` (586 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Marussi, Sudeep Holla,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@kernel.org>
[ Upstream commit f6fe7c3c007df18afd289ff2d98c692fae9ab085 ]
The SENSOR_CONFIG_GET response contains a 32-bit sensor_config field,
and the xfer is initialized with a 4-byte RX buffer. Reading it with
get_unaligned_le64() can consume bytes past the returned payload.
Use get_unaligned_le32() to match the protocol layout and the allocated
response size.
Fixes: 7b83c5f41088 ("firmware: arm_scmi: Add SCMI v3.0 sensor configuration support")
Link: https://patch.msgid.link/20260517-scmi_fixes-v1-1-d86daec4defd@kernel.org
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/sensors.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
index 0b5853fa9d874f..4e3e937cb92c18 100644
--- a/drivers/firmware/arm_scmi/sensors.c
+++ b/drivers/firmware/arm_scmi/sensors.c
@@ -777,7 +777,7 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph,
if (!ret) {
struct scmi_sensor_info *s = si->sensors + sensor_id;
- *sensor_config = get_unaligned_le64(t->rx.buf);
+ *sensor_config = get_unaligned_le32(t->rx.buf);
s->sensor_config = *sensor_config;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0413/1266] sysfs: clamp show() return value in sysfs_kf_read()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0412/1266] firmware: arm_scmi: Read sensor config as 32-bit value Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0414/1266] bitops: use common function parameter names Greg Kroah-Hartman
` (585 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Tejun Heo,
Rafael J. Wysocki (Intel), Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 454257f6d124a92342dcbb7710c03dd6ef96c731 ]
sysfs_kf_seq_show() defends against buggy show() callbacks that return
larger than PAGE_SIZE by clamping the value and printing a warning.
sysfs_kf_read(), the prealloc variant, has no such defense.
The only current in-tree user of __ATTR_PREALLOC is drivers/md/md.c,
whose show() callbacks are well-behaved, so this is hardening against
future drivers doing foolish things and out-of-tree code doing even more
foolish things.
Cc: NeilBrown <neil@brown.name>
Cc: Tejun Heo <tj@kernel.org>
Fixes: 2b75869bba67 ("sysfs/kernfs: allow attributes to request write buffer be pre-allocated.")
Assisted-by: gregkh_clanker_t1000
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/2026052000-drove-unicycle-d61b@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/sysfs/file.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f21e73d107249d..833dd3f5a3f20c 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -114,6 +114,10 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
len = ops->show(kobj, of->kn->priv, buf);
if (len < 0)
return len;
+ if (len >= (ssize_t)PAGE_SIZE) {
+ printk("fill_read_buffer: %pS returned bad count\n", ops->show);
+ len = PAGE_SIZE - 1;
+ }
if (pos) {
if (len <= pos)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0414/1266] bitops: use common function parameter names
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0413/1266] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0415/1266] regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions Greg Kroah-Hartman
` (584 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Yury Norov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 8a51b2e874f47a6094353b59ecae421f0968fe3a ]
Fix the function prototypes to use the common parameter name 'addr'
instead of 'p' (common to arch-specific implementations of these
functions).
This avoids the kernel-doc warnings:
Warning: include/asm-generic/bitops/lock.h:19 function parameter 'p'
not described in 'arch_test_and_set_bit_lock'
Warning: include/asm-generic/bitops/lock.h:41 function parameter 'p'
not described in 'arch_clear_bit_unlock'
Warning: include/asm-generic/bitops/lock.h:59 function parameter 'p'
not described in 'arch___clear_bit_unlock'
Fixes: 84c6591103db ("locking/atomics, asm-generic/bitops/lock.h: Rewrite using atomic_fetch_*()")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Yury Norov <yury.norov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/bitops/lock.h | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
index 40913516e654c9..b78be6c6c73e74 100644
--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -16,16 +16,16 @@
* It can be used to implement bit locks.
*/
static __always_inline int
-arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *p)
+arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *addr)
{
long old;
unsigned long mask = BIT_MASK(nr);
- p += BIT_WORD(nr);
- if (READ_ONCE(*p) & mask)
+ addr += BIT_WORD(nr);
+ if (READ_ONCE(*addr) & mask)
return 1;
- old = raw_atomic_long_fetch_or_acquire(mask, (atomic_long_t *)p);
+ old = raw_atomic_long_fetch_or_acquire(mask, (atomic_long_t *)addr);
return !!(old & mask);
}
@@ -38,10 +38,10 @@ arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *p)
* This operation is atomic and provides release barrier semantics.
*/
static __always_inline void
-arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *p)
+arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *addr)
{
- p += BIT_WORD(nr);
- raw_atomic_long_fetch_andnot_release(BIT_MASK(nr), (atomic_long_t *)p);
+ addr += BIT_WORD(nr);
+ raw_atomic_long_fetch_andnot_release(BIT_MASK(nr), (atomic_long_t *)addr);
}
/**
@@ -56,14 +56,14 @@ arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *p)
* See for example x86's implementation.
*/
static inline void
-arch___clear_bit_unlock(unsigned int nr, volatile unsigned long *p)
+arch___clear_bit_unlock(unsigned int nr, volatile unsigned long *addr)
{
unsigned long old;
- p += BIT_WORD(nr);
- old = READ_ONCE(*p);
+ addr += BIT_WORD(nr);
+ old = READ_ONCE(*addr);
old &= ~BIT_MASK(nr);
- raw_atomic_long_set_release((atomic_long_t *)p, old);
+ raw_atomic_long_set_release((atomic_long_t *)addr, old);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0415/1266] regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0414/1266] bitops: use common function parameter names Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0416/1266] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
` (583 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Chen-Yu Tsai,
Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit cdc517688ffa2c30a64a20b558a9ecbf046c70f1 ]
The name of the regulator should match what the board design specifies
for the power rail. There should be no limitations on what the name can
be, and they definitely don't always follow the PMIC's own names.
Drop the restrictions on regulator-name.
Fixes: 8771456635d5 ("dt-bindings: regulator: Add document for MT6359 regulator")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://patch.msgid.link/20260514091520.2718987-3-wenst@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../bindings/regulator/mt6359-regulator.yaml | 43 -------------------
1 file changed, 43 deletions(-)
diff --git a/Documentation/devicetree/bindings/regulator/mt6359-regulator.yaml b/Documentation/devicetree/bindings/regulator/mt6359-regulator.yaml
index d6b3b5a5c0b346..5e4b1e74179500 100644
--- a/Documentation/devicetree/bindings/regulator/mt6359-regulator.yaml
+++ b/Documentation/devicetree/bindings/regulator/mt6359-regulator.yaml
@@ -18,84 +18,41 @@ patternProperties:
"^buck_v(s1|gpu11|modem|pu|core|s2|pa|proc2|proc1|core_sshub)$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^v(s1|gpu11|modem|pu|core|s2|pa|proc2|proc1|core_sshub)$"
-
unevaluatedProperties: false
"^ldo_v(ibr|rf12|usb|camio|efuse|xo22)$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^v(ibr|rf12|usb|camio|efuse|xo22)$"
-
unevaluatedProperties: false
"^ldo_v(rfck|emc|a12|a09|ufs|bbck)$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^v(rfck|emc|a12|a09|ufs|bbck)$"
-
unevaluatedProperties: false
"^ldo_vcn(18|13|33_1_bt|13_1_wifi|33_2_bt|33_2_wifi)$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^vcn(18|13|33_1_bt|13_1_wifi|33_2_bt|33_2_wifi)$"
-
unevaluatedProperties: false
"^ldo_vsram_(proc2|others|md|proc1|others_sshub)$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^vsram_(proc2|others|md|proc1|others_sshub)$"
-
unevaluatedProperties: false
"^ldo_v(fe|bif|io)28$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^v(fe|bif|io)28$"
-
unevaluatedProperties: false
"^ldo_v(aud|io|aux|rf|m)18$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^v(aud|io|aux|rf|m)18$"
-
unevaluatedProperties: false
"^ldo_vsim[12]$":
type: object
$ref: regulator.yaml#
-
- properties:
- regulator-name:
- pattern: "^vsim[12]$"
-
- required:
- - regulator-name
-
unevaluatedProperties: false
additionalProperties: false
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0416/1266] net/sched: sch_drr: annotate data-races around cl->deficit
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0415/1266] regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0417/1266] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
` (582 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit c67b104fd7982162885c5e43057ca761006748e2 ]
drr_dump_class_stats() runs without qdisc spinlock held.
Add missing READ_ONCE()/WRITE_ONCE() annotations around cl->deficit.
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260519094618.2632073-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_drr.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 9b36955e32b142..9a7d9b14bc8821 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -270,7 +270,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
memset(&xstats, 0, sizeof(xstats));
if (qlen)
- xstats.deficit = cl->deficit;
+ xstats.deficit = READ_ONCE(cl->deficit);
if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 ||
gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
@@ -362,7 +362,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
if (!cl_is_active(cl)) {
list_add_tail(&cl->alist, &q->active);
- cl->deficit = cl->quantum;
+ WRITE_ONCE(cl->deficit, cl->quantum);
}
sch->qstats.backlog += len;
@@ -389,7 +389,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
len = qdisc_pkt_len(skb);
if (len <= cl->deficit) {
- cl->deficit -= len;
+ WRITE_ONCE(cl->deficit, cl->deficit - len);
skb = qdisc_dequeue_peeked(cl->qdisc);
if (unlikely(skb == NULL))
goto out;
@@ -403,7 +403,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
return skb;
}
- cl->deficit += cl->quantum;
+ WRITE_ONCE(cl->deficit, cl->deficit + cl->quantum);
list_move_tail(&cl->alist, &q->active);
}
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0417/1266] media: rockchip: rga: fix too small buffer size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0416/1266] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0418/1266] firmware: arm_scmi: Fix OOB in scmi_power_name_get() Greg Kroah-Hartman
` (581 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dufresne, Sven Püschel,
Hans Verkuil, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Püschel <s.pueschel@pengutronix.de>
[ Upstream commit 65017e26c065d1240b0512c15867ef1128034fd8 ]
Fix the command buffer size being only a quarter of the actual size.
The RGA_CMDBUF_SIZE macro was potentially intended to specify the length
of the cmdbuf u32 array pointer. But as it's used to specify the size of
the allocation, which is counted in bytes. Therefore adjust the macro
size to bytes as it better matches the variable name and adjust it's
users accordingly.
As the command buffer is relatively small, it probably didn't caused
an issue due to being smaller than a single page.
Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rga/rga-hw.c | 2 +-
drivers/media/platform/rockchip/rga/rga-hw.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
index aaa96f256356b0..bdfb9bc3eb3f6d 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.c
+++ b/drivers/media/platform/rockchip/rga/rga-hw.c
@@ -379,7 +379,7 @@ static void rga_cmd_set(struct rga_ctx *ctx)
{
struct rockchip_rga *rga = ctx->rga;
- memset(rga->cmdbuf_virt, 0, RGA_CMDBUF_SIZE * 4);
+ memset(rga->cmdbuf_virt, 0, RGA_CMDBUF_SIZE);
rga_cmd_set_src_addr(ctx, rga->src_mmu_pages);
/*
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h
index e8917e5630a48d..03990fd30f158c 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.h
+++ b/drivers/media/platform/rockchip/rga/rga-hw.h
@@ -6,7 +6,7 @@
#ifndef __RGA_HW_H__
#define __RGA_HW_H__
-#define RGA_CMDBUF_SIZE 0x20
+#define RGA_CMDBUF_SIZE 0x80
/* Hardware limits */
#define MAX_WIDTH 8192
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0418/1266] firmware: arm_scmi: Fix OOB in scmi_power_name_get()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0417/1266] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0419/1266] arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node Greg Kroah-Hartman
` (580 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Cristian Marussi,
Sudeep Holla, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit f9ef3f66f4b18078e464b7606f9497e4dbeb9905 ]
scmi_power_name_get() does not validate the domain number passed by the
external caller, which may lead to an out-of-bounds access.
Fix this by returning "unknown" for invalid domains, like
scmi_reset_name_get() does.
Fixes: 76a6550990e296a7 ("firmware: arm_scmi: add initial support for power protocol")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Link: https://patch.msgid.link/75caae28bdffb55199a0bc6cac5df112a966c608.1778838987.git.geert+renesas@glider.be
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_scmi/power.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_scmi/power.c b/drivers/firmware/arm_scmi/power.c
index 356e83631664d9..6e01f70c3a9eee 100644
--- a/drivers/firmware/arm_scmi/power.c
+++ b/drivers/firmware/arm_scmi/power.c
@@ -194,8 +194,12 @@ scmi_power_name_get(const struct scmi_protocol_handle *ph,
u32 domain)
{
struct scmi_power_info *pi = ph->get_priv(ph);
- struct power_dom_info *dom = pi->dom_info + domain;
+ struct power_dom_info *dom;
+ if (domain >= pi->num_domains)
+ return "unknown";
+
+ dom = pi->dom_info + domain;
return dom->name;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0419/1266] arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0418/1266] firmware: arm_scmi: Fix OOB in scmi_power_name_get() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0420/1266] tracing: Bound synthetic-field strings with seq_buf Greg Kroah-Hartman
` (579 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Kuldeep Singh,
Harshal Dev, Bjorn Andersson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshal Dev <harshal.dev@oss.qualcomm.com>
[ Upstream commit 3a5cb1ccbfb3141862b28f24cd5050083233aae7 ]
Qualcomm in-line crypto engine (ICE) platform driver specifies and votes
for its own resources. Before accessing ICE hardware during probe, to
avoid potential unclocked register access issues (when clk_ignore_unused
is not passed on the kernel command line), in addition to the 'core' clock
the 'iface' clock should also be turned on by the driver. This can only be
done if the UFS_PHY_GDSC power domain is enabled. Specify both the
UFS_PHY_GDSC power domain and the 'iface' clock in the ICE node for sm8450.
Fixes: 86b0aef435851 ("arm64: dts: qcom: sm8450: Use standalone ICE node for UFS")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260416-qcom_ice_power_and_clk_vote-v5-8-5ccf5d7e2846@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
index e6c6db754abb62..0dad7b0866ea5b 100644
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -4224,7 +4224,11 @@ ice: crypto@1d88000 {
compatible = "qcom,sm8450-inline-crypto-engine",
"qcom,inline-crypto-engine";
reg = <0 0x01d88000 0 0x18000>;
- clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>;
+ clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+ <&gcc GCC_UFS_PHY_AHB_CLK>;
+ clock-names = "core",
+ "iface";
+ power-domains = <&gcc UFS_PHY_GDSC>;
};
cryptobam: dma-controller@1dc4000 {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0420/1266] tracing: Bound synthetic-field strings with seq_buf
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0419/1266] arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0421/1266] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
` (578 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mathieu Desnoyers, Tom Zanussi,
Masami Hiramatsu (Google), Tom Zanussi, Pengpeng Hou,
Steven Rostedt, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit f07883450eb14d1cf020b55d9f3a7ec5683bcd26 ]
The synthetic field helpers build a prefixed synthetic variable name and
a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The
current code appends those strings with raw strcat(), so long key lists,
field names, or saved filters can run past the end of the staging
buffers.
Build both strings with seq_buf and propagate -E2BIG if either the
synthetic variable name or the generated command exceeds
MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while
using the helper intended for bounded command construction.
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tom Zanussi <tom.zanussi@linux.intel.com>
Link: https://patch.msgid.link/20260430043350.57928-1-pengpeng@iscas.ac.cn
Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_events_hist.c | 41 ++++++++++++++++++++++----------
1 file changed, 29 insertions(+), 12 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 59115079c79820..f54e3855516fb4 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -8,6 +8,7 @@
#include <linux/module.h>
#include <linux/kallsyms.h>
#include <linux/security.h>
+#include <linux/seq_buf.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/stacktrace.h>
@@ -2943,13 +2944,22 @@ find_synthetic_field_var(struct hist_trigger_data *target_hist_data,
{
struct hist_field *event_var;
char *synthetic_name;
+ struct seq_buf s;
synthetic_name = kzalloc(MAX_FILTER_STR_VAL, GFP_KERNEL);
if (!synthetic_name)
return ERR_PTR(-ENOMEM);
- strcpy(synthetic_name, "synthetic_");
- strcat(synthetic_name, field_name);
+ seq_buf_init(&s, synthetic_name, MAX_FILTER_STR_VAL);
+ seq_buf_printf(&s, "synthetic_%s", field_name);
+
+ /* Terminate synthetic_name with a NUL. */
+ seq_buf_str(&s);
+
+ if (seq_buf_has_overflowed(&s)) {
+ kfree(synthetic_name);
+ return ERR_PTR(-E2BIG);
+ }
event_var = find_event_var(target_hist_data, system, event_name, synthetic_name);
@@ -2995,6 +3005,7 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,
struct hist_field *key_field;
struct hist_field *event_var;
char *saved_filter;
+ struct seq_buf s;
char *cmd;
int ret;
@@ -3039,28 +3050,34 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,
return ERR_PTR(-ENOMEM);
}
+ seq_buf_init(&s, cmd, MAX_FILTER_STR_VAL);
+
/* Use the same keys as the compatible histogram */
- strcat(cmd, "keys=");
+ seq_buf_puts(&s, "keys=");
for_each_hist_key_field(i, hist_data) {
key_field = hist_data->fields[i];
if (!first)
- strcat(cmd, ",");
- strcat(cmd, key_field->field->name);
+ seq_buf_putc(&s, ',');
+ seq_buf_puts(&s, key_field->field->name);
first = false;
}
/* Create the synthetic field variable specification */
- strcat(cmd, ":synthetic_");
- strcat(cmd, field_name);
- strcat(cmd, "=");
- strcat(cmd, field_name);
+ seq_buf_printf(&s, ":synthetic_%s=%s", field_name, field_name);
/* Use the same filter as the compatible histogram */
saved_filter = find_trigger_filter(hist_data, file);
- if (saved_filter) {
- strcat(cmd, " if ");
- strcat(cmd, saved_filter);
+ if (saved_filter)
+ seq_buf_printf(&s, " if %s", saved_filter);
+
+ /* Terminate cmd with a NUL. */
+ seq_buf_str(&s);
+
+ if (seq_buf_has_overflowed(&s)) {
+ kfree(cmd);
+ kfree(var_hist);
+ return ERR_PTR(-E2BIG);
}
var_hist->cmd = kstrdup(cmd, GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0421/1266] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0420/1266] tracing: Bound synthetic-field strings with seq_buf Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0422/1266] driver core: Use mod_delayed_work to prevent lost deferred probe work Greg Kroah-Hartman
` (577 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit 9582485a65eacfd7245ec7f0a9d7e2c34749d669 ]
When called with FWNODE_GRAPH_ENDPOINT_NEXT, the function walks every
endpoint under the requested port and, for any endpoint whose ID is
greater than or equal to the requested one, may store a fwnode
reference in best_ep via fwnode_handle_get(). If a later iteration
finds an exact-ID match, the function returns that endpoint directly
without dropping the reference held by best_ep, leaking it.
Drop the saved candidate before returning the exact-match endpoint.
This affects callers that use FWNODE_GRAPH_ENDPOINT_NEXT to ask for
the next endpoint with ID >= the requested one (used by a number of
media drivers, e.g. imx7/8, sun6i CSI, omap3isp, xilinx-csi2,
stm32-csi). Each leak retains a fwnode reference until reboot/unbind.
Fixes: 0fcc2bdc8aff ("device property: Add fwnode_graph_get_endpoint_by_id()")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Link: https://patch.msgid.link/20260514171455.27271-1-sozdayvek@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/property.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index ea93fc8ba59273..f0dd0d46c04b2c 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1207,8 +1207,10 @@ fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode,
if (fwnode_ep.port != port)
continue;
- if (fwnode_ep.id == endpoint)
+ if (fwnode_ep.id == endpoint) {
+ fwnode_handle_put(best_ep);
return ep;
+ }
if (!endpoint_next)
continue;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0422/1266] driver core: Use mod_delayed_work to prevent lost deferred probe work
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0421/1266] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0423/1266] Revert "treewide: Fix probing of devices in DT overlays" Greg Kroah-Hartman
` (576 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Yuwei, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yuwei <zhangyuwei20@huawei.com>
[ Upstream commit 1137838865bfc9a7cd5869c1dc5c22aa45ec12c8 ]
The deferred_probe_timeout_work may be permanently and unexpectedly
canceled when deferred_probe_extend_timeout() executes concurrently.
Starting with deferred_probe_timeout_work pending, the problem can
occur after the following sequence:
CPU0 CPU1
deferred_probe_extend_timeout
-> cancel_delayed_work() => true
deferred_probe_extend_timeout
-> cancel_delayed_work()
-> __cancel_work()
-> try_grab_pending()
-> schedule_delayed_work()
-> queue_delayed_work_on()
(Since the pending bit is grabbed,
it just returns without queuing)
-> set_work_pool_and_clear_pending()
(This __cancel_work() returns false and
the work will never be queued again)
The root cause is that the WORK_STRUCT_PENDING_BIT of the work_struct
is set temporarily in __cancel_work() (via try_grab_pending()). This
transient state prevents the work_struct from being successfully queued
by another CPU.
To fix this, replace the original non-atomic cancel and schedule
mechanism with mod_delayed_work(). This ensures the modification is
handled atomically and guarantees that the work is not lost.
Fixes: 2b28a1a84a0e ("driver core: Extend deferred probe timeout on driver registration")
Signed-off-by: Zhang Yuwei <zhangyuwei20@huawei.com>
Link: https://patch.msgid.link/20260410024448.387231-1-zhangyuwei20@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/dd.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 44f9d0a06d5b70..115b24d5e73d1c 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -326,12 +326,10 @@ void deferred_probe_extend_timeout(void)
* If the work hasn't been queued yet or if the work expired, don't
* start a new one.
*/
- if (cancel_delayed_work(&deferred_probe_timeout_work)) {
- schedule_delayed_work(&deferred_probe_timeout_work,
- driver_deferred_probe_timeout * HZ);
+ if (mod_delayed_work(system_wq, &deferred_probe_timeout_work,
+ driver_deferred_probe_timeout))
pr_debug("Extended deferred probe timeout by %d secs\n",
driver_deferred_probe_timeout);
- }
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0423/1266] Revert "treewide: Fix probing of devices in DT overlays"
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0422/1266] driver core: Use mod_delayed_work to prevent lost deferred probe work Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0424/1266] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
` (575 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herve Codina, Saravana Kannan,
Mark Brown, Rob Herring (Arm), Sasha Levin, Wolfram Sang
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravana Kannan <saravanak@google.com>
[ Upstream commit aaf08c52df9a19148731d4a3cfd85d98455db901 ]
This reverts commit 1a50d9403fb90cbe4dea0ec9fd0351d2ecbd8924.
While the commit fixed fw_devlink overlay handling for one case, it
broke it for another case. So revert it and redo the fix in a separate
patch.
Fixes: 1a50d9403fb9 ("treewide: Fix probing of devices in DT overlays")
Reported-by: Herve Codina <herve.codina@bootlin.com>
Closes: https://lore.kernel.org/lkml/CAMuHMdXEnSD4rRJ-o90x4OprUacN_rJgyo8x6=9F9rZ+-KzjOg@mail.gmail.com/
Closes: https://lore.kernel.org/all/20240221095137.616d2aaa@bootlin.com/
Closes: https://lore.kernel.org/lkml/20240312151835.29ef62a0@bootlin.com/
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/lkml/20240411235623.1260061-2-saravanak@google.com/
[Herve: Fix conflicts due to f72e77c33e4b ("device property: Make
modifications of fwnode "flags" thread safe")]
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Acked-by: Mark Brown <broonie@kernel.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com> # for I2C
Link: https://patch.msgid.link/20260511155755.34428-2-herve.codina@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/imx-weim.c | 6 ------
drivers/i2c/i2c-core-of.c | 5 -----
drivers/of/dynamic.c | 1 -
drivers/of/platform.c | 5 -----
drivers/spi/spi.c | 5 -----
5 files changed, 22 deletions(-)
diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
index 5244013d328fcc..378734724a4f54 100644
--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -330,12 +330,6 @@ static int of_weim_notify(struct notifier_block *nb, unsigned long action,
"Failed to setup timing for '%pOF'\n", rd->dn);
if (!of_node_check_flag(rd->dn, OF_POPULATED)) {
- /*
- * Clear the flag before adding the device so that
- * fw_devlink doesn't skip adding consumers to this
- * device.
- */
- fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
if (!of_platform_device_create(rd->dn, NULL, &pdev->dev)) {
dev_err(&pdev->dev,
"Failed to create child device '%pOF'\n",
diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
index 50e97e2ed2cff4..a250921bbce094 100644
--- a/drivers/i2c/i2c-core-of.c
+++ b/drivers/i2c/i2c-core-of.c
@@ -178,11 +178,6 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
return NOTIFY_OK;
}
- /*
- * Clear the flag before adding the device so that fw_devlink
- * doesn't skip adding consumers to this device.
- */
- fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
client = of_i2c_register_device(adap, rd->dn);
if (IS_ERR(client)) {
dev_err(&adap->dev, "failed to create client for '%pOF'\n",
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index ab109bb92cf424..9cc0f4ffb81427 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -224,7 +224,6 @@ static void __of_attach_node(struct device_node *np)
np->sibling = np->parent->child;
np->parent->child = np;
of_node_clear_flag(np, OF_DETACHED);
- fwnode_set_flag(&np->fwnode, FWNODE_FLAG_NOT_DEVICE);
raw_spin_unlock_irqrestore(&devtree_lock, flags);
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 18b72f891c5b5a..d1dfd857f2cd06 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -770,11 +770,6 @@ static int of_platform_notify(struct notifier_block *nb,
if (of_node_check_flag(rd->dn, OF_POPULATED))
return NOTIFY_OK;
- /*
- * Clear the flag before adding the device so that fw_devlink
- * doesn't skip adding consumers to this device.
- */
- fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
/* pdev_parent may be NULL when no bus platform device */
pdev_parent = of_find_device_by_node(rd->dn->parent);
pdev = of_platform_device_create(rd->dn, NULL,
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index bb7e5e56f6dca6..da2ef6b1f7c894 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -4541,11 +4541,6 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
return NOTIFY_OK;
}
- /*
- * Clear the flag before adding the device so that fw_devlink
- * doesn't skip adding consumers to this device.
- */
- fwnode_clear_flag(&rd->dn->fwnode, FWNODE_FLAG_NOT_DEVICE);
spi = of_register_spi_device(ctlr, rd->dn);
put_device(&ctlr->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0424/1266] cpufreq: Documentation: fix sampling_down_factor range
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0423/1266] Revert "treewide: Fix probing of devices in DT overlays" Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0425/1266] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
` (574 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Pengjie Zhang,
Rafael J. Wysocki, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <zhangpengjie2@huawei.com>
[ Upstream commit 85524e651d20944399322d46fb97960337831d43 ]
The ondemand governor implementation accepts sampling_down_factor values
from 1 to 100000 via MAX_SAMPLING_DOWN_FACTOR, but the documentation in
admin-guide/pm/cpufreq.rst still says the valid range is 1 to 100.
Update the documentation to match the actual code.
Fixes: 2a0e49279850 ("cpufreq: User/admin documentation update and consolidation")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Link: https://patch.msgid.link/20260518133457.2408463-1-zhangpengjie2@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/pm/cpufreq.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 6adb7988e0eb6d..d2f37309cca3b3 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -499,7 +499,7 @@ This governor exposes the following tunables:
of those tasks above 0 and set this attribute to 1.
``sampling_down_factor``
- Temporary multiplier, between 1 (default) and 100 inclusive, to apply to
+ Temporary multiplier, between 1 (default) and 100000 inclusive, to apply to
the ``sampling_rate`` value if the CPU load goes above ``up_threshold``.
This causes the next execution of the governor's worker routine (after
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0425/1266] cpufreq: conservative: Simplify frequency limit handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0424/1266] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0426/1266] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
` (573 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lifeng Zheng, Viresh Kumar,
Zhongqiu Han, Rafael J. Wysocki, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit 3494dff89779b73a6c70481c982e0e96d336454a ]
cs_dbs_update() performs explicit checks against policy->min/max
before updating the target frequency. These checks are redundant as
__cpufreq_driver_target() already clamps the requested frequency to
the valid policy limits.
Remove the unnecessary boundary checks and simplify the update logic.
This also fixes an issue introduced by commit 00bfe05889e9 ("cpufreq:
conservative: Decrease frequency faster for deferred updates"), where
stale target comparisons could cause frequency updates to be skipped
entirely after deferred adjustments.
Closes: https://lore.kernel.org/all/20260421123545.1745998-1-zhenglifeng1@huawei.com/
Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates")
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Co-developed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/292e6d937890f135e30ec0d2107eaad47cb9a976.1779423281.git.viresh.kumar@linaro.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq_conservative.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index efdcc4ab43340a..24fbb7313c9500 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -103,10 +103,6 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
if (load > dbs_data->up_threshold) {
dbs_info->down_skip = 0;
- /* if we are already at full speed then break out early */
- if (requested_freq == policy->max)
- goto out;
-
requested_freq += freq_step;
if (requested_freq > policy->max)
requested_freq = policy->max;
@@ -124,13 +120,7 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
/* Check for frequency decrease */
if (load < cs_tuners->down_threshold) {
- /*
- * if we cannot reduce the frequency anymore, break out early
- */
- if (requested_freq == policy->min)
- goto out;
-
- if (requested_freq > freq_step)
+ if (requested_freq > policy->min + freq_step)
requested_freq -= freq_step;
else
requested_freq = policy->min;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0426/1266] pwm: imx27: Fix variable truncation in .apply()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0425/1266] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0427/1266] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
` (572 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronaldo Nunez, Frank Li,
Uwe Kleine-König, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronaldo Nunez <rnunez@baylibre.com>
[ Upstream commit dc9e08fdbcc3eb08a1d2b868b535081c44425e27 ]
Fix a variable truncation when calculating period in microseconds as
part of the solution for the ERR051198 in .apply() callback.
Example scenario:
- Period of 3us (PWMPR = 196 and prescaler = 1)
- Expected value in tmp: 198000000000 (NSEC_PER_SEC * (196 + 2) * 1)
- Actual value is 431504384 (truncation to u32)
Signed-off-by: Ronaldo Nunez <rnunez@baylibre.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260522191348.6227-1-rnunez@baylibre.com
Fixes: a25351e4c774 ("pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle")
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-imx27.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-imx27.c b/drivers/pwm/pwm-imx27.c
index 660a71b7263ce0..8a4187a67f7d4e 100644
--- a/drivers/pwm/pwm-imx27.c
+++ b/drivers/pwm/pwm-imx27.c
@@ -218,7 +218,7 @@ static void pwm_imx27_wait_fifo_slot(struct pwm_chip *chip,
static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
const struct pwm_state *state)
{
- unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;
+ unsigned long period_cycles, duty_cycles, prescale, period_us;
struct pwm_imx27_chip *imx = to_pwm_imx27_chip(chip);
struct pwm_state cstate;
unsigned long long c;
@@ -227,6 +227,7 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
int val;
int ret;
u32 cr;
+ u64 tmp;
pwm_get_state(pwm, &cstate);
@@ -270,6 +271,11 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
val = readl(imx->mmio_base + MX3_PWMPR);
val = val >= MX3_PWMPR_MAX ? MX3_PWMPR_MAX : val;
cr = readl(imx->mmio_base + MX3_PWMCR);
+
+ /*
+ * tmp stores period in nanoseconds. Result fits in u64 since
+ * val <= 0xfffe and prescaler in [1, 0x1000].
+ */
tmp = NSEC_PER_SEC * (u64)(val + 2) * MX3_PWMCR_PRESCALER_GET(cr);
tmp = DIV_ROUND_UP_ULL(tmp, clkrate);
period_us = DIV_ROUND_UP_ULL(tmp, 1000);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0427/1266] bus: sunxi-rsb: Always check register address validity
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0426/1266] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0428/1266] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs Greg Kroah-Hartman
` (571 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Andrey Skvortsov,
Chen-Yu Tsai, Jernej Skrabec, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit 61192938a5870ac36edae81e4775b680dcf02c61 ]
The register address was already validated for read operations in
regmap_sunxi_rsb_reg_read before being truncated to a u8. Write operations
have the same set of possible addresses, and the address is being truncated
from u32 to u8 here as well, so the same check is needed.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus")
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20260301144939.1832806-1-andrej.skvortzov@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/sunxi-rsb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
index db0ed4e5d315fa..c2b2e56331d1bc 100644
--- a/drivers/bus/sunxi-rsb.c
+++ b/drivers/bus/sunxi-rsb.c
@@ -447,6 +447,9 @@ static int regmap_sunxi_rsb_reg_write(void *context, unsigned int reg,
struct sunxi_rsb_ctx *ctx = context;
struct sunxi_rsb_device *rdev = ctx->rdev;
+ if (reg > 0xff)
+ return -EINVAL;
+
return sunxi_rsb_write(rdev->rsb, rdev->rtaddr, reg, &val, ctx->size);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0428/1266] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0427/1266] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0429/1266] RDMA/rxe: Fix a use-after-free problem in rxe_mmap Greg Kroah-Hartman
` (570 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 5ebb3ed757be3e04cf803026004aa0beaeb13e9b ]
The irdma_copy_user_pgaddrs function loops through all of the umem DMA
blocks to populate the PBLEs and will stop when either the last DMA
block is reached or palloc->total_cnt is reached. The issue is that
the logic for checking palloc->total_cnt would only work for non-zero
values.
When irdma_setup_pbles is called with lvl==0, it
calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
the only way to break out of the loop is to reach the last umem DMA
block, which means it could end up going beyond the fixed size of 4
iwmr->pgaddrmem array that is used in the lvl==0 case.
In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
separate input (for example, req.cq_pages in the case of a CQ). So,
we must perform explicit checking to ensure we don't overflow the
pgaddrmem array if the user provides a umem that consists of more
blocks than their provided req.cq_pages.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://patch.msgid.link/r/20260512183852.614045-1-jmoroni@google.com
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 2358fab95784b0..91d5b1b0d6b1b2 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2326,10 +2326,11 @@ static inline u64 *irdma_next_pbl_addr(u64 *pbl, struct irdma_pble_info **pinfo,
* irdma_copy_user_pgaddrs - copy user page address to pble's os locally
* @iwmr: iwmr for IB's user page addresses
* @pbl: ple pointer to save 1 level or 0 level pble
+ * @pbl_len: Max number of PBL entries to populate
* @level: indicated level 0, 1 or 2
*/
static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl,
- enum irdma_pble_level level)
+ u32 pbl_len, enum irdma_pble_level level)
{
struct ib_umem *region = iwmr->region;
struct irdma_pbl *iwpbl = &iwmr->iwpbl;
@@ -2337,7 +2338,9 @@ static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl,
struct irdma_pble_info *pinfo;
struct ib_block_iter biter;
u32 idx = 0;
- u32 pbl_cnt = 0;
+
+ if (!pbl_len)
+ return;
pinfo = (level == PBLE_LEVEL_1) ? NULL : palloc->level2.leaf;
@@ -2346,7 +2349,7 @@ static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl,
rdma_umem_for_each_dma_block(region, &biter, iwmr->page_size) {
*pbl = rdma_block_iter_dma_address(&biter);
- if (++pbl_cnt == palloc->total_cnt)
+ if (!--pbl_len)
break;
pbl = irdma_next_pbl_addr(pbl, &pinfo, &idx);
}
@@ -2422,6 +2425,7 @@ static int irdma_setup_pbles(struct irdma_pci_f *rf, struct irdma_mr *iwmr,
u64 *pbl;
int status;
enum irdma_pble_level level = PBLE_LEVEL_1;
+ u32 pbl_len;
if (lvl) {
status = irdma_get_pble(rf->pble_rsrc, palloc, iwmr->page_cnt,
@@ -2429,16 +2433,18 @@ static int irdma_setup_pbles(struct irdma_pci_f *rf, struct irdma_mr *iwmr,
if (status)
return status;
+ pbl_len = palloc->total_cnt;
iwpbl->pbl_allocated = true;
level = palloc->level;
pinfo = (level == PBLE_LEVEL_1) ? &palloc->level1 :
palloc->level2.leaf;
pbl = pinfo->addr;
} else {
+ pbl_len = IRDMA_MAX_SAVED_PHY_PGADDR;
pbl = iwmr->pgaddrmem;
}
- irdma_copy_user_pgaddrs(iwmr, pbl, level);
+ irdma_copy_user_pgaddrs(iwmr, pbl, pbl_len, level);
if (lvl)
iwmr->pgaddrmem[0] = *pbl;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0429/1266] RDMA/rxe: Fix a use-after-free problem in rxe_mmap
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0428/1266] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0430/1266] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
` (569 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, nasm, Zhu Yanjun, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <yanjun.zhu@linux.dev>
[ Upstream commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561 ]
rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list
and releases pending_lock while the struct's kref is still at 1:
list_del_init(&ip->pending_mmaps);
spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */
ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */
[...]
rxe_vma_open(vma); /* kref_get, ref → 2 */
remap_vmalloc_range_partial() walks PTEs without any lock.
A concurrent DESTROY_CQ ioctl on another CPU calls:
kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */
vfree(ip->obj) /* clears vmalloc PTEs mid-walk */
kfree(ip) /* frees rxe_mmap_info */
This yields:
1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the
per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert
2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears
it. User VMA holds a PTE to a free'd page which might eventually get
reallocated later by vmalloc which allows the attacker to get a clean
page-level UAF.
It is worth noting that even though a page-level UAF is possible given
the strong primitive, it is statistically very difficult to achieve
given the very short time window (after the last insert_page and before
the kref_get).
The call trace are as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:validate_page_before_insert+0x32/0x300
Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5
RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008
RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00
R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20
FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0
Call Trace:
<TASK>
insert_page+0x8f/0x190
? __pfx_insert_page+0x10/0x10
? kasan_save_alloc_info+0x38/0x60
vm_insert_page+0x2e7/0x400
remap_vmalloc_range_partial+0x212/0x3e0
remap_vmalloc_range+0x6e/0xb0
? __kasan_check_write+0x14/0x30
rxe_mmap+0x2e9/0x5d0
ib_uverbs_mmap+0x1ad/0x2c0
__mmap_region+0x12c2/0x2ad0
? __pfx___mmap_region+0x10/0x10
? __sanitizer_cov_trace_switch+0x58/0xb0
? mas_prev_slot+0x360/0x39c0
? __sanitizer_cov_trace_switch+0x58/0xb0
? mas_next_slot+0x1e5b/0x2f40
? __sanitizer_cov_trace_cmp8+0x18/0x30
? unmapped_area_topdown+0x4dd/0x610
? kfree+0x1b1/0x440
? free_cpumask_var+0x16/0x30
? __kasan_slab_free+0x7d/0xa0
? __sanitizer_cov_trace_cmp8+0x18/0x30
mmap_region+0x2e6/0x3c0
do_mmap+0xa3e/0x12a0
? __pfx_do_mmap+0x10/0x10
? __kasan_check_write+0x14/0x30
? down_write_killable+0xba/0x160
? __pfx_down_write_killable+0x10/0x10
? __sanitizer_cov_trace_cmp4+0x16/0x30
vm_mmap_pgoff+0x2d4/0x4a0
? __pfx_vm_mmap_pgoff+0x10/0x10
? fget+0x1bf/0x270
ksys_mmap_pgoff+0x40c/0x690
? __sanitizer_cov_trace_const_cmp4+0x16/0x30
? __pfx_ksys_mmap_pgoff+0x10/0x10
? __kasan_check_write+0x14/0x30
? _raw_spin_trylock+0xbb/0x130
? __pfx__raw_spin_trylock+0x10/0x10
__x64_sys_mmap+0x135/0x1e0
x64_sys_call+0x1c14/0x2790
do_syscall_64+0xd2/0x1050
? rcu_core+0x352/0x7d0
? rcu_core_si+0xe/0x20
? handle_softirqs+0x1aa/0x650
? __sanitizer_cov_trace_cmp4+0x16/0x30
? fpregs_assert_state_consistent+0xe1/0x160
? irqentry_exit+0xb1/0x670
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Link: https://patch.msgid.link/r/20260515002537.6209-1-yanjun.zhu@linux.dev
Reported-and-tested-by: nasm <n4sm@protonmail.com>
Suggested-by: nasm <n4sm@protonmail.com>
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_mmap.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
index 6b7f2bd6987991..466ab6dbe9af6f 100644
--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
+++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
@@ -93,18 +93,31 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
goto done;
found_it:
+ /*
+ * Increment refcount and check whether it is being freed atm while
+ * holding lock to prevent UAF
+ */
+ if (!kref_get_unless_zero(&ip->ref)) {
+ spin_unlock_bh(&rxe->pending_lock);
+ ret = -ENXIO;
+ goto done;
+ }
+
list_del_init(&ip->pending_mmaps);
spin_unlock_bh(&rxe->pending_lock);
+ vma->vm_ops = &rxe_vm_ops;
+ vma->vm_private_data = ip;
+
ret = remap_vmalloc_range(vma, ip->obj, 0);
if (ret) {
+ vma->vm_private_data = NULL;
+ vma->vm_ops = NULL;
+ kref_put(&ip->ref, rxe_mmap_release);
rxe_dbg_dev(rxe, "err %d from remap_vmalloc_range\n", ret);
goto done;
}
- vma->vm_ops = &rxe_vm_ops;
- vma->vm_private_data = ip;
- rxe_vma_open(vma);
done:
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0430/1266] IB/mlx4: Fix refcount leak in add_port() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0429/1266] RDMA/rxe: Fix a use-after-free problem in rxe_mmap Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0431/1266] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
` (568 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 9a8826fdfbcd7ed2ccf745f5d54208358d939def ]
After kobject_init_and_add(), the lifetime of the embedded struct
kobject is expected to be managed through the kobject core reference
counting.
In add_port(), failure paths after kobject_init_and_add() must not free
struct mlx4_port directly, because the embedded kobject is then managed
by the kobject core. Freeing it directly leaves the kobject reference
counting unbalanced and can lead to incorrect lifetime handling.
Allocate the pkey and gid attribute arrays before kobject_init_and_add(),
so failures before kobject initialization can be handled by directly
freeing the allocated memory. Once kobject_init_and_add() has been
called, unwind later failures by removing any successfully created sysfs
groups, calling kobject_del(), and then releasing the embedded kobject
with kobject_put().
Fixes: c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device")
Link: https://patch.msgid.link/r/20260518021910.972900-1-lgs201920130244@gmail.com
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx4/sysfs.c | 45 ++++++++++++++++++------------
1 file changed, 27 insertions(+), 18 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
index 88f534cf690e92..1676f819c2f760 100644
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -638,12 +638,6 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
p->port_num = port_num;
p->slave = slave;
- ret = kobject_init_and_add(&p->kobj, &port_type,
- kobject_get(dev->dev_ports_parent[slave]),
- "%d", port_num);
- if (ret)
- goto err_alloc;
-
p->pkey_group.name = "pkey_idx";
p->pkey_group.attrs =
alloc_group_attrs(show_port_pkey,
@@ -651,13 +645,9 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
dev->dev->caps.pkey_table_len[port_num]);
if (!p->pkey_group.attrs) {
ret = -ENOMEM;
- goto err_alloc;
+ goto err_free_port;
}
- ret = sysfs_create_group(&p->kobj, &p->pkey_group);
- if (ret)
- goto err_free_pkey;
-
p->gid_group.name = "gid_idx";
p->gid_group.attrs = alloc_group_attrs(show_port_gid_idx, NULL, 1);
if (!p->gid_group.attrs) {
@@ -665,28 +655,47 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
goto err_free_pkey;
}
+ ret = kobject_init_and_add(&p->kobj, &port_type,
+ kobject_get(dev->dev_ports_parent[slave]),
+ "%d", port_num);
+ if (ret)
+ goto err_put;
+
+ ret = sysfs_create_group(&p->kobj, &p->pkey_group);
+ if (ret)
+ goto err_del;
+
ret = sysfs_create_group(&p->kobj, &p->gid_group);
if (ret)
- goto err_free_gid;
+ goto err_remove_pkey;
ret = add_vf_smi_entries(p);
if (ret)
- goto err_free_gid;
+ goto err_remove_gid;
list_add_tail(&p->kobj.entry, &dev->pkeys.pkey_port_list[slave]);
return 0;
-err_free_gid:
- kfree(p->gid_group.attrs[0]);
- kfree(p->gid_group.attrs);
+err_remove_gid:
+ sysfs_remove_group(&p->kobj, &p->gid_group);
+
+err_remove_pkey:
+ sysfs_remove_group(&p->kobj, &p->pkey_group);
+
+err_del:
+ kobject_del(&p->kobj);
+
+err_put:
+ kobject_put(dev->dev_ports_parent[slave]);
+ kobject_put(&p->kobj);
+ return ret;
err_free_pkey:
for (i = 0; i < dev->dev->caps.pkey_table_len[port_num]; ++i)
kfree(p->pkey_group.attrs[i]);
kfree(p->pkey_group.attrs);
-err_alloc:
- kobject_put(dev->dev_ports_parent[slave]);
+err_free_port:
kfree(p);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0431/1266] RDMA/hns: Fix warning in poll cq direct mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0430/1266] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0432/1266] RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup Greg Kroah-Hartman
` (567 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lianfa Weng, Junxian Huang,
Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianfa Weng <wenglianfa@huawei.com>
[ Upstream commit 3f19c2a3852e6ba75f3e92dd5edc4e07f3d07f4a ]
CQs allocated by ib_alloc_cq() always have a comp_handler. Though
in direct mode this handler is never expected to be called, it
is still called when the driver is reset, triggering the following
WARN_ONCE():
Call trace:
ib_cq_completion_direct+0x38/0x60
hns_roce_cq_completion+0x54/0x90 (hns_roce_hw_v2]
hns_roce_handle_device_err+Ox1c8/0x340 [hns_roce_hw_v2]
hns_roce_hw_v2_uninit_instance.constprop.0+0x34/0x70 [hns_roce_hw_v2]
hns_roce_hw_v2_reset_notify+0xc4/0xe0 [hns_roce_hw_v2]
hclge_notify_roce_client+0x60/0xbc [hclge]
hclge_reset_rebuild+0x48/0x34c [hclge]
hclge_reset_subtask+0xcc/0xec [hclge]
hclge_reset_service_task+0x80/0x160 [hclge]
hclge_service_task+0x50/0x80 (hclge]
process_one_work+0x1cc/0x4d0
worker_thread+0x154/0x414
kthread+0x104/0x144
ret_from_fork+0x10/0x18
Fixes: f295e4cece5c ("RDMA/hns: Delete unnecessary callback functions for cq")
Link: https://patch.msgid.link/r/20260520055759.2354037-3-huangjunxian6@hisilicon.com
Signed-off-by: Lianfa Weng <wenglianfa@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index 5f39a25064d10d..a67b3291e68f4d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -969,7 +969,7 @@ static void check_and_get_armed_cq(struct list_head *cq_list, struct ib_cq *cq)
unsigned long flags;
spin_lock_irqsave(&hr_cq->lock, flags);
- if (cq->comp_handler) {
+ if (cq->comp_handler && hr_cq->ib_cq.poll_ctx != IB_POLL_DIRECT) {
if (!hr_cq->is_armed) {
hr_cq->is_armed = 1;
list_add_tail(&hr_cq->node, cq_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0432/1266] RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0431/1266] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0433/1266] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
` (566 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Cui, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Cui <cuitao@kylinos.cn>
[ Upstream commit b86fd95805a7bd4c5b9465c9e7f75e45bbe7eb6f ]
The error cleanup loop in rdma_counter_init() iterates with variable
'i' but accesses dev->port_data[port] instead of dev->port_data[i].
This causes the failed port's hstats to be freed multiple times while
leaking hstats of previously initialized ports.
Fixes: 56594ae1d250 ("RDMA/core: Annotate destroy of mutex to ensure that it is released as unlocked")
Link: https://patch.msgid.link/r/20260520104546.1776253-3-cuitao@kylinos.cn
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/counters.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index af59486fe41852..d41af5ab6403ab 100644
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -649,7 +649,7 @@ void rdma_counter_init(struct ib_device *dev)
fail:
for (i = port; i >= rdma_start_port(dev); i--) {
- port_counter = &dev->port_data[port].port_counter;
+ port_counter = &dev->port_data[i].port_counter;
rdma_free_hw_stats_struct(port_counter->hstats);
port_counter->hstats = NULL;
mutex_destroy(&port_counter->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0433/1266] PM: sleep: Use complete() in device_pm_sleep_init()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0432/1266] RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0434/1266] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
` (565 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiakai Xu, Rafael J. Wysocki,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
[ Upstream commit 3855941f1e4069182c895d5093c5fa589f5b38bd ]
Replace complete_all() with complete() in device_pm_sleep_init() to allow
it to be called in atomic contexts without triggering a false-positive
WARNING from lockdep_assert_RT_in_threaded_ctx() when
CONFIG_PROVE_RAW_LOCK_NESTING is enabled.
device_pm_sleep_init() may be called during device initialization while
holding a raw_spinlock (e.g., from within device_initialize()), and
complete_all() is unsafe in atomic contexts on PREEMPT_RT kernels.
complete(), which is safe to call from any context, is sufficient here.
complete_all() sets the completion count to UINT_MAX/2 (permanently
signaled), while complete() increments it by 1. Since no threads can be
waiting during device initialization, both are functionally equivalent.
The completion is always reinitialized via reinit_completion() in
dpm_clear_async_state() before each suspend/resume cycle.
However, changing to complete() introduces a potential deadlock for
devices with no PM support (dev->power.no_pm = true). Such devices are
never added to the dpm_list and never go through dpm_clear_async_state(),
so their completion is never reinitialized. A parent device waiting on a
no_pm child across multiple suspend phases would consume the single-use
token in the first phase and block forever in the second.
Fix this by adding an early return in dpm_wait() when dev->power.no_pm is
set, since no_pm devices do not participate in system suspend/resume.
Fixes: 152e1d592071 ("PM: Prevent waiting forever on asynchronous resume after failing suspend")
Signed-off-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/20260523022314.2657232-1-xujiakai24@mails.ucas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index ef5157fc8dcc51..dc3d30860ef328 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -101,7 +101,7 @@ void device_pm_sleep_init(struct device *dev)
dev->power.is_noirq_suspended = false;
dev->power.is_late_suspended = false;
init_completion(&dev->power.completion);
- complete_all(&dev->power.completion);
+ complete(&dev->power.completion);
dev->power.wakeup = NULL;
INIT_LIST_HEAD(&dev->power.entry);
}
@@ -238,6 +238,10 @@ static void dpm_wait(struct device *dev, bool async)
if (!dev)
return;
+ /* Devices with no PM support don't use the completion. */
+ if (dev->power.no_pm)
+ return;
+
if (async || (pm_async_enabled && dev->power.async_suspend))
wait_for_completion(&dev->power.completion);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0434/1266] MIPS: Fix big-endian stack argument fetching in o32 wrapper
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0433/1266] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0435/1266] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
` (564 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit 8e0780d30b1b51248e42895b7acc7a20f147b40b ]
Fix an issue in call_o32() where the upper 32-bit half of incoming n64
stack arguments is fetched and used for outgoing o32 stack arguments on
big-endian platforms.
This code was adapted from arch/mips/dec/prom/call_o32.S which was meant
for a little-endian platform only and therefore using 32-bit loads from
64-bit stack slot locations holding incoming stack arguments resulted in
correct values being retrieved for data that is expected to be 32-bit.
This works on little-endian platforms where the lower 32-bit half of the
64-bit value is located at every 64-bit stack slot location. However on
big-endian platforms the lower 32-bit half is instead located at offset
4 from every 64-bit stack slot location.
So to fix the issue the offset of 4 would have to be used on big-endian
platforms only, or alternatively a 64-bit load from the 64-bit stack
slot location can be used across the board, as the subsequent 32-bit
store to the corresponding outgoing stack argument slot will correctly
truncate the value and cause no unpredictable result. We already take
advantage of this architectural feature for the incoming arguments held
in $a6 and $a7 registers, since the o32 wrapper does not know how many
incoming arguments there are and consequently propagates incoming data
which may not be 32-bit.
Since this code is generally supposed to be used with the stack located
in cached memory there is no extra overhead expected for 64-bit loads as
opposed to 32-bit ones, so pick this variant for code simplicity.
Fixes: 231a35d37293 ("[MIPS] RM: Collected changes")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/fw/lib/call_o32.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/fw/lib/call_o32.S b/arch/mips/fw/lib/call_o32.S
index ee856709e0b600..77533cfbdfc10b 100644
--- a/arch/mips/fw/lib/call_o32.S
+++ b/arch/mips/fw/lib/call_o32.S
@@ -74,7 +74,7 @@ NESTED(call_o32, O32_FRAMESZ, ra)
PTR_LA t1,6*O32_SZREG(fp)
li t2,O32_ARGC-6
1:
- lw t3,(t0)
+ ld t3,(t0)
REG_ADDU t0,SZREG
sw t3,(t1)
REG_SUBU t2,1
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0435/1266] MIPS: DEC: Remove do_IRQ() call indirection
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0434/1266] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0436/1266] mips: ralink: mt7621: add missing __iomem Greg Kroah-Hartman
` (563 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit 35554eadc1b127bb5294504a4ac8f3a5dd9e299d ]
As from commit 8f99a1626535 ("MIPS: Tracing: Add IRQENTRY_EXIT section
for MIPS") do_IRQ() is not a macro anymore and can be invoked directly
from assembly code, as a tail call. Remove the dec_irq_dispatch() stub
then and the indirection previously introduced with commit 187933f23679
("[MIPS] do_IRQ cleanup"), improving performance by reducing the number
of control flow changes and the overall instruction count, while fixing
a compiler's complaint about a missing prototype for said stub:
arch/mips/dec/setup.c:780:25: warning: no previous prototype for 'dec_irq_dispatch' [-Wmissing-prototypes]
780 | asmlinkage unsigned int dec_irq_dispatch(unsigned int irq)
| ^~~~~~~~~~~~~~~~
(which gets promoted to a compilation error with CONFIG_WERROR).
Fixes: 8f99a1626535 ("MIPS: Tracing: Add IRQENTRY_EXIT section for MIPS")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/dec/int-handler.S | 2 +-
arch/mips/dec/setup.c | 6 ------
2 files changed, 1 insertion(+), 7 deletions(-)
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 011d1d678840aa..a0b439c90488fc 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -277,7 +277,7 @@
srlv t3,t1,t2
handle_it:
- j dec_irq_dispatch
+ j do_IRQ
nop
#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
index 6c3704f51d0de4..ca6cb6b7293b44 100644
--- a/arch/mips/dec/setup.c
+++ b/arch/mips/dec/setup.c
@@ -776,9 +776,3 @@ void __init arch_init_irq(void)
pr_err("Failed to register halt interrupt\n");
}
}
-
-asmlinkage unsigned int dec_irq_dispatch(unsigned int irq)
-{
- do_IRQ(irq);
- return 0;
-}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0436/1266] mips: ralink: mt7621: add missing __iomem
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0435/1266] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0437/1266] mips: n64: add __iomem for writel call Greg Kroah-Hartman
` (562 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Rosen Penev,
Sergio Paracuellos, Thomas Bogendoerfer, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 4ddaf88aadd3bd09c2eb3734c53d2864af6b144e ]
raw_readl and writel calls expect pointers annotated with __iomem.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild/202211060456.cnV6IK6G-lkp@intel.com/
Fixes: cc19db8b312a ("MIPS: ralink: mt7621: do memory detection on KSEG1")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/ralink/mt7621.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/ralink/mt7621.c b/arch/mips/ralink/mt7621.c
index 137781d0bd0a12..01a6219214081a 100644
--- a/arch/mips/ralink/mt7621.c
+++ b/arch/mips/ralink/mt7621.c
@@ -63,7 +63,7 @@ phys_addr_t mips_cpc_default_phys_base(void)
static bool __init mt7621_addr_wraparound_test(phys_addr_t size)
{
- void *dm = (void *)KSEG1ADDR(&detect_magic);
+ void __iomem *dm = (void __iomem *)KSEG1ADDR(&detect_magic);
if (CPHYSADDR(dm + size) >= MT7621_LOWMEM_MAX_SIZE)
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0437/1266] mips: n64: add __iomem for writel call
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0436/1266] mips: ralink: mt7621: add missing __iomem Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0438/1266] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
` (561 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Rosen Penev,
Thomas Bogendoerfer, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit 579f5329d5df2dbcf4bb5ef398701c2501d24892 ]
sparse: incorrect type in argument 2 (different address spaces) @@
expected void volatile [noderef] __iomem *mem @@
got unsigned int [usertype] *
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202105261445.AcvPd2EE-lkp@intel.com/
Fixes: baec970aa5ba ("mips: Add N64 machine type")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/n64/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/n64/init.c b/arch/mips/n64/init.c
index dfbd864f466700..66ec28ab41f321 100644
--- a/arch/mips/n64/init.c
+++ b/arch/mips/n64/init.c
@@ -50,7 +50,7 @@ void __init prom_init(void)
#define W 320
#define H 240
-#define REG_BASE ((u32 *) CKSEG1ADDR(0x4400000))
+#define REG_BASE ((u32 __iomem *) CKSEG1ADDR(0x4400000))
static void __init n64rdp_write_reg(const u8 reg, const u32 value)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0438/1266] mtd: spi-nor: Drop duplicate Kconfig dependency
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0437/1266] mips: n64: add __iomem for writel call Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0439/1266] ALSA: seq: midi: Serialize output teardown with event_input Greg Kroah-Hartman
` (560 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Michael Walle,
Pratyush Yadav, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit a6470e2162e9c3779a4bd6ff3bed1b81d796e46e ]
I do not think the MTD dependency is needed twice. This is likely a
duplicate coming from a former rebase when the spi-nor core got cleaned
up a while ago. Remove the extra line.
Fixes: b35b9a10362d ("mtd: spi-nor: Move m25p80 code in spi-nor.c")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/Kconfig b/drivers/mtd/spi-nor/Kconfig
index 24cd25de2b8b71..fd05a24d64a96f 100644
--- a/drivers/mtd/spi-nor/Kconfig
+++ b/drivers/mtd/spi-nor/Kconfig
@@ -1,7 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
menuconfig MTD_SPI_NOR
tristate "SPI NOR device support"
- depends on MTD
depends on MTD && SPI_MASTER
select SPI_MEM
help
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0439/1266] ALSA: seq: midi: Serialize output teardown with event_input
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0438/1266] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0440/1266] pinctrl: cs42l43: Fix polarity on debounce Greg Kroah-Hartman
` (559 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Cen, Takashi Iwai, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit ef7607ab1c8adc6258fb1b27d08e26aecdc18a58 ]
event_process_midi() borrows msynth->output_rfile.output and then
passes the substream to dump_midi() and snd_rawmidi_kernel_write()
without synchronizing with the output open/close transition.
midisynth_use() also publishes output_rfile before
snd_rawmidi_output_params() has finished.
The last midisynth_unuse() can therefore release the same rawmidi file
and free substream->runtime before snd_rawmidi_kernel_write1() takes
its runtime buffer reference. That leaves the event_input path using a
stale substream or runtime and can end in a NULL-deref or use-after-free.
Fix this with two pieces of synchronization. Keep a short IRQ-safe
spinlock only for publishing or clearing output_rfile and for pairing
the output snapshot with an snd_use_lock_t reference. Once
event_process_midi() has taken that in-flight reference, it drops the
spinlock before calling snd_seq_dump_var_event(), dump_midi(), or
snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible
rawmidi file under the same spinlock, waits for the in-flight writers
to drain, and only then drains and releases the saved file.
midisynth_use() likewise opens into a local snd_rawmidi_file and
publishes it only after snd_rawmidi_output_params() succeeds.
The buggy scenario involves two paths, with each column showing the
order within that path:
event_input path: last unuse path:
1. event_process_midi() snapshots 1. midisynth_unuse() starts
output_rfile.output. tearing down output_rfile.
2. dump_midi() reaches 2. snd_rawmidi_kernel_release()
snd_rawmidi_kernel_write() closes the output file.
before runtime is pinned. 3. close_substream() frees
3. The callback keeps using substream->runtime.
the borrowed substream.
Validation reproduced this kernel report:
KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360
RIP: 0033:0x7fde7dd0837f
RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Link: https://patch.msgid.link/20260527062948.3614025-1-rollkingzzc@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/seq_midi.c | 55 +++++++++++++++++++++++++++++----------
1 file changed, 41 insertions(+), 14 deletions(-)
diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
index 78dcb0ea155827..c8a7c39747113d 100644
--- a/sound/core/seq/seq_midi.c
+++ b/sound/core/seq/seq_midi.c
@@ -24,6 +24,7 @@ Possible options for midisynth module:
#include <sound/seq_device.h>
#include <sound/seq_midi_event.h>
#include <sound/initval.h>
+#include "seq_lock.h"
MODULE_AUTHOR("Frank van de Pol <fvdpol@coil.demon.nl>, Jaroslav Kysela <perex@perex.cz>");
MODULE_DESCRIPTION("Advanced Linux Sound Architecture sequencer MIDI synth.");
@@ -42,6 +43,8 @@ struct seq_midisynth {
int device;
int subdevice;
struct snd_rawmidi_file input_rfile;
+ spinlock_t output_lock; /* protects output_rfile publication */
+ snd_use_lock_t output_use_lock; /* in-flight event_input users */
struct snd_rawmidi_file output_rfile;
int seq_client;
int seq_port;
@@ -125,31 +128,42 @@ static int event_process_midi(struct snd_seq_event *ev, int direct,
struct seq_midisynth *msynth = private_data;
unsigned char msg[10]; /* buffer for constructing midi messages */
struct snd_rawmidi_substream *substream;
+ int err = 0;
int len;
if (snd_BUG_ON(!msynth))
return -EINVAL;
- substream = msynth->output_rfile.output;
- if (substream == NULL)
- return -ENODEV;
+
+ scoped_guard(spinlock_irqsave, &msynth->output_lock) {
+ substream = msynth->output_rfile.output;
+ if (!substream)
+ return -ENODEV;
+ snd_use_lock_use(&msynth->output_use_lock);
+ }
+
if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { /* special case, to save space */
if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) {
/* invalid event */
pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
- return 0;
+ goto out;
}
snd_seq_dump_var_event(ev, __dump_midi, substream);
snd_midi_event_reset_decode(msynth->parser);
} else {
- if (msynth->parser == NULL)
- return -EIO;
+ if (!msynth->parser) {
+ err = -EIO;
+ goto out;
+ }
len = snd_midi_event_decode(msynth->parser, msg, sizeof(msg), ev);
if (len < 0)
- return 0;
+ goto out;
if (dump_midi(substream, msg, len) < 0)
snd_midi_event_reset_decode(msynth->parser);
}
- return 0;
+
+out:
+ snd_use_lock_free(&msynth->output_use_lock);
+ return err;
}
@@ -163,6 +177,8 @@ static int snd_seq_midisynth_new(struct seq_midisynth *msynth,
msynth->card = card;
msynth->device = device;
msynth->subdevice = subdevice;
+ spin_lock_init(&msynth->output_lock);
+ snd_use_lock_init(&msynth->output_use_lock);
return 0;
}
@@ -215,12 +231,13 @@ static int midisynth_use(void *private_data, struct snd_seq_port_subscribe *info
{
int err;
struct seq_midisynth *msynth = private_data;
+ struct snd_rawmidi_file rfile = {};
struct snd_rawmidi_params params;
/* open midi port */
err = snd_rawmidi_kernel_open(msynth->rmidi, msynth->subdevice,
SNDRV_RAWMIDI_LFLG_OUTPUT,
- &msynth->output_rfile);
+ &rfile);
if (err < 0) {
pr_debug("ALSA: seq_midi: midi output open failed!!!\n");
return err;
@@ -229,12 +246,14 @@ static int midisynth_use(void *private_data, struct snd_seq_port_subscribe *info
params.avail_min = 1;
params.buffer_size = output_buffer_size;
params.no_active_sensing = 1;
- err = snd_rawmidi_output_params(msynth->output_rfile.output, ¶ms);
+ err = snd_rawmidi_output_params(rfile.output, ¶ms);
if (err < 0) {
- snd_rawmidi_kernel_release(&msynth->output_rfile);
+ snd_rawmidi_kernel_release(&rfile);
return err;
}
snd_midi_event_reset_decode(msynth->parser);
+ scoped_guard(spinlock_irqsave, &msynth->output_lock)
+ msynth->output_rfile = rfile;
return 0;
}
@@ -242,11 +261,19 @@ static int midisynth_use(void *private_data, struct snd_seq_port_subscribe *info
static int midisynth_unuse(void *private_data, struct snd_seq_port_subscribe *info)
{
struct seq_midisynth *msynth = private_data;
+ struct snd_rawmidi_file rfile = {};
- if (snd_BUG_ON(!msynth->output_rfile.output))
+ scoped_guard(spinlock_irqsave, &msynth->output_lock) {
+ rfile = msynth->output_rfile;
+ msynth->output_rfile = (struct snd_rawmidi_file){};
+ }
+
+ if (snd_BUG_ON(!rfile.output))
return -EINVAL;
- snd_rawmidi_drain_output(msynth->output_rfile.output);
- return snd_rawmidi_kernel_release(&msynth->output_rfile);
+
+ snd_use_lock_sync(&msynth->output_use_lock);
+ snd_rawmidi_drain_output(rfile.output);
+ return snd_rawmidi_kernel_release(&rfile);
}
/* delete given midi synth port */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0440/1266] pinctrl: cs42l43: Fix polarity on debounce
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0439/1266] ALSA: seq: midi: Serialize output teardown with event_input Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0441/1266] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
` (558 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charles Keepax, Bartosz Golaszewski,
Linus Walleij, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 9da52ee80aee3ab3c69208bd1cfbb4be01371214 ]
The debounce bit sets a bypass on the debounce rather than enabling it,
as such the current polarity of the debounce is set incorrectly. Invert
the polarity to correct this.
Fixes: d5282a539297 ("pinctrl: cs42l43: Add support for the cs42l43")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
index 1640c5522f0e8a..53229faa5cc5b2 100644
--- a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
+++ b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
@@ -343,7 +343,7 @@ static inline int cs42l43_pin_set_db(struct cs42l43_pin *priv, unsigned int pin,
return regmap_update_bits(priv->regmap, CS42L43_GPIO_CTRL2,
CS42L43_GPIO1_DEGLITCH_BYP_MASK << pin,
- !!us << pin);
+ !us << pin);
}
static int cs42l43_pin_config_get(struct pinctrl_dev *pctldev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0441/1266] nvme-multipath: fix flex array size in struct nvme_ns_head
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0440/1266] pinctrl: cs42l43: Fix polarity on debounce Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0442/1266] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
` (557 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Kumar Chaurasiya (IBM),
Hannes Reinecke, John Garry, Christoph Hellwig, Nilay Shroff,
Keith Busch, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <nilay@linux.ibm.com>
[ Upstream commit 001e57554de81aa79c25c18fd53911d8a415c304 ]
struct nvme_ns_head contains a flexible array member, current_path[],
which is indexed using the NUMA node ID:
head->current_path[numa_node_id()]
The structure is currently allocated as:
size = sizeof(struct nvme_ns_head) +
(num_possible_nodes() * sizeof(struct nvme_ns *));
head = kzalloc(size, GFP_KERNEL);
This allocation assumes that NUMA node IDs are sequential and densely
packed from 0 .. num_possible_nodes() - 1. While this assumption holds
on many systems, it is not always true on some architectures such as
powerpc.
On some powerpc systems, NUMA node IDs can be sparse. For example:
NUMA:
NUMA node(s): 6
NUMA node0 CPU(s): 80-159
NUMA node8 CPU(s): 0-79
NUMA node252 CPU(s):
NUMA node253 CPU(s):
NUMA node254 CPU(s):
NUMA node255 CPU(s):
That is, the possible/online NUMA node IDs are: 0, 8, 252, 253, 254, 255
In this case: num_possible_nodes() = 6
So memory is allocated for only 6 entries in current_path[]. However,
the array is later indexed using the actual NUMA node ID. As a result,
accesses such as:
head->current_path[8] or
head->current_path[252]
goes out of bounds, leading to the following KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
Write of size 8 at addr c00020003bda35b8 by task kworker/u641:2/1997
CPU: 1 UID: 0 PID: 1997 Comm: kworker/u641:2 Not tainted 7.1.0-rc5-dirty #14 PREEMPT(lazy)
Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV
Workqueue: async async_run_entry_fn
Call Trace:
[c000200037fa7510] [c0000000021c23d4] dump_stack_lvl+0x88/0xdc (unreliable)
[c000200037fa7540] [c0000000009fda90] print_report+0x22c/0x67c
[c000200037fa7630] [c0000000009fd508] kasan_report+0x108/0x220
[c000200037fa7740] [c0000000009fff48] __asan_store8+0xe8/0x120
[c000200037fa7760] [c008000018e76474] nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
[c000200037fa7800] [c008000018e6556c] nvme_update_ns_info+0x4a4/0x5e0 [nvme_core]
[c000200037fa7a50] [c008000018e66270] nvme_alloc_ns+0x6d8/0x1a70 [nvme_core]
[c000200037fa7c20] [c008000018e679fc] nvme_scan_ns+0x3f4/0x630 [nvme_core]
[c000200037fa7d10] [c00000000031f22c] async_run_entry_fn+0x9c/0x3a0
[c000200037fa7db0] [c0000000002fa544] process_one_work+0x414/0xa10
[c000200037fa7ec0] [c0000000002fbf00] worker_thread+0x320/0x640
[c000200037fa7f80] [c00000000030d0f8] kthread+0x278/0x290
[c000200037fa7fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18
Allocated by task 1997 on cpu 1 at 35.928317s:
The buggy address belongs to the object at c00020003bda3000
which belongs to the cache kmalloc-rnd-15-2k of size 2048
The buggy address is located 16 bytes to the right of
allocated 1448-byte region [c00020003bda3000, c00020003bda35a8)
The buggy address belongs to the physical page:
Memory state around the buggy address:
c00020003bda3480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c00020003bda3500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>c00020003bda3580: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
^
c00020003bda3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
c00020003bda3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fix this by allocating the flexible array using nr_node_ids instead
of num_possible_nodes(). Since nr_node_ids represents the maximum
possible NUMA node IDs, indexing current_path[] using numa_node_id()
becomes safe even on systems with sparse node IDs.
Fixes: f333444708f8 ("nvme: take node locality into account when selecting a path")
Tested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 48c46c942253c7..13ff4ac8f3e372 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3396,7 +3396,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
int ret = -ENOMEM;
#ifdef CONFIG_NVME_MULTIPATH
- size += num_possible_nodes() * sizeof(struct nvme_ns *);
+ size += nr_node_ids * sizeof(struct nvme_ns *);
#endif
head = kzalloc(size, GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0442/1266] workqueue: drop spurious * from print_worker_info() fn declaration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0441/1266] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0443/1266] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
` (556 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Breno Leitao, Tejun Heo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 611583a76ea97991b0f65ec1ff099eac7fe0bae4 ]
print_worker_info() declares its local 'fn' as work_func_t * but
worker->current_func has type work_func_t (a function pointer). The
extra level of indirection is wrong and only happens to be harmless
today because every supported Linux architecture has
sizeof(work_func_t) == sizeof(work_func_t *):
copy_from_kernel_nofault() reads the correct number of bytes by
accident, and %ps still resolves the printed address because the
stored value is the function address regardless of declared type.
On any future ABI where sizeof(void (*)()) differs from
sizeof(void *), the nofault copy would transfer the wrong number of
bytes and the subsequent %ps would print an incorrect address.
Match the field type so the intent is explicit and the code does not
silently rely on equal pointer sizes.
Fixes: 3d1cb2059d93 ("workqueue: include workqueue info when printing debug dump of a worker task")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/workqueue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8692e75aa6d808..b59cc9f86d1595 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5119,7 +5119,7 @@ EXPORT_SYMBOL_GPL(set_worker_desc);
*/
void print_worker_info(const char *log_lvl, struct task_struct *task)
{
- work_func_t *fn = NULL;
+ work_func_t fn = NULL;
char name[WQ_NAME_LEN] = { };
char desc[WORKER_DESC_LEN] = { };
struct pool_workqueue *pwq = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0443/1266] ipv6: guard against possible NULL deref in __in6_dev_stats_get()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0442/1266] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0444/1266] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
` (555 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Stephen Suryaputra,
Ido Schimmel, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc ]
dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.
Found by Sashiko.
Fixes: e1ae5c2ea478 ("vrf: Increment Icmp6InMsgs on the original netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index facb7a469efad6..e596f57f680dc1 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -334,8 +334,11 @@ static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,
const struct sk_buff *skb)
{
- if (netif_is_l3_master(dev))
+ if (netif_is_l3_master(dev)) {
dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
+ if (!dev)
+ return NULL;
+ }
return __in6_dev_get(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0444/1266] net/sched: cls_bpf: prevent unbounded recursion in offload rollback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0443/1266] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0445/1266] drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered Greg Kroah-Hartman
` (554 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Jiayuan Chen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit 27db54b90bcc7c37867fe664107fa25ea6a116e4 ]
Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd().
Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the
bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace
calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then
swaps prog/oldprog and recursively calls itself to roll back. But
bpf_tc_accept=0 makes the rollback fail too, which triggers yet another
rollback frame with the same arguments, and so on until the stack is
exhausted.
bpf_tc_accept is just a convenient knob for the reproducer. Any driver
whose tc_setup_cb_replace() fails twice in a row can hit the same loop,
so this is not a netdevsim-only issue.
Two ways to fix it:
1) Have the rollback call tc_setup_cb_add() on oldprog instead of
re-entering cls_bpf_offload_cmd().
2) Mark the rollback frame with a flag and skip a second-level
rollback from inside it.
Go with (2). It is the smaller change and keeps the original behaviour:
the rollback still goes through tc_setup_cb_replace(), so the driver
gets one real chance to restore its state. If that attempt also fails,
we just return the original error instead of recursing.
[1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u
Fixes: 102740bd9436 ("cls_bpf: fix offload assumptions after callback conversion")
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260526025529.24382-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_bpf.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 29dfe6767f108c..d5a5dffcd6f9b5 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -142,7 +142,8 @@ static bool cls_bpf_is_ebpf(const struct cls_bpf_prog *prog)
static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
struct cls_bpf_prog *oldprog,
- struct netlink_ext_ack *extack)
+ struct netlink_ext_ack *extack,
+ bool is_rollback)
{
struct tcf_block *block = tp->chain->block;
struct tc_cls_bpf_offload cls_bpf = {};
@@ -177,7 +178,8 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
&oldprog->in_hw_count, true);
if (prog && err) {
- cls_bpf_offload_cmd(tp, oldprog, prog, extack);
+ if (!is_rollback)
+ cls_bpf_offload_cmd(tp, oldprog, prog, extack, true);
return err;
}
@@ -208,7 +210,7 @@ static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
if (!prog && !oldprog)
return 0;
- return cls_bpf_offload_cmd(tp, prog, oldprog, extack);
+ return cls_bpf_offload_cmd(tp, prog, oldprog, extack, false);
}
static void cls_bpf_stop_offload(struct tcf_proto *tp,
@@ -217,7 +219,7 @@ static void cls_bpf_stop_offload(struct tcf_proto *tp,
{
int err;
- err = cls_bpf_offload_cmd(tp, NULL, prog, extack);
+ err = cls_bpf_offload_cmd(tp, NULL, prog, extack, false);
if (err)
pr_err("Stopping hardware offload failed: %d\n", err);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0445/1266] drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0444/1266] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0446/1266] drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove Greg Kroah-Hartman
` (553 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Svyatoslav Ryhel,
Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <clamor95@gmail.com>
[ Upstream commit c4ef5ba1131346159e31f4ef858525cf377380a6 ]
The host1x_client_register() function is called just prior to register map
initialization loop, making the device available to userspace. This may
result in userspace attempting to submits a job before the register map is
initialized. Address this by moving register initialization before host1x
client registration.
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260517091450.46728-2-clamor95@gmail.com
Stable-dep-of: ace01e2af387 ("drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/gr2d.c | 8 ++++----
drivers/gpu/drm/tegra/gr3d.c | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/tegra/gr2d.c b/drivers/gpu/drm/tegra/gr2d.c
index a160d01f26e1db..1b096aea3efc48 100644
--- a/drivers/gpu/drm/tegra/gr2d.c
+++ b/drivers/gpu/drm/tegra/gr2d.c
@@ -276,16 +276,16 @@ static int gr2d_probe(struct platform_device *pdev)
if (err)
return err;
+ /* initialize address register map */
+ for (i = 0; i < ARRAY_SIZE(gr2d_addr_regs); i++)
+ set_bit(gr2d_addr_regs[i], gr2d->addr_regs);
+
err = host1x_client_register(&gr2d->client.base);
if (err < 0) {
dev_err(dev, "failed to register host1x client: %d\n", err);
return err;
}
- /* initialize address register map */
- for (i = 0; i < ARRAY_SIZE(gr2d_addr_regs); i++)
- set_bit(gr2d_addr_regs[i], gr2d->addr_regs);
-
return 0;
}
diff --git a/drivers/gpu/drm/tegra/gr3d.c b/drivers/gpu/drm/tegra/gr3d.c
index 00c8564520e708..075cb1b0ec2f69 100644
--- a/drivers/gpu/drm/tegra/gr3d.c
+++ b/drivers/gpu/drm/tegra/gr3d.c
@@ -529,6 +529,10 @@ static int gr3d_probe(struct platform_device *pdev)
if (err)
return err;
+ /* initialize address register map */
+ for (i = 0; i < ARRAY_SIZE(gr3d_addr_regs); i++)
+ set_bit(gr3d_addr_regs[i], gr3d->addr_regs);
+
err = host1x_client_register(&gr3d->client.base);
if (err < 0) {
dev_err(&pdev->dev, "failed to register host1x client: %d\n",
@@ -536,10 +540,6 @@ static int gr3d_probe(struct platform_device *pdev)
return err;
}
- /* initialize address register map */
- for (i = 0; i < ARRAY_SIZE(gr3d_addr_regs); i++)
- set_bit(gr3d_addr_regs[i], gr3d->addr_regs);
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0446/1266] drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0445/1266] drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0447/1266] gpu: host1x: Allow entries in BO caches to be freed Greg Kroah-Hartman
` (552 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Ion Agorria,
Svyatoslav Ryhel, Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ion Agorria <ion@agorria.com>
[ Upstream commit ace01e2af3871343d700fb60c6f64d8f8e3180e1 ]
The current power management configuration causes GR2G/GR3D to malfunction
after resume. Reconfigure all PM actions to be handled within the GR*D
probe and remove operations to address this.
Fixes: 62fa0a985e2c ("drm/tegra: Enable runtime PM during probe")
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Ion Agorria <ion@agorria.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260517091450.46728-3-clamor95@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/gr2d.c | 13 ++++++-------
drivers/gpu/drm/tegra/gr3d.c | 13 ++++++-------
2 files changed, 12 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/tegra/gr2d.c b/drivers/gpu/drm/tegra/gr2d.c
index 1b096aea3efc48..e68847fb43d157 100644
--- a/drivers/gpu/drm/tegra/gr2d.c
+++ b/drivers/gpu/drm/tegra/gr2d.c
@@ -100,9 +100,6 @@ static int gr2d_exit(struct host1x_client *client)
if (err < 0)
return err;
- pm_runtime_dont_use_autosuspend(client->dev);
- pm_runtime_force_suspend(client->dev);
-
host1x_client_iommu_detach(client);
host1x_syncpt_put(client->syncpts[0]);
host1x_channel_put(gr2d->channel);
@@ -280,12 +277,18 @@ static int gr2d_probe(struct platform_device *pdev)
for (i = 0; i < ARRAY_SIZE(gr2d_addr_regs); i++)
set_bit(gr2d_addr_regs[i], gr2d->addr_regs);
+ pm_runtime_enable(dev);
+
err = host1x_client_register(&gr2d->client.base);
if (err < 0) {
+ pm_runtime_disable(dev);
dev_err(dev, "failed to register host1x client: %d\n", err);
return err;
}
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, 500);
+
return 0;
}
@@ -367,10 +370,6 @@ static int __maybe_unused gr2d_runtime_resume(struct device *dev)
goto disable_clk;
}
- pm_runtime_enable(dev);
- pm_runtime_use_autosuspend(dev);
- pm_runtime_set_autosuspend_delay(dev, 500);
-
return 0;
disable_clk:
diff --git a/drivers/gpu/drm/tegra/gr3d.c b/drivers/gpu/drm/tegra/gr3d.c
index 075cb1b0ec2f69..3cde55b2ff282b 100644
--- a/drivers/gpu/drm/tegra/gr3d.c
+++ b/drivers/gpu/drm/tegra/gr3d.c
@@ -108,9 +108,6 @@ static int gr3d_exit(struct host1x_client *client)
if (err < 0)
return err;
- pm_runtime_dont_use_autosuspend(client->dev);
- pm_runtime_force_suspend(client->dev);
-
host1x_client_iommu_detach(client);
host1x_syncpt_put(client->syncpts[0]);
host1x_channel_put(gr3d->channel);
@@ -533,13 +530,19 @@ static int gr3d_probe(struct platform_device *pdev)
for (i = 0; i < ARRAY_SIZE(gr3d_addr_regs); i++)
set_bit(gr3d_addr_regs[i], gr3d->addr_regs);
+ pm_runtime_enable(&pdev->dev);
+
err = host1x_client_register(&gr3d->client.base);
if (err < 0) {
+ pm_runtime_disable(&pdev->dev);
dev_err(&pdev->dev, "failed to register host1x client: %d\n",
err);
return err;
}
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 500);
+
return 0;
}
@@ -601,10 +604,6 @@ static int __maybe_unused gr3d_runtime_resume(struct device *dev)
goto disable_clk;
}
- pm_runtime_enable(dev);
- pm_runtime_use_autosuspend(dev);
- pm_runtime_set_autosuspend_delay(dev, 500);
-
return 0;
disable_clk:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0447/1266] gpu: host1x: Allow entries in BO caches to be freed
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0446/1266] drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0448/1266] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
` (551 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Kling, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc ]
When a buffer object is pinned via host1x_bo_pin() with a cache, the
resulting mapping is kept in the cache so it can be reused on subsequent
pins. Each mapping held a reference to the underlying host1x_bo (taken
in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached,
the bo itself could not be freed.
However, the only way to remove the cached mapping was through the free
path of the buffer object. This meant that if a bo got cached, it could
never get freed again.
Resolve the circularity by holding a weak reference to the bo from the
cache side. This is done by having the .pin callbacks not bump the bo's
refcount -- instead the common Host1x bo code does so, except for the
cache reference.
Also move the remove-cache-mapping-on-free code into a common function
inside Host1x code. This is only called from the TegraDRM GEM buffers
since those are the only ones that can be cached at the moment.
Reported-by: Aaron Kling <webgeek1234@gmail.com>
Fixes: 1f39b1dfa53c ("drm/tegra: Implement buffer object cache")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Tested-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260515-host1x-bocache-leak-v1-1-a0375f68aeab@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/gem.c | 13 ++------
drivers/gpu/drm/tegra/submit.c | 3 +-
drivers/gpu/host1x/bus.c | 60 +++++++++++++++++++++++++++++++++-
include/linux/host1x.h | 7 ++++
4 files changed, 69 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index a825fbbc01af6b..69a7aa5cd76ca4 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -69,7 +69,7 @@ static struct host1x_bo_mapping *tegra_bo_pin(struct device *dev, struct host1x_
return ERR_PTR(-ENOMEM);
kref_init(&map->ref);
- map->bo = host1x_bo_get(bo);
+ map->bo = bo;
map->direction = direction;
map->dev = dev;
@@ -170,7 +170,6 @@ static void tegra_bo_unpin(struct host1x_bo_mapping *map)
kfree(map->sgt);
}
- host1x_bo_put(map->bo);
kfree(map);
}
@@ -494,17 +493,9 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm,
void tegra_bo_free_object(struct drm_gem_object *gem)
{
struct tegra_drm *tegra = gem->dev->dev_private;
- struct host1x_bo_mapping *mapping, *tmp;
struct tegra_bo *bo = to_tegra_bo(gem);
- /* remove all mappings of this buffer object from any caches */
- list_for_each_entry_safe(mapping, tmp, &bo->base.mappings, list) {
- if (mapping->cache)
- host1x_bo_unpin(mapping);
- else
- dev_err(gem->dev->dev, "mapping %p stale for device %s\n", mapping,
- dev_name(mapping->dev));
- }
+ host1x_bo_clear_cached_mappings(&bo->base);
if (tegra->domain)
tegra_bo_iommu_unmap(tegra, bo);
diff --git a/drivers/gpu/drm/tegra/submit.c b/drivers/gpu/drm/tegra/submit.c
index 2430fcc97448da..705382035f5f66 100644
--- a/drivers/gpu/drm/tegra/submit.c
+++ b/drivers/gpu/drm/tegra/submit.c
@@ -76,7 +76,7 @@ gather_bo_pin(struct device *dev, struct host1x_bo *bo, enum dma_data_direction
return ERR_PTR(-ENOMEM);
kref_init(&map->ref);
- map->bo = host1x_bo_get(bo);
+ map->bo = bo;
map->direction = direction;
map->dev = dev;
@@ -117,7 +117,6 @@ static void gather_bo_unpin(struct host1x_bo_mapping *map)
dma_unmap_sgtable(map->dev, map->sgt, map->direction, 0);
sg_free_table(map->sgt);
kfree(map->sgt);
- host1x_bo_put(map->bo);
kfree(map);
}
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 3937889fa912d4..f1385489fc6e50 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -881,6 +881,20 @@ int host1x_client_resume(struct host1x_client *client)
}
EXPORT_SYMBOL(host1x_client_resume);
+/**
+ * host1x_bo_pin() - Create a DMA mapping for the buffer object
+ * @dev: Device onto which DMA map to
+ * @bo: Buffer object to map
+ * @dir: DMA direction
+ * @cache: Cache in which to store mapping, or NULL
+ *
+ * Creates a DMA mapping pointing to @bo for @dev. The refcount of @bo is incremented
+ * until host1x_bo_unpin is called.
+ *
+ * If @cache is specified, the mapping is also stored in the cache and not released
+ * until @bo is freed (refcount drops to zero). This improves performance when a buffer
+ * is pinned and unpinned frequently as in the case of display use.
+ */
struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo,
enum dma_data_direction dir,
struct host1x_bo_cache *cache)
@@ -893,6 +907,7 @@ struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo
list_for_each_entry(mapping, &cache->mappings, entry) {
if (mapping->bo == bo && mapping->direction == dir) {
kref_get(&mapping->ref);
+ host1x_bo_get(bo);
goto unlock;
}
}
@@ -902,6 +917,8 @@ struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo
if (IS_ERR(mapping))
goto unlock;
+ host1x_bo_get(bo);
+
spin_lock(&mapping->bo->lock);
list_add_tail(&mapping->list, &bo->mappings);
spin_unlock(&mapping->bo->lock);
@@ -912,7 +929,12 @@ struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo
list_add_tail(&mapping->entry, &cache->mappings);
- /* bump reference count to track the copy in the cache */
+ /*
+ * Bump the mapping reference count to track the mapping in the cache,
+ * but do not bump the BO's refcount. This allows the BO to still get freed,
+ * triggering the release of the cache mapping through
+ * host1x_bo_clear_cached_mappings.
+ */
kref_get(&mapping->ref);
}
@@ -942,9 +964,17 @@ static void __host1x_bo_unpin(struct kref *ref)
mapping->bo->ops->unpin(mapping);
}
+/**
+ * host1x_bo_unpin() - Release an established DMA mapping of a buffer object
+ * @mapping: Mapping to release
+ *
+ * Unmaps the given @mapping, unless it is cached. Decreases the refcount on
+ * the underlying buffer object.
+ */
void host1x_bo_unpin(struct host1x_bo_mapping *mapping)
{
struct host1x_bo_cache *cache = mapping->cache;
+ struct host1x_bo *bo = mapping->bo;
if (cache)
mutex_lock(&cache->lock);
@@ -953,5 +983,33 @@ void host1x_bo_unpin(struct host1x_bo_mapping *mapping)
if (cache)
mutex_unlock(&cache->lock);
+
+ host1x_bo_put(bo);
}
EXPORT_SYMBOL(host1x_bo_unpin);
+
+/**
+ * host1x_bo_clear_cached_mappings() - Remove all cached mappings pointing at a bo
+ * @bo: Buffer object to release mappings of
+ *
+ * Drops references to any mappings pointing to @bo left in any caches. This must
+ * be called by any host1x_bo implementers that may be pinned with caching enabled
+ * before freeing the bo.
+ */
+void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
+{
+ struct host1x_bo_mapping *mapping, *tmp;
+ struct host1x_bo_cache *cache;
+
+ list_for_each_entry_safe(mapping, tmp, &bo->mappings, list) {
+ cache = mapping->cache;
+ if (WARN_ON(!cache))
+ continue;
+
+ mutex_lock(&mapping->cache->lock);
+ WARN_ON(kref_read(&mapping->ref) != 1);
+ __host1x_bo_unpin(&mapping->ref);
+ mutex_unlock(&mapping->cache->lock);
+ }
+}
+EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index 9c8119ed13a4b7..4836a9f3a2b0c5 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -138,6 +138,12 @@ static inline struct host1x_bo_mapping *to_host1x_bo_mapping(struct kref *ref)
return container_of(ref, struct host1x_bo_mapping, ref);
}
+/**
+ * struct host1x_bo_ops - operations implemented by a host1x_bo provider
+ *
+ * @pin: create a DMA mapping. Implementation must not touch the bo's refcount.
+ * @unpin: destroy a DMA mapping. Implementation must not touch the bo's refcount.
+ */
struct host1x_bo_ops {
struct host1x_bo *(*get)(struct host1x_bo *bo);
void (*put)(struct host1x_bo *bo);
@@ -176,6 +182,7 @@ struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo
enum dma_data_direction dir,
struct host1x_bo_cache *cache);
void host1x_bo_unpin(struct host1x_bo_mapping *map);
+void host1x_bo_clear_cached_mappings(struct host1x_bo *bo);
static inline void *host1x_bo_mmap(struct host1x_bo *bo)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0448/1266] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0447/1266] gpu: host1x: Allow entries in BO caches to be freed Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0449/1266] gpu: host1x: Fix iommu_map_sgtable() return value check Greg Kroah-Hartman
` (550 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 63a3998d792ab5c45304bf879e385a31fa923b61 ]
The of_for_each_phandle() macro increments the reference count of the
device node it iterates over. If the loop exits early, the reference must
be released manually.
In tegra_dc_has_output(), the function returns true immediately when a
match is found, failing to release the current node's reference.
Fix this by adding a call to of_node_put() before returning from the loop.
Fixes: c57997bce423 ("drm/tegra: sor: Add Tegra186 support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260128-dc-v1-1-a88205826301@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index caa1fe6cc386eb..9c46caa6192f41 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -100,8 +100,10 @@ bool tegra_dc_has_output(struct tegra_dc *dc, struct device *dev)
int err;
of_for_each_phandle(&it, err, np, "nvidia,outputs", NULL, 0)
- if (it.node == dev->of_node)
+ if (it.node == dev->of_node) {
+ of_node_put(it.node);
return true;
+ }
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0449/1266] gpu: host1x: Fix iommu_map_sgtable() return value check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0448/1266] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0450/1266] drm/tegra: " Greg Kroah-Hartman
` (549 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 18f74762013a4b6aa6f905c4459e0f506f9c5c7b ]
Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values
in error cases, rather than a size_t and a zero.
pin_job() also was incorrectly assigning to 'int', which could cause
overflows into negative values.
Update pin_job() to correctly check for errors from iommu_map_sgtable.
Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260421-iommu_map_sgtable-return-v1-1-fb484c07d2a1@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/job.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index 3ed49e1fd93322..70bda32f1ff488 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -235,6 +235,8 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
}
if (host->domain) {
+ ssize_t map_err;
+
for_each_sgtable_sg(map->sgt, sg, j)
gather_size += sg->length;
@@ -248,11 +250,11 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
goto put;
}
- err = iommu_map_sgtable(host->domain, iova_dma_addr(&host->iova, alloc),
- map->sgt, IOMMU_READ);
- if (err == 0) {
+ map_err = iommu_map_sgtable(host->domain, iova_dma_addr(&host->iova, alloc),
+ map->sgt, IOMMU_READ);
+ if (map_err < 0) {
__free_iova(&host->iova, alloc);
- err = -EINVAL;
+ err = map_err;
goto put;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0450/1266] drm/tegra: Fix iommu_map_sgtable() return value check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0449/1266] gpu: host1x: Fix iommu_map_sgtable() return value check Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0451/1266] drm/nouveau/bios: specify correct display fuse register for Ampere and Ada Greg Kroah-Hartman
` (548 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit b3f349517de8f4469c385ebb7bfdfcc148790c0f ]
Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values
in error cases, rather than a size_t and a zero.
Update tegra_bo_iommu_map() to correctly check for errors from
iommu_map_sgtable.
Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260421-iommu_map_sgtable-return-v1-2-fb484c07d2a1@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/gem.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 69a7aa5cd76ca4..c4cc8353574ea2 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -224,6 +224,7 @@ static const struct host1x_bo_ops tegra_bo_ops = {
static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo)
{
int prot = IOMMU_READ | IOMMU_WRITE;
+ ssize_t size;
int err;
if (bo->mm)
@@ -245,13 +246,15 @@ static int tegra_bo_iommu_map(struct tegra_drm *tegra, struct tegra_bo *bo)
bo->iova = bo->mm->start;
- bo->size = iommu_map_sgtable(tegra->domain, bo->iova, bo->sgt, prot);
- if (!bo->size) {
+ size = iommu_map_sgtable(tegra->domain, bo->iova, bo->sgt, prot);
+ if (size < 0) {
dev_err(tegra->drm->dev, "failed to map buffer\n");
- err = -ENOMEM;
+ err = size;
goto remove;
}
+ bo->size = size;
+
mutex_unlock(&tegra->mm_lock);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0451/1266] drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0450/1266] drm/tegra: " Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0452/1266] libbpf: Harden parse_vma_segs() path parsing Greg Kroah-Hartman
` (547 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Tabi, Lyude Paul,
Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <ttabi@nvidia.com>
[ Upstream commit c1cf2d5db80ce91a85855bbaf4da85ff603e089a ]
The NV_FUSE_STATUS_OPT_DISPLAY register is used to determine whether
the GPU has display hardware. The current code that normally reads
this register is instead hard-coded to check for GA100 vs later GPUs.
Since this function is called only on pre-Hopper GPUs, and this
if-statement applies only to GA100 and later, the check works
because GA100 is the only non-display Ampere and Ada GPU.
However, there actually is a register that can be read, so we should
use it.
Fixes: a34632482f1e ("drm/nouveau/bios/ga10[024]: initial support")
Signed-off-by: Timur Tabi <ttabi@nvidia.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260430223838.2530778-8-ttabi@nvidia.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c
index 023ddc7c5399a4..a295e94e4cb88d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c
@@ -65,13 +65,14 @@ pramin_init(struct nvkm_bios *bios, const char *name)
/* we can't get the bios image pointer without PDISP */
if (device->card_type >= GA100)
- addr = device->chipset == 0x170; /*XXX: find the fuse reg for this */
+ addr = nvkm_rd32(device, 0x820c04);
else
if (device->card_type >= GM100)
addr = nvkm_rd32(device, 0x021c04);
else
if (device->card_type >= NV_C0)
addr = nvkm_rd32(device, 0x022500);
+
if (addr & 0x00000001) {
nvkm_debug(subdev, "... display disabled\n");
return ERR_PTR(-ENODEV);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0452/1266] libbpf: Harden parse_vma_segs() path parsing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0451/1266] drm/nouveau/bios: specify correct display fuse register for Ampere and Ada Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0453/1266] libbpf: Fix UAF in strset__add_str() Greg Kroah-Hartman
` (546 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Andrii Nakryiko,
Emil Tsalapatis, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit fee9a38174f4c6454fb1fbaf2b9b5a1cca9070d0 ]
parse_vma_segs() in tools/lib/bpf/usdt.c parses /proc/<pid>/maps
with two widthless scansets, "%s" into mode[16] and "%[^\n]"
into line[4096]. A VMA name in maps is not limited to that local
buffer; a deeply nested backing path can produce a maps record long
enough to overflow the stack buffer.
Bound both scansets to the declared buffer sizes ("%15s" for mode[16]
and "%4095[^\n]" for line[4096]) and drain any residue past line[4094]
with "%*[^\n]" before the trailing "\n". Without the drain, the residue
of an over-long record would stay in the stream and break the next
"%zx-%zx" parse, so the loop would exit early and silently skip later
maps records.
Also stop using sscanf(..., "%s") to peel the /proc/<pid>/root prefix
from lib_path. Parse the pid and prefix length with "%n", check for the
following slash, and copy the remainder with libbpf_strlcpy(). That
removes a second unbounded stack write and preserves paths containing
spaces.
Fixes: 74cc6311cec9 ("libbpf: Add USDT notes parsing and resolution logic")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260522201353.1454653-1-michael.bommarito@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/usdt.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
index 6ff28e7bf5e3da..f6689f12466f23 100644
--- a/tools/lib/bpf/usdt.c
+++ b/tools/lib/bpf/usdt.c
@@ -449,10 +449,10 @@ static int parse_elf_segs(Elf *elf, const char *path, struct elf_seg **segs, siz
static int parse_vma_segs(int pid, const char *lib_path, struct elf_seg **segs, size_t *seg_cnt)
{
- char path[PATH_MAX], line[PATH_MAX], mode[16];
+ char path[PATH_MAX], line[4096], mode[16];
size_t seg_start, seg_end, seg_off;
struct elf_seg *seg;
- int tmp_pid, i, err;
+ int tmp_pid, n, i, err;
FILE *f;
*seg_cnt = 0;
@@ -461,8 +461,13 @@ static int parse_vma_segs(int pid, const char *lib_path, struct elf_seg **segs,
* /proc/<pid>/root/<path>. They will be reported as just /<path> in
* /proc/<pid>/maps.
*/
- if (sscanf(lib_path, "/proc/%d/root%s", &tmp_pid, path) == 2 && pid == tmp_pid)
+ /* %n is not counted in sscanf() return value, so initialize it. */
+ n = 0;
+ if (sscanf(lib_path, "/proc/%d/root%n", &tmp_pid, &n) == 1 &&
+ n > 0 && pid == tmp_pid && lib_path[n] == '/') {
+ libbpf_strlcpy(path, lib_path + n, sizeof(path));
goto proceed;
+ }
if (!realpath(lib_path, path)) {
pr_warn("usdt: failed to get absolute path of '%s' (err %d), using path as is...\n",
@@ -485,8 +490,11 @@ static int parse_vma_segs(int pid, const char *lib_path, struct elf_seg **segs,
* 7f5c6f5d1000-7f5c6f5d3000 rw-p 001c7000 08:04 21238613 /usr/lib64/libc-2.17.so
* 7f5c6f5d3000-7f5c6f5d8000 rw-p 00000000 00:00 0
* 7f5c6f5d8000-7f5c6f5d9000 r-xp 00000000 103:01 362990598 /data/users/andriin/linux/tools/bpf/usdt/libhello_usdt.so
+ *
+ * Some VMA names can be longer than the local buffer. Bound the
+ * writes, but still consume the rest of the line.
*/
- while (fscanf(f, "%zx-%zx %s %zx %*s %*d%[^\n]\n",
+ while (fscanf(f, "%zx-%zx %15s %zx %*s %*d%4095[^\n]%*[^\n]\n",
&seg_start, &seg_end, mode, &seg_off, line) == 5) {
void *tmp;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0453/1266] libbpf: Fix UAF in strset__add_str()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0452/1266] libbpf: Harden parse_vma_segs() path parsing Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0454/1266] dax/kmem: account for partial discontiguous resource upon removal Greg Kroah-Hartman
` (545 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Mykyta Yatsenko,
Carlos Llamas, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
[ Upstream commit b23705e6afb6ac4ae6d220dcb35975698667dd76 ]
strset_add_str_mem() might reallocate the strset data buffer in order to
accommodate the provided string 's'. However, if 's' points to a string
already present in the buffer, it becomes dangling after the realloc.
This leads to a use-after-free when attempting to memcpy() the string
into the new buffer.
One scenario that triggers this problematic path is when resolve_btfids
attempts to patch kfunc prototypes using existing BTF parameter names:
| resolve_btfids: function bpf_list_push_back_impl already exists in BTF
| Segmentation fault (core dumped)
Compiling resolve_btfids with fsanitize=address generates a detailed
report of the UAF:
| =================================================================
| ERROR: AddressSanitizer: heap-use-after-free on address 0x7f4c4a500bd4
| ==1507892==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f4c4a500bd4 at pc 0x55d25155a2a8 bp 0x7ffcef879060 sp 0x7ffcef878818
| READ of size 5 at 0x7f4c4a500bd4 thread T0
| #0 0x55d25155a2a7 in memcpy (tools/bpf/resolve_btfids/resolve_btfids+0xcf2a7)
| #1 0x55d2515d708e in strset__add_str tools/lib/bpf/strset.c:162:2
| #2 0x55d2515c730b in btf__add_str tools/lib/bpf/btf.c:2109:8
| #3 0x55d2515c9020 in btf__add_func_param tools/lib/bpf/btf.c:3108:14
| #4 0x55d25159f0b5 in process_kfunc_with_implicit_args tools/bpf/resolve_btfids/main.c:1196:9
| #5 0x55d25159e004 in btf2btf tools/bpf/resolve_btfids/main.c:1229:9
| #6 0x55d25159cee7 in main tools/bpf/resolve_btfids/main.c:1535:6
| #7 0x7f4c78e29f76 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
| #8 0x7f4c78e2a026 in __libc_start_main csu/../csu/libc-start.c:360:3
| #9 0x55d2514bb860 in _start (tools/bpf/resolve_btfids/resolve_btfids+0x30860)
|
| 0x7f4c4a500bd4 is located 13268 bytes inside of 2829000-byte region [0x7f4c4a4fd800,0x7f4c4a7b02c8)
| freed by thread T0 here:
| #0 0x55d25155b700 in realloc (tools/bpf/resolve_btfids/resolve_btfids+0xd0700)
| #1 0x55d2515c426c in libbpf_reallocarray tools/lib/bpf/./libbpf_internal.h:220:9
| #2 0x55d2515c426c in libbpf_add_mem tools/lib/bpf/btf.c:224:13
|
| previously allocated by thread T0 here:
| #0 0x55d25155b2e3 in malloc (tools/bpf/resolve_btfids/resolve_btfids+0xd02e3)
| #1 0x55d2515d6e7d in strset__new tools/lib/bpf/strset.c:58:20
While resolve_btfids could be refactored to avoid this call path, let's
instead fix this issue at the source in strset__add_str() and avoid
similar scenarios.
Let's check if set->strs_data was reallocated and whether 's' points to
an internal string within the old strset buffer. In such case, 's' is
reconstructed to point to the new buffer.
While already here, also fix strset__find_str() which suffers from the
same problem by factoring out the common operations into a new helper
function strset_str_append().
Fixes: 90d76d3ececc ("libbpf: Extract internal set-of-strings datastructure APIs")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Suggested-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260523162722.2718940-1-cmllamas@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/strset.c | 62 ++++++++++++++++++++++++++++--------------
1 file changed, 41 insertions(+), 21 deletions(-)
diff --git a/tools/lib/bpf/strset.c b/tools/lib/bpf/strset.c
index 2464bcbd04e037..ace73c6b3d62b4 100644
--- a/tools/lib/bpf/strset.c
+++ b/tools/lib/bpf/strset.c
@@ -107,6 +107,41 @@ static void *strset_add_str_mem(struct strset *set, size_t add_sz)
set->strs_data_len, set->strs_data_max_len, add_sz);
}
+static long strset_str_append(struct strset *set, const char *s)
+{
+ uintptr_t old_data = (uintptr_t)set->strs_data;
+ size_t old_data_len = set->strs_data_len;
+ uintptr_t old_s = (uintptr_t)s;
+ long len = strlen(s) + 1;
+ void *p;
+
+ /*
+ * Hashmap keys are always offsets within set->strs_data, so to even
+ * look up some string from the "outside", we need to first append it
+ * at the end, so that it can be addressed with an offset. Luckily,
+ * until set->strs_data_len is incremented, that string is just a piece
+ * of garbage for the rest of the code, so no harm, no foul. On the
+ * other hand, if the string is unique, it's already appended and
+ * ready to be used, only a simple set->strs_data_len increment away.
+ */
+ p = strset_add_str_mem(set, len);
+ if (!p)
+ return -ENOMEM;
+
+ /*
+ * The set->strs_data might have reallocated and if 's' pointed
+ * to an internal string within the old buffer, then it became
+ * dangling and needs to be reconstructed before the copy.
+ */
+ if (old_data && old_data != (uintptr_t)set->strs_data &&
+ old_s >= old_data && old_s < old_data + old_data_len)
+ s = set->strs_data + (old_s - old_data);
+
+ memcpy(p, s, len);
+
+ return len;
+}
+
/* Find string offset that corresponds to a given string *s*.
* Returns:
* - >0 offset into string data, if string is found;
@@ -116,16 +151,12 @@ static void *strset_add_str_mem(struct strset *set, size_t add_sz)
int strset__find_str(struct strset *set, const char *s)
{
long old_off, new_off, len;
- void *p;
- /* see strset__add_str() for why we do this */
- len = strlen(s) + 1;
- p = strset_add_str_mem(set, len);
- if (!p)
- return -ENOMEM;
+ len = strset_str_append(set, s);
+ if (len < 0)
+ return len;
new_off = set->strs_data_len;
- memcpy(p, s, len);
if (hashmap__find(set->strs_hash, new_off, &old_off))
return old_off;
@@ -142,24 +173,13 @@ int strset__find_str(struct strset *set, const char *s)
int strset__add_str(struct strset *set, const char *s)
{
long old_off, new_off, len;
- void *p;
int err;
- /* Hashmap keys are always offsets within set->strs_data, so to even
- * look up some string from the "outside", we need to first append it
- * at the end, so that it can be addressed with an offset. Luckily,
- * until set->strs_data_len is incremented, that string is just a piece
- * of garbage for the rest of the code, so no harm, no foul. On the
- * other hand, if the string is unique, it's already appended and
- * ready to be used, only a simple set->strs_data_len increment away.
- */
- len = strlen(s) + 1;
- p = strset_add_str_mem(set, len);
- if (!p)
- return -ENOMEM;
+ len = strset_str_append(set, s);
+ if (len < 0)
+ return len;
new_off = set->strs_data_len;
- memcpy(p, s, len);
/* Now attempt to add the string, but only if the string with the same
* contents doesn't exist already (HASHMAP_ADD strategy). If such
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0454/1266] dax/kmem: account for partial discontiguous resource upon removal
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0453/1266] libbpf: Fix UAF in strset__add_str() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0455/1266] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
` (544 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Davidlohr Bueso, Ben Cheatham,
Alison Schofield, Jonathan Cameron, Dan Williams, Dave Jiang,
Vishal Verma, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <dave@stgolabs.net>
[ Upstream commit 8aa442cfce79e2d69e72fc8e0c0864ac2971149d ]
When dev_dax_kmem_probe() partially succeeds (at least one range is
mapped) but a subsequent range fails request_mem_region() or
add_memory_driver_managed(), the probe silently continues, ultimately
returning success, but with the corresponding range resource NULL'ed out.
dev_dax_kmem_remove() iterates over all dax_device ranges regardless of if
the underlying resource exists. When remove_memory() is called later, it
returns 0 because the memory was never added which causes
dev_dax_kmem_remove() to incorrectly assume the (nonexistent) resource can
be removed and attempts cleanup on a NULL pointer.
Fix this by skipping these ranges altogether, noting that these cases are
considered success, such that the cleanup is still reached when all
actually-added ranges are successfully removed.
Link: https://lore.kernel.org/20260223201516.1517657-1-dave@stgolabs.net
Fixes: 60e93dc097f7 ("device-dax: add dis-contiguous resource support")
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dax/kmem.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
index c57acb73e3db2a..60d8bb7acf519a 100644
--- a/drivers/dax/kmem.c
+++ b/drivers/dax/kmem.c
@@ -193,6 +193,12 @@ static void dev_dax_kmem_remove(struct dev_dax *dev_dax)
if (rc)
continue;
+ /* range was never added during probe */
+ if (!data->res[i]) {
+ success++;
+ continue;
+ }
+
rc = remove_memory(range.start, range_len(&range));
if (rc == 0) {
remove_resource(data->res[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0455/1266] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0454/1266] dax/kmem: account for partial discontiguous resource upon removal Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0456/1266] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
` (543 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alexandre Bounine,
Chul Kim, Matt Porter, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit fc15e3a30ddd950f009c76765331783b9af94a87 ]
With a list_for_each() loop, if we don't find the item we are looking for
in the list, then the loop exits with the iterator, which is "dbell" in
this loop, pointing to invalid memory.
This code uses the "found" variable to determine if we have found the
doorbell we are looking for or not. However, the problem that the "found"
variable needs to be set to false at the start of each iteration,
otherwise after the first correct doorbell, then everything is marked as
found.
Reset the "found" to false at the start of the iteration and move the
variable inside the loop.
Link: https://lore.kernel.org/af2WHMZiqMwdYveO@stanley.mountain
Fixes: 48618fb4e522 ("RapidIO: add mport driver for Tsi721 bridge")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Chul Kim <chul.kim@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rapidio/devices/tsi721.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 83323c3d10aff7..61ac7c8a1c7f65 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -384,7 +384,6 @@ static void tsi721_db_dpc(struct work_struct *work)
idb_work);
struct rio_mport *mport;
struct rio_dbell *dbell;
- int found = 0;
u32 wr_ptr, rd_ptr;
u64 *idb_entry;
u32 regval;
@@ -402,6 +401,8 @@ static void tsi721_db_dpc(struct work_struct *work)
rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
while (wr_ptr != rd_ptr) {
+ int found = 0;
+
idb_entry = (u64 *)(priv->idb_base +
(TSI721_IDB_ENTRY_SIZE * rd_ptr));
rd_ptr++;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0456/1266] ocfs2: dont BUG_ON an invalid journal dinode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0455/1266] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0457/1266] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
` (542 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhengYuan Huang, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <gality369@gmail.com>
[ Upstream commit c0438198c28b1d22c272751af5e717c11d9fa8dd ]
[BUG]
A fuzzed OCFS2 image can corrupt the current slot journal dinode while
mount is still in progress. The mount path first reports the invalid
journal block and then crashes in shutdown:
kernel BUG at fs/ocfs2/journal.c:1034!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_journal_toggle_dirty+0x2d6/0x340 fs/ocfs2/journal.c:1034
Call Trace:
ocfs2_journal_shutdown+0x414/0xc30 fs/ocfs2/journal.c:1116
ocfs2_mount_volume fs/ocfs2/super.c:1785 [inline]
ocfs2_fill_super+0x30a9/0x3cd0 fs/ocfs2/super.c:1083
get_tree_bdev_flags+0x38b/0x640 fs/super.c:1698
get_tree_bdev+0x24/0x40 fs/super.c:1721
ocfs2_get_tree+0x21/0x30 fs/ocfs2/super.c:1184
vfs_get_tree+0x9a/0x370 fs/super.c:1758
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3642 [inline]
do_new_mount fs/namespace.c:3718 [inline]
path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
do_mount fs/namespace.c:4041 [inline]
__do_sys_mount fs/namespace.c:4229 [inline]
__se_sys_mount fs/namespace.c:4206 [inline]
__x64_sys_mount+0x282/0x320 fs/namespace.c:4206
...
[CAUSE]
ocfs2_journal_toggle_dirty() used to return -EIO when journal->j_bh no
longer contained a valid dinode, because the startup and shutdown paths
already handled that failure. Commit 10995aa2451a
("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.") changed
the check to a BUG_ON() under the assumption that the journal dinode had
already been validated. That turns an unexpected invalid journal dinode
during mount teardown into a kernel crash instead of a normal mount
failure.
[FIX]
Replace the BUG_ON() with WARN_ON() and return -EIO. This keeps the
invariant warning for debugging, but restores the original behavior of
failing startup or shutdown cleanly instead of panicking the kernel.
Link: https://lore.kernel.org/20260512024115.4036371-1-gality369@gmail.com
Fixes: 10995aa2451a ("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.")
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/journal.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index b246e53271114d..e7e710bc3675b0 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1027,11 +1027,8 @@ static int ocfs2_journal_toggle_dirty(struct ocfs2_super *osb,
struct ocfs2_dinode *fe;
fe = (struct ocfs2_dinode *)bh->b_data;
-
- /* The journal bh on the osb always comes from ocfs2_journal_init()
- * and was validated there inside ocfs2_inode_lock_full(). It's a
- * code bug if we mess it up. */
- BUG_ON(!OCFS2_IS_VALID_DINODE(fe));
+ if (WARN_ON(!OCFS2_IS_VALID_DINODE(fe)))
+ return -EIO;
flags = le32_to_cpu(fe->id1.journal1.ij_flags);
if (dirty)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0457/1266] ocfs2: kill osb->system_file_mutex lock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0456/1266] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0458/1266] crypto: hisilicon/qm - disable error report before flr Greg Kroah-Hartman
` (541 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tetsuo Handa, Heming Zhao, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit f5b1910e23f1233c8d4185268b2e659df2bc5dbf ]
Commit 43b10a20372d ("ocfs2: avoid system inode ref confusion by adding
mutex lock") tried to avoid a refcount leak caused by allowing multiple
threads to call igrab(inode). But addition of osb->system_file_mutex made
locking dependency complicated and is causing lockdep to warn about
possibility of AB-BA deadlock.
Since _ocfs2_get_system_file_inode() returns the same inode for the same
input arguments, we don't need to serialize
_ocfs2_get_system_file_inode(). What we need to make sure is that
igrab(inode) is called for only once(). Therefore, replace
osb->system_file_mutex with cmpxchg()-based locking.
Link: https://lore.kernel.org/fea8d1fd-afb0-4302-a560-c202e2ef7afd@I-love.SAKURA.ne.jp
Fixes: 43b10a20372d ("ocfs2: avoid system inode ref confusion by adding mutex lock")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/ocfs2.h | 2 --
fs/ocfs2/super.c | 2 --
fs/ocfs2/sysfile.c | 9 +++------
3 files changed, 3 insertions(+), 10 deletions(-)
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 5e3ebbab698ad1..e8b8262026c8a1 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -494,8 +494,6 @@ struct ocfs2_super
struct rb_root osb_rf_lock_tree;
struct ocfs2_refcount_tree *osb_ref_tree_lru;
- struct mutex system_file_mutex;
-
/*
* OCFS2 needs to schedule several different types of work which
* require cluster locking, disk I/O, recovery waits, etc. Since these
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 18dba873a1633f..cc4bba65f15275 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2053,8 +2053,6 @@ static int ocfs2_initialize_super(struct super_block *sb,
spin_lock_init(&osb->osb_xattr_lock);
ocfs2_init_steal_slots(osb);
- mutex_init(&osb->system_file_mutex);
-
atomic_set(&osb->alloc_stats.moves, 0);
atomic_set(&osb->alloc_stats.local_data, 0);
atomic_set(&osb->alloc_stats.bitmap_data, 0);
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index 53a945da873bc0..b63af8d64904a2 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -98,11 +98,9 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
} else
arr = get_local_system_inode(osb, type, slot);
- mutex_lock(&osb->system_file_mutex);
if (arr && ((inode = *arr) != NULL)) {
/* get a ref in addition to the array ref */
inode = igrab(inode);
- mutex_unlock(&osb->system_file_mutex);
BUG_ON(!inode);
return inode;
@@ -112,11 +110,10 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
inode = _ocfs2_get_system_file_inode(osb, type, slot);
/* add one more if putting into array for first time */
- if (arr && inode) {
- *arr = igrab(inode);
- BUG_ON(!*arr);
+ if (inode && arr && !*arr && !cmpxchg(&(*arr), NULL, inode)) {
+ inode = igrab(inode);
+ BUG_ON(!inode);
}
- mutex_unlock(&osb->system_file_mutex);
return inode;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0458/1266] crypto: hisilicon/qm - disable error report before flr
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0457/1266] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0459/1266] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
` (540 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weili Qian, Zongyu Wu, Herbert Xu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weili Qian <qianweili@huawei.com>
[ Upstream commit e71dc5602b9a29027f6aedd5990d3e8c4f638c8c ]
Before function level reset, driver first disable device error report
and then waits for the device reset to complete. However, when the
error is recovered, the error bits will be enabled again, resulting in
invalid disable. It is modified to detect that there is no error
before disable error report, and then do FLR.
Fixes: 7ce396fa12a9 ("crypto: hisilicon - add FLR support")
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Zongyu Wu <wuzongyu1@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/qm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index e09357fea057ca..c7f87457038349 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4568,8 +4568,6 @@ void hisi_qm_reset_prepare(struct pci_dev *pdev)
u32 delay = 0;
int ret;
- hisi_qm_dev_err_uninit(pf_qm);
-
/*
* Check whether there is an ECC mbit error, If it occurs, need to
* wait for soft reset to fix it.
@@ -4586,6 +4584,8 @@ void hisi_qm_reset_prepare(struct pci_dev *pdev)
return;
}
+ hisi_qm_dev_err_uninit(pf_qm);
+
/* PF obtains the information of VF by querying the register. */
if (qm->fun_type == QM_HW_PF)
qm_cmd_uninit(qm);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0459/1266] drm/msm/dp: fix HPD state status bit shift value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0458/1266] crypto: hisilicon/qm - disable error report before flr Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0460/1266] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
` (539 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jessica Zhang, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin, Val Packett, Yongxing Mou
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
[ Upstream commit 2e6c2e81d81251623c458a60e2a57447dcbc988e ]
The HPD state status is the 3 most significant bits, not 4 bits of the
HPD_INT_STATUS register.
Fix the bit shift macro so that the correct bits are returned in
msm_dp_aux_is_link_connected().
Fixes: 19e52bcb27c2 ("drm/msm/dp: return correct connection status after suspend")
Signed-off-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Val Packett <val@packett.cool> # x1e80100-dell-latitude-7455
Tested-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> # Hamoa IOT EVK, QCS8300 Ride
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/727611/
Link: https://lore.kernel.org/r/20260524-hpd-refactor-v6-1-cf3ab488dd7b@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_reg.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index 78785ed4b40c49..df9df1250a7e5d 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -46,8 +46,8 @@
#define DP_DP_IRQ_HPD_INT_ACK (0x00000002)
#define DP_DP_HPD_REPLUG_INT_ACK (0x00000004)
#define DP_DP_HPD_UNPLUG_INT_ACK (0x00000008)
-#define DP_DP_HPD_STATE_STATUS_BITS_MASK (0x0000000F)
-#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT (0x1C)
+#define DP_DP_HPD_STATE_STATUS_BITS_MASK (0x00000007)
+#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT (0x1D)
#define REG_DP_DP_HPD_INT_MASK (0x0000000C)
#define DP_DP_HPD_PLUG_INT_MASK (0x00000001)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0460/1266] drm/msm/dp: Fix the ISR_* enum values
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0459/1266] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0461/1266] EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info Greg Kroah-Hartman
` (538 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jessica Zhang, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin, Val Packett, Yongxing Mou
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
[ Upstream commit 3fbfdc3b1d48cc115a86953e5df0c76cd2efc42b ]
The ISR_HPD_* enum should represent values that can be read from the
REG_DP_DP_HPD_INT_STATUS register. Swap ISR_HPD_IO_GLITCH_COUNT and
ISR_HPD_REPLUG_COUNT to map them correctly to register values.
While we are at it, correct the spelling for ISR_HPD_REPLUG_COUNT.
Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")
Signed-off-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Val Packett <val@packett.cool> # x1e80100-dell-latitude-7455
Tested-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> # Hamoa IOT EVK, QCS8300 Ride
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/727602/
Link: https://lore.kernel.org/r/20260524-hpd-refactor-v6-2-cf3ab488dd7b@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_display.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index ed77c957eceba3..9c8f6a0458c8a7 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -37,9 +37,9 @@ enum {
ISR_DISCONNECTED,
ISR_CONNECT_PENDING,
ISR_CONNECTED,
- ISR_HPD_REPLUG_COUNT,
+ ISR_HPD_IO_GLITCH_COUNT,
ISR_IRQ_HPD_PULSE_COUNT,
- ISR_HPD_LO_GLITH_COUNT,
+ ISR_HPD_REPLUG_COUNT,
};
/* event thread connection state */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0461/1266] EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0460/1266] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0462/1266] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Greg Kroah-Hartman
` (537 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, zhoumin, Tony Luck, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhoumin <teczm@foxmail.com>
[ Upstream commit c63ed6e1f5fe648a4a099b6717f679999be482ef ]
When the skx_get_dimm_attr() helper returns -EINVAL,
skx_get_dimm_info() does not validate these return values before using
them in a shift operation:
size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
If all three values are -22, the shift exponent becomes -66, triggering
a UBSAN shift-out-of-bounds error:
UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c
shift exponent -66 is negative
Fixes: 88a242c98740 ("EDAC, skx_common: Separate common code out from skx_edac")
Signed-off-by: zhoumin <teczm@foxmail.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://patch.msgid.link/tencent_2A0CC835A18366643CBD2865B169948AB409@qq.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/skx_common.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c
index 9e43aed72bd9fa..6b492ac8ba48ba 100644
--- a/drivers/edac/skx_common.c
+++ b/drivers/edac/skx_common.c
@@ -417,6 +417,9 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm,
rows = numrow(mtr);
cols = imc->hbm_mc ? 6 : numcol(mtr);
+ if (ranks < 0 || rows < 0 || cols < 0)
+ return 0;
+
if (imc->hbm_mc) {
banks = 32;
mtype = MEM_HBM2;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0462/1266] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0461/1266] EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info Greg Kroah-Hartman
@ 2026-07-21 15:14 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0463/1266] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path Greg Kroah-Hartman
` (536 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Zhu Yanjun,
Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristmd@gmail.com>
[ Upstream commit 22b8fbded65b8c441b634a185f8da67657df6c50 ]
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.
Read num_sge into a local variable and use it for both the bounds
check and the size calculation.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-2-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_resp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 70e9bf3a704225..c7bdc3d22053eb 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -273,6 +273,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
struct rxe_recv_wqe *wqe;
struct ib_event ev;
unsigned int count;
+ unsigned int num_sge;
size_t size;
unsigned long flags;
@@ -288,12 +289,13 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
}
/* don't trust user space data */
- if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) {
+ num_sge = wqe->dma.num_sge;
+ if (unlikely(num_sge > srq->rq.max_sge)) {
spin_unlock_irqrestore(&srq->rq.consumer_lock, flags);
rxe_dbg_qp(qp, "invalid num_sge in SRQ entry\n");
return RESPST_ERR_MALFORMED_WQE;
}
- size = sizeof(*wqe) + wqe->dma.num_sge*sizeof(struct rxe_sge);
+ size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge);
memcpy(&qp->resp.srq_wqe, wqe, size);
qp->resp.wqe = &qp->resp.srq_wqe.wqe;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0463/1266] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-07-21 15:14 ` [PATCH 6.6 0462/1266] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0464/1266] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
` (535 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Zhu Yanjun,
Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristmd@gmail.com>
[ Upstream commit d6ab440240a04b8737ee4c7bb21af9182e451733 ]
For non-SRQ QPs, the responder reads WQE fields directly from the
shared queue buffer mapped into userspace. This allows a malicious
user to modify fields like num_sge or sge entries while the kernel
is processing the WQE, leading to out-of-bounds reads in
rxe_resp_check_length() and copy_data().
Introduce get_recv_wqe() that validates num_sge and copies the WQE
to a kernel-local buffer before processing, matching the approach
already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is
reused since SRQ and non-SRQ paths are mutually exclusive per QP.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_resp.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index c7bdc3d22053eb..539a30ec98219a 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -319,6 +319,29 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
return RESPST_CHK_LENGTH;
}
+static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp)
+{
+ struct rxe_queue *q = qp->rq.queue;
+ struct rxe_recv_wqe *wqe;
+ unsigned int num_sge;
+ size_t size;
+
+ wqe = queue_head(q, QUEUE_TYPE_FROM_CLIENT);
+ if (!wqe)
+ return RESPST_ERR_RNR;
+
+ num_sge = wqe->dma.num_sge;
+ if (unlikely(num_sge > qp->rq.max_sge)) {
+ rxe_dbg_qp(qp, "invalid num_sge in recv WQE\n");
+ return RESPST_ERR_MALFORMED_WQE;
+ }
+ size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge);
+ memcpy(&qp->resp.srq_wqe, wqe, size);
+
+ qp->resp.wqe = &qp->resp.srq_wqe.wqe;
+ return RESPST_CHK_LENGTH;
+}
+
static enum resp_states check_resource(struct rxe_qp *qp,
struct rxe_pkt_info *pkt)
{
@@ -339,9 +362,7 @@ static enum resp_states check_resource(struct rxe_qp *qp,
if (srq)
return get_srq_wqe(qp);
- qp->resp.wqe = queue_head(qp->rq.queue,
- QUEUE_TYPE_FROM_CLIENT);
- return (qp->resp.wqe) ? RESPST_CHK_LENGTH : RESPST_ERR_RNR;
+ return rxe_get_recv_wqe(qp);
}
return RESPST_CHK_LENGTH;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0464/1266] media: qcom: venus: drop extra padding in NV12 raw size calculation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0463/1266] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0465/1266] media: qcom: venus: relax encoder frame/blur dimension steps on v4 Greg Kroah-Hartman
` (534 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Renjiang Han, Dikshita Agarwal,
Bryan ODonoghue, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renjiang Han <renjiang.han@oss.qualcomm.com>
[ Upstream commit e1c9adabb268cc5d56723b7df1da49e59070f309 ]
get_framesize_raw_nv12() currently adds SZ_4K to the UV plane size and an
additional SZ_8K to the total buffer size. This inflates the calculated
sizeimage and leads userspace to over-allocate buffers without a clear
requirement.
Remove the extra SZ_4K/SZ_8K padding and compute the NV12 size as the sum
of Y and UV planes, keeping the final ALIGN(size, SZ_4K) intact.
Fixes: e1cb72de702ad ("media: venus: helpers: move frame size calculations on common place")
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/helpers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
index 8295542e1a7c8c..d6984129c2f361 100644
--- a/drivers/media/platform/qcom/venus/helpers.c
+++ b/drivers/media/platform/qcom/venus/helpers.c
@@ -954,8 +954,8 @@ static u32 get_framesize_raw_nv12(u32 width, u32 height)
uv_sclines = ALIGN(((height + 1) >> 1), 16);
y_plane = y_stride * y_sclines;
- uv_plane = uv_stride * uv_sclines + SZ_4K;
- size = y_plane + uv_plane + SZ_8K;
+ uv_plane = uv_stride * uv_sclines;
+ size = y_plane + uv_plane;
return ALIGN(size, SZ_4K);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0465/1266] media: qcom: venus: relax encoder frame/blur dimension steps on v4
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0464/1266] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0466/1266] media: qcom: venus: relax encoder frame/blur step size on v6 Greg Kroah-Hartman
` (533 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Renjiang Han, Dikshita Agarwal,
Bryan ODonoghue, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renjiang Han <renjiang.han@oss.qualcomm.com>
[ Upstream commit 35428ae3a6a40912f1f7b47bb6c65f1a63d0b8f8 ]
Encoder HFI capabilities on v4 advertise a 16-pixel step for frame and
blur dimensions. This is overly restrictive and can cause userspace caps
negotiation to fail even for valid resolutions.
Relax the advertised step size to 1 and keep alignment enforcement in
buffer layout and size calculations.
Fixes: 8b88cabef404e ("media: venus: hfi_plat_v4: Populate codecs and capabilities for v4")
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/qcom/venus/hfi_platform_v4.c | 20 +++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/hfi_platform_v4.c b/drivers/media/platform/qcom/venus/hfi_platform_v4.c
index e3f0a90a567b85..277322d1fa2751 100644
--- a/drivers/media/platform/qcom/venus/hfi_platform_v4.c
+++ b/drivers/media/platform/qcom/venus/hfi_platform_v4.c
@@ -135,8 +135,8 @@ static const struct hfi_plat_caps caps[] = {
.codec = HFI_VIDEO_CODEC_H264,
.domain = VIDC_SESSION_TYPE_ENC,
.cap_bufs_mode_dynamic = true,
- .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 16},
- .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 16},
+ .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 1},
+ .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 1},
.caps[2] = {HFI_CAPABILITY_MBS_PER_FRAME, 1, 36864, 1},
.caps[3] = {HFI_CAPABILITY_BITRATE, 1, 120000000, 1},
.caps[4] = {HFI_CAPABILITY_SCALE_X, 8192, 65536, 1},
@@ -172,8 +172,8 @@ static const struct hfi_plat_caps caps[] = {
.codec = HFI_VIDEO_CODEC_HEVC,
.domain = VIDC_SESSION_TYPE_ENC,
.cap_bufs_mode_dynamic = true,
- .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 16},
- .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 16},
+ .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 1},
+ .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 1},
.caps[2] = {HFI_CAPABILITY_MBS_PER_FRAME, 1, 36864, 1},
.caps[3] = {HFI_CAPABILITY_BITRATE, 1, 120000000, 1},
.caps[4] = {HFI_CAPABILITY_SCALE_X, 8192, 65536, 1},
@@ -194,8 +194,8 @@ static const struct hfi_plat_caps caps[] = {
.caps[19] = {HFI_CAPABILITY_RATE_CONTROL_MODES, 0x1000001, 0x1000005, 1},
.caps[20] = {HFI_CAPABILITY_COLOR_SPACE_CONVERSION, 0, 2, 1},
.caps[21] = {HFI_CAPABILITY_ROTATION, 1, 4, 90},
- .caps[22] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 16},
- .caps[23] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 16},
+ .caps[22] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 1},
+ .caps[23] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 1},
.num_caps = 24,
.pl[0] = {HFI_HEVC_PROFILE_MAIN, HFI_HEVC_LEVEL_6 | HFI_HEVC_TIER_HIGH0},
.pl[1] = {HFI_HEVC_PROFILE_MAIN10, HFI_HEVC_LEVEL_6 | HFI_HEVC_TIER_HIGH0},
@@ -209,8 +209,8 @@ static const struct hfi_plat_caps caps[] = {
.codec = HFI_VIDEO_CODEC_VP8,
.domain = VIDC_SESSION_TYPE_ENC,
.cap_bufs_mode_dynamic = true,
- .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 16},
- .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 16},
+ .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 96, 4096, 1},
+ .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 96, 4096, 1},
.caps[2] = {HFI_CAPABILITY_MBS_PER_FRAME, 1, 36864, 1},
.caps[3] = {HFI_CAPABILITY_BITRATE, 1, 120000000, 1},
.caps[4] = {HFI_CAPABILITY_SCALE_X, 8192, 65536, 1},
@@ -228,8 +228,8 @@ static const struct hfi_plat_caps caps[] = {
.caps[16] = {HFI_CAPABILITY_P_FRAME_QP, 0, 127, 1},
.caps[17] = {HFI_CAPABILITY_MAX_WORKMODES, 1, 2, 1},
.caps[18] = {HFI_CAPABILITY_RATE_CONTROL_MODES, 0x1000001, 0x1000005, 1},
- .caps[19] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 16},
- .caps[20] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 16},
+ .caps[19] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 1},
+ .caps[20] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 1},
.caps[21] = {HFI_CAPABILITY_COLOR_SPACE_CONVERSION, 0, 2, 1},
.caps[22] = {HFI_CAPABILITY_ROTATION, 1, 4, 90},
.num_caps = 23,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0466/1266] media: qcom: venus: relax encoder frame/blur step size on v6
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0465/1266] media: qcom: venus: relax encoder frame/blur dimension steps on v4 Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0467/1266] rpmsg: use generic driver_override infrastructure Greg Kroah-Hartman
` (532 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Renjiang Han, Dikshita Agarwal,
Bryan ODonoghue, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renjiang Han <renjiang.han@oss.qualcomm.com>
[ Upstream commit c53e0550288b2e08b984b24035c471941b7820c7 ]
Encoder HFI capabilities on v6 enforce a 16-pixel step for frame and blur
dimensions, which does not reflect actual hardware requirements and can
reject valid userspace configurations.
Relax the step size to 1 while leaving min/max limits unchanged.
Fixes: 869d77e706290 ("media: venus: hfi_plat_v6: Populate capabilities for v6")
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/qcom/venus/hfi_platform_v6.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/hfi_platform_v6.c b/drivers/media/platform/qcom/venus/hfi_platform_v6.c
index 4e8af645f8b95b..b5b769d735c1e7 100644
--- a/drivers/media/platform/qcom/venus/hfi_platform_v6.c
+++ b/drivers/media/platform/qcom/venus/hfi_platform_v6.c
@@ -172,8 +172,8 @@ static const struct hfi_plat_caps caps[] = {
.codec = HFI_VIDEO_CODEC_HEVC,
.domain = VIDC_SESSION_TYPE_ENC,
.cap_bufs_mode_dynamic = true,
- .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 128, 8192, 16},
- .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 128, 8192, 16},
+ .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 128, 8192, 1},
+ .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 128, 8192, 1},
.caps[2] = {HFI_CAPABILITY_MBS_PER_FRAME, 64, 138240, 1},
.caps[3] = {HFI_CAPABILITY_BITRATE, 1, 160000000, 1},
.caps[4] = {HFI_CAPABILITY_SCALE_X, 8192, 65536, 1},
@@ -194,8 +194,8 @@ static const struct hfi_plat_caps caps[] = {
.caps[19] = {HFI_CAPABILITY_RATE_CONTROL_MODES, 0x1000001, 0x1000005, 1},
.caps[20] = {HFI_CAPABILITY_COLOR_SPACE_CONVERSION, 0, 2, 1},
.caps[21] = {HFI_CAPABILITY_ROTATION, 1, 4, 90},
- .caps[22] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 16},
- .caps[23] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 16},
+ .caps[22] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 1},
+ .caps[23] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 1},
.num_caps = 24,
.pl[0] = {HFI_HEVC_PROFILE_MAIN, HFI_HEVC_LEVEL_6 | HFI_HEVC_TIER_HIGH0},
.pl[1] = {HFI_HEVC_PROFILE_MAIN10, HFI_HEVC_LEVEL_6 | HFI_HEVC_TIER_HIGH0},
@@ -209,8 +209,8 @@ static const struct hfi_plat_caps caps[] = {
.codec = HFI_VIDEO_CODEC_VP8,
.domain = VIDC_SESSION_TYPE_ENC,
.cap_bufs_mode_dynamic = true,
- .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 128, 4096, 16},
- .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 128, 4096, 16},
+ .caps[0] = {HFI_CAPABILITY_FRAME_WIDTH, 128, 4096, 1},
+ .caps[1] = {HFI_CAPABILITY_FRAME_HEIGHT, 128, 4096, 1},
.caps[2] = {HFI_CAPABILITY_MBS_PER_FRAME, 64, 36864, 1},
.caps[3] = {HFI_CAPABILITY_BITRATE, 1, 74000000, 1},
.caps[4] = {HFI_CAPABILITY_SCALE_X, 8192, 65536, 1},
@@ -228,8 +228,8 @@ static const struct hfi_plat_caps caps[] = {
.caps[16] = {HFI_CAPABILITY_P_FRAME_QP, 0, 127, 1},
.caps[17] = {HFI_CAPABILITY_MAX_WORKMODES, 1, 2, 1},
.caps[18] = {HFI_CAPABILITY_RATE_CONTROL_MODES, 0x1000001, 0x1000005, 1},
- .caps[19] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 16},
- .caps[20] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 16},
+ .caps[19] = {HFI_CAPABILITY_BLUR_WIDTH, 96, 4096, 1},
+ .caps[20] = {HFI_CAPABILITY_BLUR_HEIGHT, 96, 4096, 1},
.caps[21] = {HFI_CAPABILITY_COLOR_SPACE_CONVERSION, 0, 2, 1},
.caps[22] = {HFI_CAPABILITY_ROTATION, 1, 4, 90},
.num_caps = 23,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0467/1266] rpmsg: use generic driver_override infrastructure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0466/1266] media: qcom: venus: relax encoder frame/blur step size on v6 Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0468/1266] md/raid10: reset read_slot when reusing r10bio for discard Greg Kroah-Hartman
` (531 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Mathieu Poirier,
Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit 55ced13c42921714e90f8fae94b6ed803330dc6a ]
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes: e95060478244 ("rpmsg: Introduce a driver override mechanism")
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260505133935.3772495-5-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_glink_native.c | 2 --
drivers/rpmsg/rpmsg_core.c | 43 +++++--------------------------
drivers/rpmsg/virtio_rpmsg_bus.c | 1 -
include/linux/rpmsg.h | 4 ---
4 files changed, 7 insertions(+), 43 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index da2fe69ba20482..f5909e45489346 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1526,7 +1526,6 @@ static void qcom_glink_rpdev_release(struct device *dev)
{
struct rpmsg_device *rpdev = to_rpmsg_device(dev);
- kfree(rpdev->driver_override);
kfree(rpdev);
}
@@ -1770,7 +1769,6 @@ static void qcom_glink_device_release(struct device *dev)
/* Release qcom_glink_alloc_channel() reference */
kref_put(&channel->refcount, qcom_glink_channel_release);
- kfree(rpdev->driver_override);
kfree(rpdev);
}
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 662a674314045c..615d06af992902 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -419,33 +419,6 @@ rpmsg_show_attr(src, src, "0x%x\n");
rpmsg_show_attr(dst, dst, "0x%x\n");
rpmsg_show_attr(announce, announce ? "true" : "false", "%s\n");
-static ssize_t driver_override_store(struct device *dev,
- struct device_attribute *attr,
- const char *buf, size_t count)
-{
- struct rpmsg_device *rpdev = to_rpmsg_device(dev);
- int ret;
-
- ret = driver_set_override(dev, &rpdev->driver_override, buf, count);
- if (ret)
- return ret;
-
- return count;
-}
-
-static ssize_t driver_override_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- struct rpmsg_device *rpdev = to_rpmsg_device(dev);
- ssize_t len;
-
- device_lock(dev);
- len = sysfs_emit(buf, "%s\n", rpdev->driver_override);
- device_unlock(dev);
- return len;
-}
-static DEVICE_ATTR_RW(driver_override);
-
static ssize_t modalias_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -466,7 +439,6 @@ static struct attribute *rpmsg_dev_attrs[] = {
&dev_attr_dst.attr,
&dev_attr_src.attr,
&dev_attr_announce.attr,
- &dev_attr_driver_override.attr,
NULL,
};
ATTRIBUTE_GROUPS(rpmsg_dev);
@@ -485,9 +457,11 @@ static int rpmsg_dev_match(struct device *dev, struct device_driver *drv)
struct rpmsg_driver *rpdrv = to_rpmsg_driver(drv);
const struct rpmsg_device_id *ids = rpdrv->id_table;
unsigned int i;
+ int ret;
- if (rpdev->driver_override)
- return !strcmp(rpdev->driver_override, drv->name);
+ ret = device_match_driver_override(dev, drv);
+ if (ret >= 0)
+ return ret;
if (ids)
for (i = 0; ids[i].name[0]; i++)
@@ -597,6 +571,7 @@ static struct bus_type rpmsg_bus = {
.name = "rpmsg",
.match = rpmsg_dev_match,
.dev_groups = rpmsg_dev_groups,
+ .driver_override = true,
.uevent = rpmsg_uevent,
.probe = rpmsg_dev_probe,
.remove = rpmsg_dev_remove,
@@ -622,11 +597,9 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
device_initialize(dev);
if (driver_override) {
- ret = driver_set_override(dev, &rpdev->driver_override,
- driver_override,
- strlen(driver_override));
+ ret = device_set_driver_override(dev, driver_override);
if (ret) {
- dev_err(dev, "device_set_override failed: %d\n", ret);
+ dev_err(dev, "device_set_driver_override() failed: %d\n", ret);
put_device(dev);
return ret;
}
@@ -635,8 +608,6 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
ret = device_add(dev);
if (ret) {
dev_err(dev, "device_add failed: %d\n", ret);
- kfree(rpdev->driver_override);
- rpdev->driver_override = NULL;
put_device(dev);
}
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index f1af0f6746150e..905ac7910c98f3 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -378,7 +378,6 @@ static void virtio_rpmsg_release_device(struct device *dev)
struct rpmsg_device *rpdev = to_rpmsg_device(dev);
struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev);
- kfree(rpdev->driver_override);
kfree(vch);
}
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 90d8e4475f80ed..32819293670620 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -41,9 +41,6 @@ struct rpmsg_channel_info {
* rpmsg_device - device that belong to the rpmsg bus
* @dev: the device struct
* @id: device id (used to match between rpmsg drivers and devices)
- * @driver_override: driver name to force a match; do not set directly,
- * because core frees it; use driver_set_override() to
- * set or clear it.
* @src: local address
* @dst: destination address
* @ept: the rpmsg endpoint of this channel
@@ -53,7 +50,6 @@ struct rpmsg_channel_info {
struct rpmsg_device {
struct device dev;
struct rpmsg_device_id id;
- const char *driver_override;
u32 src;
u32 dst;
struct rpmsg_endpoint *ept;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0468/1266] md/raid10: reset read_slot when reusing r10bio for discard
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0467/1266] rpmsg: use generic driver_override infrastructure Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0469/1266] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
` (530 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Cheng, Xiao Ni, Yu Kuai,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <chencheng@fnnas.com>
[ Upstream commit 6b8a26af065ddc93de2aa5c9f0df98dce9723442 ]
put_all_bios() always drops devs[i].bio, but it only drops
devs[i].repl_bio when r10_bio->read_slot < 0. If discard reuses an
r10bio that was previously used for a read, read_slot can still be
non-negative, and discard cleanup can skip bio_put() on repl_bio.
Reset read_slot to -1 when preparing an r10bio for discard so the
replacement bio is always released correctly.
Fixes: d30588b2731f ("md/raid10: improve raid10 discard request")
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Reviewed-by: Xiao Ni <xiao@kernel.org>
Link: https://patch.msgid.link/20260515093019.3436882-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid10.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index fd03c01bcf2571..ca9ae89c6d1dc2 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1744,6 +1744,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
r10_bio->mddev = mddev;
r10_bio->state = 0;
r10_bio->sectors = 0;
+ r10_bio->read_slot = -1;
memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * geo->raid_disks);
wait_blocked_dev(mddev, r10_bio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0469/1266] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0468/1266] md/raid10: reset read_slot when reusing r10bio for discard Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0470/1266] ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble Greg Kroah-Hartman
` (529 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Baokun Li, Jan Kara,
Theodore Tso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit d99748ef1695ce17eaf51c64b7a06952fa7cddab ]
In EXT4_GOING_FLAGS_LOGFLUSH mode, the EXT4_FLAGS_SHUTDOWN flag was set
before calling ext4_force_commit(). This caused ordered-mode data
writeback (triggered by journal commit) to fail with -EIO, since
ext4_do_writepages() checks for the shutdown flag. The journal would
then be aborted prematurely before the commit could succeed.
Fix this by calling ext4_force_commit() first, then setting the
shutdown flag, so that pending data can be written back correctly.
Note that moving ext4_force_commit() before setting the shutdown flag
creates a small window in which new writes may occur and generate new
journal transactions. When the journal is subsequently aborted, the
new transactions will not be able to write to disk. This is intentional
because LOGFLUSH's semantics are to flush pre-existing journal entries
before shutdown, not to guarantee atomicity for writes that race with
the ioctl.
Fixes: 783d94854499 ("ext4: add EXT4_IOC_GOINGDOWN ioctl")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260424104201.1930823-1-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index d34affd2075eb4..e27eae7f163dfd 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -826,11 +826,17 @@ int ext4_force_shutdown(struct super_block *sb, u32 flags)
thaw_bdev(sb->s_bdev);
break;
case EXT4_GOING_FLAGS_LOGFLUSH:
+ /*
+ * Call ext4_force_commit() before setting EXT4_FLAGS_SHUTDOWN.
+ * This is because in data=ordered mode, journal commit
+ * triggers data writeback which fails if shutdown is already
+ * set, causing the journal to be aborted prematurely before
+ * the commit succeeds.
+ */
+ (void) ext4_force_commit(sb);
set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
- if (sbi->s_journal && !is_journal_aborted(sbi->s_journal)) {
- (void) ext4_force_commit(sb);
+ if (sbi->s_journal && !is_journal_aborted(sbi->s_journal))
jbd2_journal_abort(sbi->s_journal, -ESHUTDOWN);
- }
break;
case EXT4_GOING_FLAGS_NOLOGFLUSH:
set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0470/1266] ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0469/1266] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0471/1266] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
` (528 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Madieu, Kuninori Morimoto,
Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Madieu <john.madieu.xa@bp.renesas.com>
[ Upstream commit c0758279367e9d82eb7d7b4959718d7d32e96b7d ]
RSND_SOC_MASK was defined as (0xFF << 4), spanning bits 4-11. This is
wider than needed since only nibble B (bits 7:4) is used for SoC
identifiers. Narrow it to (0xF << 4) to match the intended single-nibble
allocation and prevent overlap with bits 8-11 which will be used by
upcoming RZ series flags.
No functional change, since the only current user (RSND_SOC_E) fits
within a single nibble.
Fixes: ba164a49f8f7 ("ASoC: rsnd: src: Avoid a potential deadlock")
Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260525110230.4014435-3-john.madieu.xa@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sh/rcar/rsnd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 1214dbba6898b1..923436ee6f7e0d 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -637,7 +637,7 @@ struct rsnd_priv {
#define RSND_GEN2 (2 << 0)
#define RSND_GEN3 (3 << 0)
#define RSND_GEN4 (4 << 0)
-#define RSND_SOC_MASK (0xFF << 4)
+#define RSND_SOC_MASK (0xF << 4)
#define RSND_SOC_E (1 << 4) /* E1/E2/E3 */
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0471/1266] ARM: imx3: Fix CCM node reference leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0470/1266] ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0472/1266] HID: wiimote: Fix table layout and whitespace errors Greg Kroah-Hartman
` (527 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Frank Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 36d46348eb5fc4bc505cd2290ddd70c25fbe6bb3 ]
of_find_compatible_node() returns a referenced device node. The i.MX31
and i.MX35 early init paths use the node to map the CCM registers with
of_iomap(), but never drop the node reference.
Release the node after the mapping is created.
Fixes: 2cf98d12958c ("ARM: imx3: Retrieve the CCM base address from devicetree")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/mm-imx3.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c
index 0788c5cc7f9e64..9b0b014d7fe276 100644
--- a/arch/arm/mach-imx/mm-imx3.c
+++ b/arch/arm/mach-imx/mm-imx3.c
@@ -106,6 +106,7 @@ void __init imx31_init_early(void)
arm_pm_idle = imx31_idle;
np = of_find_compatible_node(NULL, NULL, "fsl,imx31-ccm");
mx3_ccm_base = of_iomap(np, 0);
+ of_node_put(np);
BUG_ON(!mx3_ccm_base);
}
#endif /* ifdef CONFIG_SOC_IMX31 */
@@ -143,6 +144,7 @@ void __init imx35_init_early(void)
arch_ioremap_caller = imx3_ioremap_caller;
np = of_find_compatible_node(NULL, NULL, "fsl,imx35-ccm");
mx3_ccm_base = of_iomap(np, 0);
+ of_node_put(np);
BUG_ON(!mx3_ccm_base);
}
#endif /* ifdef CONFIG_SOC_IMX35 */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0472/1266] HID: wiimote: Fix table layout and whitespace errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0471/1266] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0473/1266] ata: libata: Fix ata_exec_internal() Greg Kroah-Hartman
` (526 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Rheinsberg,
J . Neuschäfer, Benjamin Tissoires, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Neuschäfer <j.ne@posteo.net>
[ Upstream commit 12b7731995ca577d86e02196e99ba9c126f47282 ]
Some tab characters snuck into the data layout table for turntable
extensions, which resulted in the table only looking right at a tabstop
of 4, which is uncommon in the kernel. Change them to the equivalent
amount of spaces, which should look correct in any editor.
While at it, also fix the other whitespace errors (trailing spaces at
end of line) introduced in the same commit.
Fixes: 05086f3db530b3 ("HID: wiimote: Add support for the DJ Hero turntable")
Reviewed-by: David Rheinsberg <david@readahead.eu>
Signed-off-by: J. Neuschäfer <j.ne@posteo.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-wiimote-modules.c | 58 +++++++++++++++----------------
1 file changed, 29 insertions(+), 29 deletions(-)
diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
index dbccdfa6391672..dccb78bb3afd61 100644
--- a/drivers/hid/hid-wiimote-modules.c
+++ b/drivers/hid/hid-wiimote-modules.c
@@ -2403,7 +2403,7 @@ static const struct wiimod_ops wiimod_guitar = {
.in_ext = wiimod_guitar_in_ext,
};
-/*
+/*
* Turntable
* DJ Hero came with a Turntable Controller that was plugged in
* as an extension.
@@ -2439,15 +2439,15 @@ static const __u16 wiimod_turntable_map[] = {
static void wiimod_turntable_in_ext(struct wiimote_data *wdata, const __u8 *ext)
{
__u8 be, cs, sx, sy, ed, rtt, rbg, rbr, rbb, ltt, lbg, lbr, lbb, bp, bm;
- /*
+ /*
* Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
*------+------+-----+-----+-----+-----+------+------+--------+
- * 0 | RTT<4:3> | SX <5:0> |
- * 1 | RTT<2:1> | SY <5:0> |
+ * 0 | RTT<4:3> | SX <5:0> |
+ * 1 | RTT<2:1> | SY <5:0> |
*------+------+-----+-----+-----+-----+------+------+--------+
* 2 |RTT<0>| ED<4:3> | CS<3:0> | RTT<5> |
*------+------+-----+-----+-----+-----+------+------+--------+
- * 3 | ED<2:0> | LTT<4:0> |
+ * 3 | ED<2:0> | LTT<4:0> |
*------+------+-----+-----+-----+-----+------+------+--------+
* 4 | 0 | 0 | LBR | B- | 0 | B+ | RBR | LTT<5> |
*------+------+-----+-----+-----+-----+------+------+--------+
@@ -2458,20 +2458,20 @@ static void wiimod_turntable_in_ext(struct wiimote_data *wdata, const __u8 *ext)
* With Motion+ enabled, it will look like this:
* Byte | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
*------+------+-----+-----+-----+-----+------+------+--------+
- * 1 | RTT<4:3> | SX <5:1> | 0 |
- * 2 | RTT<2:1> | SY <5:1> | 0 |
+ * 1 | RTT<4:3> | SX <5:1> | 0 |
+ * 2 | RTT<2:1> | SY <5:1> | 0 |
*------+------+-----+-----+-----+-----+------+------+--------+
* 3 |RTT<0>| ED<4:3> | CS<3:0> | RTT<5> |
*------+------+-----+-----+-----+-----+------+------+--------+
- * 4 | ED<2:0> | LTT<4:0> |
+ * 4 | ED<2:0> | LTT<4:0> |
*------+------+-----+-----+-----+-----+------+------+--------+
* 5 | 0 | 0 | LBR | B- | 0 | B+ | RBR | XXXX |
*------+------+-----+-----+-----+-----+------+------+--------+
* 6 | LBB | 0 | RBG | BE | LBG | RBB | XXXX | XXXX |
*------+------+-----+-----+-----+-----+------+------+--------+
*/
-
- be = !(ext[5] & 0x10);
+
+ be = !(ext[5] & 0x10);
cs = ((ext[2] & 0x1e));
sx = ext[0] & 0x3f;
sy = ext[1] & 0x3f;
@@ -2499,32 +2499,32 @@ static void wiimod_turntable_in_ext(struct wiimote_data *wdata, const __u8 *ext)
input_report_abs(wdata->extension.input, ABS_HAT1X, ltt);
input_report_abs(wdata->extension.input, ABS_HAT2X, cs);
input_report_abs(wdata->extension.input, ABS_HAT3X, ed);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_G_RIGHT],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_G_RIGHT],
rbg);
input_report_key(wdata->extension.input,
wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_R_RIGHT],
rbr);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_B_RIGHT],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_B_RIGHT],
rbb);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_G_LEFT],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_G_LEFT],
lbg);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_R_LEFT],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_R_LEFT],
lbr);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_B_LEFT],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_B_LEFT],
lbb);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_EUPHORIA],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_EUPHORIA],
be);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_PLUS],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_PLUS],
bp);
- input_report_key(wdata->extension.input,
- wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_MINUS],
+ input_report_key(wdata->extension.input,
+ wiimod_turntable_map[WIIMOD_TURNTABLE_KEY_MINUS],
bm);
input_sync(wdata->extension.input);
@@ -2557,7 +2557,7 @@ static void wiimod_turntable_close(struct input_dev *dev)
static int wiimod_turntable_probe(const struct wiimod_ops *ops,
struct wiimote_data *wdata)
{
- int ret, i;
+ int ret, i;
wdata->extension.input = input_allocate_device();
if (!wdata->extension.input)
@@ -2594,9 +2594,9 @@ static int wiimod_turntable_probe(const struct wiimod_ops *ops,
input_set_abs_params(wdata->extension.input,
ABS_HAT1X, -8, 8, 0, 0);
input_set_abs_params(wdata->extension.input,
- ABS_HAT2X, 0, 31, 1, 1);
+ ABS_HAT2X, 0, 31, 1, 1);
input_set_abs_params(wdata->extension.input,
- ABS_HAT3X, 0, 7, 0, 0);
+ ABS_HAT3X, 0, 7, 0, 0);
ret = input_register_device(wdata->extension.input);
if (ret)
goto err_free;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0473/1266] ata: libata: Fix ata_exec_internal()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0472/1266] HID: wiimote: Fix table layout and whitespace errors Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0474/1266] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
` (525 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Niklas Cassel,
Damien Le Moal, Hannes Reinecke, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit aa0ae1c35f7b3e9afed2324bed5f5c87ad55b92c ]
Some but not all ata_exec_internal() calls happen from the context of
the ATA error handler. Commit c0c362b60e25 ("libata: implement cross-port
EH exclusion") added ata_eh_release() and ata_eh_acquire() calls in
ata_exec_internal(). Calling these functions is necessary if the caller
holds the eh_mutex but is not allowed if the caller doesn't hold that
mutex. Fix this by only calling ata_eh_release() and ata_eh_acquire() if
the caller holds the eh_mutex. An example of an indirect caller of
ata_exec_internal() that does not hold the eh_mutex is
ata_host_register().
Fixes: c0c362b60e25 ("libata: implement cross-port EH exclusion")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 91c6291b01f4e0..07dd04b8d01d16 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1508,6 +1508,7 @@ static unsigned ata_exec_internal_sg(struct ata_device *dev,
{
struct ata_link *link = dev->link;
struct ata_port *ap = link->ap;
+ const bool owns_eh_mutex = ap->host->eh_owner == current;
u8 command = tf->command;
int auto_timeout = 0;
struct ata_queued_cmd *qc;
@@ -1586,11 +1587,25 @@ static unsigned ata_exec_internal_sg(struct ata_device *dev,
}
}
- ata_eh_release(ap);
+ if (owns_eh_mutex) {
+ /*
+ * To prevent that the compiler complains about the
+ * ata_eh_release() call below.
+ */
+ __acquire(&ap->host->eh_mutex);
+ ata_eh_release(ap);
+ }
rc = wait_for_completion_timeout(&wait, msecs_to_jiffies(timeout));
- ata_eh_acquire(ap);
+ if (owns_eh_mutex) {
+ ata_eh_acquire(ap);
+ /*
+ * To prevent that the compiler complains about the above
+ * ata_eh_acquire() call.
+ */
+ __release(&ap->host->eh_mutex);
+ }
ata_sff_flush_pio_task(ap);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0474/1266] ARM: imx31: Fix IIM mapping leak in revision check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0473/1266] ata: libata: Fix ata_exec_internal() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0475/1266] nvdimm/btt: Handle preemption in BTT lane acquisition Greg Kroah-Hartman
` (524 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Frank Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit ccb4b54b8ecf1ebafef96d538cd6c5c8455bb390 ]
mx31_read_cpu_rev() maps the IIM registers with of_iomap() to read the
silicon revision, but returns without unmapping the MMIO mapping.
Keep the normalized revision value in a local variable and route the
return path through iounmap() after the revision register has been read.
Fixes: 3172225d45bd ("ARM: imx31: Retrieve the IIM base address from devicetree")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/cpu-imx31.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-imx/cpu-imx31.c b/arch/arm/mach-imx/cpu-imx31.c
index 35c544924e5095..e81ef9e36a1fab 100644
--- a/arch/arm/mach-imx/cpu-imx31.c
+++ b/arch/arm/mach-imx/cpu-imx31.c
@@ -36,6 +36,7 @@ static int mx31_read_cpu_rev(void)
void __iomem *iim_base;
struct device_node *np;
u32 i, srev;
+ int rev = IMX_CHIP_REVISION_UNKNOWN;
np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim");
iim_base = of_iomap(np, 0);
@@ -48,13 +49,17 @@ static int mx31_read_cpu_rev(void)
for (i = 0; i < ARRAY_SIZE(mx31_cpu_type); i++)
if (srev == mx31_cpu_type[i].srev) {
+ rev = mx31_cpu_type[i].rev;
imx_print_silicon_rev(mx31_cpu_type[i].name,
mx31_cpu_type[i].rev);
- return mx31_cpu_type[i].rev;
+ goto out;
}
imx_print_silicon_rev("i.MX31", IMX_CHIP_REVISION_UNKNOWN);
- return IMX_CHIP_REVISION_UNKNOWN;
+
+out:
+ iounmap(iim_base);
+ return rev;
}
int mx31_revision(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0475/1266] nvdimm/btt: Handle preemption in BTT lane acquisition
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0474/1266] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0476/1266] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
` (523 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan, Vishal Verma,
Dave Jiang, Alison Schofield, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <alison.schofield@intel.com>
[ Upstream commit 8d4b989d9c9afe5f185aa5853b666fc4617afe9e ]
BTT lanes serialize access to per-lane metadata and workspace state
during BTT I/O. The btt-check unit test reports data mismatches during
BTT writes due to a race in lane acquisition that can lead to silent
data corruption.
The existing lane model uses a spinlock together with a per-CPU
recursion count. That recursion model stopped being valid after BTT
lanes became preemptible: another task can run on the same CPU,
observe a non-zero recursion count, bypass locking, and use the same
lane concurrently.
BTT lanes are also held across arena_write_bytes() calls. That path
reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush().
Some provider flush callbacks can sleep, making a spinlock the wrong
primitive for the lane lifetime.
Replace the spinlock-based recursion model with a dynamically
allocated per-lane mutex array and take the lane lock
unconditionally.
Add might_sleep() to catch any future atomic-context caller.
Found with the ndctl unit test btt-check.sh.
Fixes: 36c75ce3bd29 ("nd_btt: Make BTT lanes preemptible")
Assisted-by: Claude-Sonnet:4.5
Tested-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reviewed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260528021625.618462-1-alison.schofield@intel.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/driver-api/nvdimm/btt.rst | 5 +-
drivers/nvdimm/nd.h | 11 ++---
drivers/nvdimm/region_devs.c | 66 +++++++++----------------
3 files changed, 29 insertions(+), 53 deletions(-)
diff --git a/Documentation/driver-api/nvdimm/btt.rst b/Documentation/driver-api/nvdimm/btt.rst
index 107395c042ae07..cb1afe9dc3cbb9 100644
--- a/Documentation/driver-api/nvdimm/btt.rst
+++ b/Documentation/driver-api/nvdimm/btt.rst
@@ -161,9 +161,8 @@ process::
nlanes = min(nfree, num_cpus)
A lane number is obtained at the start of any IO, and is used for indexing into
-all the on-disk and in-memory data structures for the duration of the IO. If
-there are more CPUs than the max number of available lanes, than lanes are
-protected by spinlocks.
+all the on-disk and in-memory data structures for the duration of the IO. Lanes
+are protected by mutexes.
d. In-memory data structure: Read Tracking Table (RTT)
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index 12774334273c10..9b0bd875171576 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -365,11 +365,6 @@ unsigned sizeof_namespace_label(struct nvdimm_drvdata *ndd);
for (res = (ndd)->dpa.child, next = res ? res->sibling : NULL; \
res; res = next, next = next ? next->sibling : NULL)
-struct nd_percpu_lane {
- int count;
- spinlock_t lock;
-};
-
enum nd_label_flags {
ND_LABEL_REAP,
};
@@ -400,6 +395,10 @@ struct nd_mapping {
struct nvdimm_drvdata *ndd;
};
+struct nd_lane {
+ struct mutex lock; /* serialize lane access */
+} ____cacheline_aligned_in_smp;
+
struct nd_region {
struct device dev;
struct ida ns_ida;
@@ -420,7 +419,7 @@ struct nd_region {
struct kernfs_node *bb_state;
struct badblocks bb;
struct nd_interleave_set *nd_set;
- struct nd_percpu_lane __percpu *lane;
+ struct nd_lane *lane;
int (*flush)(struct nd_region *nd_region, struct bio *bio);
struct nd_mapping mapping[];
};
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index e2f1fb99707fc4..c13264c7b0deb7 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -179,7 +179,9 @@ static void nd_region_release(struct device *dev)
put_device(&nvdimm->dev);
}
- free_percpu(nd_region->lane);
+ for (i = 0; i < nd_region->num_lanes; i++)
+ mutex_destroy(&nd_region->lane[i].lock);
+ kfree(nd_region->lane);
if (!test_bit(ND_REGION_CXL, &nd_region->flags))
memregion_free(nd_region->id);
kfree(nd_region);
@@ -922,52 +924,30 @@ void nd_region_advance_seeds(struct nd_region *nd_region, struct device *dev)
* nd_region_acquire_lane - allocate and lock a lane
* @nd_region: region id and number of lanes possible
*
- * A lane correlates to a BLK-data-window and/or a log slot in the BTT.
- * We optimize for the common case where there are 256 lanes, one
- * per-cpu. For larger systems we need to lock to share lanes. For now
- * this implementation assumes the cost of maintaining an allocator for
- * free lanes is on the order of the lock hold time, so it implements a
- * static lane = cpu % num_lanes mapping.
+ * A lane correlates to a log slot in the BTT. Lanes are shared across
+ * CPUs using a static lane = cpu % num_lanes mapping, with a per-lane
+ * mutex to serialize access.
*
- * In the case of a BTT instance on top of a BLK namespace a lane may be
- * acquired recursively. We lock on the first instance.
- *
- * In the case of a BTT instance on top of PMEM, we only acquire a lane
- * for the BTT metadata updates.
+ * Callers must be in sleepable context. The only in-tree caller is
+ * BTT's ->submit_bio handler (btt_read_pg / btt_write_pg).
*/
unsigned int nd_region_acquire_lane(struct nd_region *nd_region)
+ __acquires(&nd_region->lane[lane].lock)
{
- unsigned int cpu, lane;
-
- migrate_disable();
- cpu = smp_processor_id();
- if (nd_region->num_lanes < nr_cpu_ids) {
- struct nd_percpu_lane *ndl_lock, *ndl_count;
+ unsigned int lane;
- lane = cpu % nd_region->num_lanes;
- ndl_count = per_cpu_ptr(nd_region->lane, cpu);
- ndl_lock = per_cpu_ptr(nd_region->lane, lane);
- if (ndl_count->count++ == 0)
- spin_lock(&ndl_lock->lock);
- } else
- lane = cpu;
+ might_sleep();
+ lane = raw_smp_processor_id() % nd_region->num_lanes;
+ mutex_lock(&nd_region->lane[lane].lock);
return lane;
}
EXPORT_SYMBOL(nd_region_acquire_lane);
void nd_region_release_lane(struct nd_region *nd_region, unsigned int lane)
+ __releases(&nd_region->lane[lane].lock)
{
- if (nd_region->num_lanes < nr_cpu_ids) {
- unsigned int cpu = smp_processor_id();
- struct nd_percpu_lane *ndl_lock, *ndl_count;
-
- ndl_count = per_cpu_ptr(nd_region->lane, cpu);
- ndl_lock = per_cpu_ptr(nd_region->lane, lane);
- if (--ndl_count->count == 0)
- spin_unlock(&ndl_lock->lock);
- }
- migrate_enable();
+ mutex_unlock(&nd_region->lane[lane].lock);
}
EXPORT_SYMBOL(nd_region_release_lane);
@@ -1037,17 +1017,16 @@ static struct nd_region *nd_region_create(struct nvdimm_bus *nvdimm_bus,
goto err_id;
}
- nd_region->lane = alloc_percpu(struct nd_percpu_lane);
+ nd_region->num_lanes = ndr_desc->num_lanes;
+ if (!nd_region->num_lanes)
+ goto err_percpu;
+ nd_region->lane = kcalloc(nd_region->num_lanes,
+ sizeof(*nd_region->lane), GFP_KERNEL);
if (!nd_region->lane)
goto err_percpu;
- for (i = 0; i < nr_cpu_ids; i++) {
- struct nd_percpu_lane *ndl;
-
- ndl = per_cpu_ptr(nd_region->lane, i);
- spin_lock_init(&ndl->lock);
- ndl->count = 0;
- }
+ for (i = 0; i < nd_region->num_lanes; i++)
+ mutex_init(&nd_region->lane[i].lock);
for (i = 0; i < ndr_desc->num_mappings; i++) {
struct nd_mapping_desc *mapping = &ndr_desc->mapping[i];
@@ -1065,7 +1044,6 @@ static struct nd_region *nd_region_create(struct nvdimm_bus *nvdimm_bus,
nd_region->ndr_mappings = ndr_desc->num_mappings;
nd_region->provider_data = ndr_desc->provider_data;
nd_region->nd_set = ndr_desc->nd_set;
- nd_region->num_lanes = ndr_desc->num_lanes;
nd_region->flags = ndr_desc->flags;
nd_region->ro = ro;
nd_region->numa_node = ndr_desc->numa_node;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0476/1266] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0475/1266] nvdimm/btt: Handle preemption in BTT lane acquisition Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0477/1266] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
` (522 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Wilck, Don Brace, storagedev,
Ranjan Kumar, Sathya Prakash Veerichetty, Kashyap Desai,
Sumit Saxena, mpi3mr-linuxdrv.pdl, MPT-FusionLinux.pdl, Yihang Li,
Christoph Hellwig, Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
[ Upstream commit 8c292e89bd831c8a13e92f3429ef66bbe0b83677 ]
This reverts commit 37c4e72b0651e7697eb338cd1fb09feef472cc1a.
Said commit causes excessive resource usage and even system freeze with
some controllers, e.g. smartpqi and hisi_sas. The justification provided
by the patch authors [1] was supporting a special mode of the mpi3mr and
mpt3sas, so-called "Tri-mode", in which NVMe drives are exposed as SCSI
devices on a separate channel. While that's useful for these drivers, it
seems wrong to cause major breakage for other drivers for the sake of
this feature.
[1] https://lore.kernel.org/linux-scsi/CAFdVvOwjy+2ORJ6uJkspiLTPF05481U7gcS4QohFOFGPqAs8ig@mail.gmail.com/
Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans")
Signed-off-by: Martin Wilck <martin.wilck@suse.com>
Cc: Don Brace <don.brace@microchip.com>
Cc: storagedev@microchip.com
Cc: Ranjan Kumar <ranjan.kumar@broadcom.com>
Cc: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Cc: Kashyap Desai <kashyap.desai@broadcom.com>
Cc: Sumit Saxena <sumit.saxena@broadcom.com>
Cc: mpi3mr-linuxdrv.pdl@broadcom.com
Cc: MPT-FusionLinux.pdl@broadcom.com
Cc: Yihang Li <liyihang9@h-partners.c>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260513174236.430465-3-mwilck@suse.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_scan.c | 2 +-
drivers/scsi/scsi_transport_sas.c | 60 +++++++------------------------
2 files changed, 13 insertions(+), 49 deletions(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 083bf3386c6b3b..d3795db86b326b 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1848,7 +1848,7 @@ int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel,
return 0;
}
-EXPORT_SYMBOL(scsi_scan_host_selected);
+
static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
{
struct scsi_device *sdev;
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index a9eb548c0de9f5..7fdd2b61fe855e 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -40,8 +40,6 @@
#include <scsi/scsi_transport_sas.h>
#include "scsi_sas_internal.h"
-#include "scsi_priv.h"
-
struct sas_host_attrs {
struct list_head rphy_list;
struct mutex lock;
@@ -1683,22 +1681,6 @@ int scsi_is_sas_rphy(const struct device *dev)
}
EXPORT_SYMBOL(scsi_is_sas_rphy);
-static void scan_channel_zero(struct Scsi_Host *shost, uint id, u64 lun)
-{
- struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
- struct sas_rphy *rphy;
-
- list_for_each_entry(rphy, &sas_host->rphy_list, list) {
- if (rphy->identify.device_type != SAS_END_DEVICE ||
- rphy->scsi_target_id == -1)
- continue;
-
- if (id == SCAN_WILD_CARD || id == rphy->scsi_target_id) {
- scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id,
- lun, SCSI_SCAN_MANUAL);
- }
- }
-}
/*
* SCSI scan helper
@@ -1708,41 +1690,23 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
uint id, u64 lun)
{
struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
- int res = 0;
- int i;
-
- switch (channel) {
- case 0:
- mutex_lock(&sas_host->lock);
- scan_channel_zero(shost, id, lun);
- mutex_unlock(&sas_host->lock);
- break;
-
- case SCAN_WILD_CARD:
- mutex_lock(&sas_host->lock);
- scan_channel_zero(shost, id, lun);
- mutex_unlock(&sas_host->lock);
+ struct sas_rphy *rphy;
- for (i = 1; i <= shost->max_channel; i++) {
- res = scsi_scan_host_selected(shost, i, id, lun,
- SCSI_SCAN_MANUAL);
- if (res)
- goto exit_scan;
- }
- break;
+ mutex_lock(&sas_host->lock);
+ list_for_each_entry(rphy, &sas_host->rphy_list, list) {
+ if (rphy->identify.device_type != SAS_END_DEVICE ||
+ rphy->scsi_target_id == -1)
+ continue;
- default:
- if (channel <= shost->max_channel) {
- res = scsi_scan_host_selected(shost, channel, id, lun,
- SCSI_SCAN_MANUAL);
- } else {
- res = -EINVAL;
+ if ((channel == SCAN_WILD_CARD || channel == 0) &&
+ (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
+ scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id,
+ lun, SCSI_SCAN_MANUAL);
}
- break;
}
+ mutex_unlock(&sas_host->lock);
-exit_scan:
- return res;
+ return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0477/1266] scsi: pm8001: Fix error code in non_fatal_log_show()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0476/1266] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0478/1266] scsi: ufs: Fix wrong value printed in unexpected UPIU response case Greg Kroah-Hartman
` (521 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Jack Wang,
Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 1b6f03b7ae9ee27054c55bb55a69d05555a78516 ]
The non_fatal_log_show() function is supposed to return negative error
codes on failure. But because the error codes are saved in a u32 and
then cast to signed long, they end up being high positive values instead
of negative. Remove the intermediary u32 variable to fix this bug.
Fixes: dba2cc03b9db ("scsi: pm80xx: sysfs attribute for non fatal dump")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Link: https://patch.msgid.link/ahs-bEsBJH0KhnsX@stanley.mountain
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index d3ff212d28b2e1..49e60976a61afe 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -588,10 +588,7 @@ static DEVICE_ATTR(fatal_log, S_IRUGO, pm8001_ctl_fatal_log_show, NULL);
static ssize_t non_fatal_log_show(struct device *cdev,
struct device_attribute *attr, char *buf)
{
- u32 count;
-
- count = pm80xx_get_non_fatal_dump(cdev, attr, buf);
- return count;
+ return pm80xx_get_non_fatal_dump(cdev, attr, buf);
}
static DEVICE_ATTR_RO(non_fatal_log);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0478/1266] scsi: ufs: Fix wrong value printed in unexpected UPIU response case
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0477/1266] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0479/1266] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs Greg Kroah-Hartman
` (520 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chanwoo Lee, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanwoo Lee <cw9316.lee@samsung.com>
[ Upstream commit 2483ae0a56231a915c706411421c6c002a2bf83e ]
In ufshcd_transfer_rsp_status(), the default case of the inner switch
statement prints the UPIU response code when an unexpected response is
received. However, the code was printing 'result' variable which is
always 0 at that point, making the error message useless for debugging.
Fix this by printing the actual UPIU response code returned by
ufshcd_get_req_rsp().
Fixes: 08108d31129a ("scsi: ufs: Improve type safety")
Signed-off-by: Chanwoo Lee <cw9316.lee@samsung.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260527092134.275887-1-cw9316.lee@samsung.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index f6aada5150f9cd..142abff3012207 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -5407,7 +5407,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp,
default:
dev_err(hba->dev,
"Unexpected request response code = %x\n",
- result);
+ ufshcd_get_req_rsp(lrbp->ucd_rsp_ptr));
result = DID_ERROR << 16;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0479/1266] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0478/1266] scsi: ufs: Fix wrong value printed in unexpected UPIU response case Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0480/1266] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
` (519 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+36e50496c8ac4bcde3f9, Al Viro,
Deepanshu Kartikey, Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
[ Upstream commit b93c55b4932dd7e32dca8cf34a3443cc87a02906 ]
commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning
htab with internal structs") moved inode cleanup from ->free_inode()
into ->destroy_inode() to avoid sleeping in RCU context when calling
bpf_any_put(). However this removed the RCU delay on freeing the
inode itself and the cached symlink body (i_link), both of which
can be accessed by RCU pathwalk (pick_link, may_lookup etc.).
This causes a use-after-free when a concurrent unlinkat() drops the
last inode reference and destroy_inode() frees the inode immediately,
while another task is still walking the path in RCU mode and reads
inode->i_opflags (offset +2) inside current_time() -> is_mgtime().
KASAN reports:
BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313
Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)
The rules (per Al Viro):
->destroy_inode() called immediately, can sleep, use for blocking
cleanup e.g. bpf_any_put()
->free_inode() called after RCU grace period, use for freeing
inode and anything RCU-accessible e.g. i_link
Fix: split the two concerns properly:
- keep bpf_any_put() in bpf_destroy_inode() since it is blocking
and needs to run promptly
- introduce bpf_free_inode() to handle kfree(i_link) and
free_inode_nonrcu() with proper RCU delay, preventing the UAF
Fixes: 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs")
Reported-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=36e50496c8ac4bcde3f9
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lore.kernel.org/all/20260423043906.GN3518998@ZenIV/
Link: https://lore.kernel.org/all/20260602002607.110866-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lore.kernel.org/r/20260602025249.113828-1-kartikey406@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/inode.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 9a9630adcba4f6..99ec74325175cf 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -611,10 +611,18 @@ static void bpf_destroy_inode(struct inode *inode)
{
enum bpf_type type;
- if (S_ISLNK(inode->i_mode))
- kfree(inode->i_link);
if (!bpf_inode_type(inode, &type))
bpf_any_put(inode->i_private, type);
+}
+
+/*
+ * Called after RCU grace period - safe to free inode and anything
+ * that might be accessed by RCU pathwalk (inode fields, i_link).
+ */
+static void bpf_free_inode(struct inode *inode)
+{
+ if (S_ISLNK(inode->i_mode))
+ kfree(inode->i_link);
free_inode_nonrcu(inode);
}
@@ -623,6 +631,7 @@ static const struct super_operations bpf_super_ops = {
.drop_inode = generic_delete_inode,
.show_options = bpf_show_options,
.destroy_inode = bpf_destroy_inode,
+ .free_inode = bpf_free_inode,
};
enum {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0480/1266] mm/fake-numa: fix under-allocation detection in uniform split
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0479/1266] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0481/1266] ext2: fix ignored return value of generic_write_sync() Greg Kroah-Hartman
` (518 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sang-Heon Jeon, Donghyeon Lee,
Munhui Chae, Mike Rapoport (Microsoft), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <ekffu200098@gmail.com>
[ Upstream commit 3a3fc1dfd6a958615ebaab8fb251e89fc2b3f2f2 ]
When splitting NUMA node uniformly, split_nodes_size_interleave_uniform()
returns the next absolute node ID, not the number of nodes created.
The existing under-allocation detection logic compares next absolute node
ID (ret) and request count (n), which only works when nid starts at 0.
For example, on a system with 2 physical NUMA nodes (node 0: 2GB, node
1: 128MB) and numa=fake=8U, 8 fake nodes are successfully created from
node 0 and split_nodes_size_interleave_uniform() returns 8. For node 1,
fake node nid starts at 8, but only 4 fake nodes are created due to
current FAKE_NODE_MIN_SIZE being 32MB, and
split_nodes_size_interleave_uniform() returns 12. By existing
under-allocation detection logic, "ret < n" (12 < 8) is false, so the
under-allocation will not be detected.
Fix under-allocation detection logic to compare the number of actually
created nodes (ret - nid) against the request count (n). Also skip
under-allocation detection logic for memoryless physical nodes where no
fake nodes are created.
Also, fix the outdated comment describing
split_nodes_size_interleave_uniform() to match the actual return value.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Reported-by: Donghyeon Lee <asd142513@gmail.com>
Reported-by: Munhui Chae <mochae@student.42seoul.kr>
Fixes: cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") # 4.19
Link: https://patch.msgid.link/20260417135805.1758378-1-ekffu200098@gmail.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/numa_emulation.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index 9a9305367fdd16..b8ae605537145e 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -211,7 +211,7 @@ static u64 uniform_size(u64 max_addr, u64 base, u64 hole, int nr_nodes)
* Sets up fake nodes of `size' interleaved over physical nodes ranging from
* `addr' to `max_addr'.
*
- * Returns zero on success or negative on error.
+ * Returns node ID of the next node on success or negative error code.
*/
static int __init split_nodes_size_interleave_uniform(struct numa_meminfo *ei,
struct numa_meminfo *pi,
@@ -395,7 +395,7 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
if (strchr(emu_cmdline, 'U')) {
nodemask_t physnode_mask = numa_nodes_parsed;
unsigned long n;
- int nid = 0;
+ int nid = 0, nr_created;
n = simple_strtoul(emu_cmdline, &emu_cmdline, 0);
ret = -1;
@@ -413,9 +413,18 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
n, &pi.blk[0], nid);
if (ret < 0)
break;
- if (ret < n) {
+
+ /*
+ * If no memory was found for this physical node,
+ * skip the under-allocation check.
+ */
+ if (ret == nid)
+ continue;
+
+ nr_created = ret - nid;
+ if (nr_created < n) {
pr_info("%s: phys: %d only got %d of %ld nodes, failing\n",
- __func__, i, ret, n);
+ __func__, i, nr_created, n);
ret = -1;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0481/1266] ext2: fix ignored return value of generic_write_sync()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0480/1266] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0482/1266] sched: restore timer_slack_ns when resetting RT policy on fork Greg Kroah-Hartman
` (517 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danila Chernetsov, Jan Kara,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <listdansp@mail.ru>
[ Upstream commit a4659be0bc7cb1856ffb15b67f903229ae8891ec ]
Fix ext2_dio_write_iter() to propagate the error returned by
generic_write_sync() instead of silently discarding it, which could
cause write(2) to return success to userspace on O_SYNC/O_DSYNC files
even when the sync failed.
The correct pattern, already used in ext2_dax_write_iter() in the same
file and in ext4, xfs, f2fs among others, is:
if (ret > 0)
ret = generic_write_sync(iocb, ret);
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[JK: Reflect also filemap_write_and_wait() return value]
Fixes: fb5de4358e1a ("ext2: Move direct-io to use iomap")
Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
Link: https://patch.msgid.link/20260530122311.136803-1-listdansp@mail.ru
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext2/file.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/ext2/file.c b/fs/ext2/file.c
index 4ddc36f4dbd407..a6913e4eb523e1 100644
--- a/fs/ext2/file.c
+++ b/fs/ext2/file.c
@@ -262,12 +262,15 @@ static ssize_t ext2_dio_write_iter(struct kiocb *iocb, struct iov_iter *from)
endbyte = pos + status - 1;
ret2 = filemap_write_and_wait_range(inode->i_mapping, pos,
endbyte);
- if (!ret2)
+ if (!ret2) {
invalidate_mapping_pages(inode->i_mapping,
pos >> PAGE_SHIFT,
endbyte >> PAGE_SHIFT);
- if (ret > 0)
- generic_write_sync(iocb, ret);
+ if (ret > 0)
+ ret = generic_write_sync(iocb, ret);
+ } else {
+ ret = ret2;
+ }
}
out_unlock:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0482/1266] sched: restore timer_slack_ns when resetting RT policy on fork
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0481/1266] ext2: fix ignored return value of generic_write_sync() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0483/1266] lib/test_meminit: use && for bools Greg Kroah-Hartman
` (516 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiaoting.Lin, Guanyou.Chen,
Chunhui.Li, Peter Zijlstra (Intel), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanyou.Chen <chenguanyou9338@gmail.com>
[ Upstream commit 63c1a12bc0e09af7dee919c4fb4a300a719d5125 ]
Commit ed4fb6d7ef68 ("hrtimer: Use and report correct timerslack values
for realtime tasks") sets timer_slack_ns to 0 for RT tasks in
__setscheduler_params(). However, when an RT task with SCHED_RESET_ON_FORK
creates child threads, the children inherit timer_slack_ns=0 from the
parent. sched_fork() resets the child's policy to SCHED_NORMAL but does
not restore timer_slack_ns, leaving the child permanently running with
zero slack.
Fix this by restoring timer_slack_ns from default_timer_slack_ns in
sched_fork() when resetting from RT/DL to NORMAL policy, matching the
existing behavior in __setscheduler_params().
Note: this fix alone requires a correct default_timer_slack_ns to be
effective. See the following patch for that fix.
Fixes: ed4fb6d7ef68 ("hrtimer: Use and report correct timerslack values for realtime tasks")
Reported-by: Qiaoting.Lin <linqiaoting@xiaomi.com>
Signed-off-by: Guanyou.Chen <chenguanyou@xiaomi.com>
Signed-off-by: Chunhui.Li <chunhui.li@mediatek.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260522131000.1664983-2-chenguanyou@xiaomi.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d558e43aedcf2a..797b81dcf69ab6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4751,6 +4751,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
p->policy = SCHED_NORMAL;
p->static_prio = NICE_TO_PRIO(0);
p->rt_priority = 0;
+ p->timer_slack_ns = p->default_timer_slack_ns;
} else if (PRIO_TO_NICE(p->static_prio) < 0)
p->static_prio = NICE_TO_PRIO(0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0483/1266] lib/test_meminit: use && for bools
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0482/1266] sched: restore timer_slack_ns when resetting RT policy on fork Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0484/1266] configfs_lookup(): dont leave ->s_dentry dangling on failure Greg Kroah-Hartman
` (515 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Potapenko, Dan Carpenter,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 8e0c2085c978ed6d9764d79fc785920360096f21 ]
As pointed out by Dan Carpenter, test_kmemcache() was using a bitwise AND
on two bools instead of a boolean AND. Fix this for the sake of code
cleanliness.
Link: https://lore.kernel.org/20260504100637.1535762-1-glider@google.com
Fixes: 5015a300a522 ("lib: introduce test_meminit module")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/kernel-janitors/afOcIan1ap9kD26M@stanley.mountain/
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/test_meminit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/test_meminit.c b/lib/test_meminit.c
index 0dc173849a5420..d0aa0acd4e0109 100644
--- a/lib/test_meminit.c
+++ b/lib/test_meminit.c
@@ -387,7 +387,7 @@ static int __init test_kmemcache(int *total_failures)
ctor = flags & 1;
rcu = flags & 2;
zero = flags & 4;
- if (ctor & zero)
+ if (ctor && zero)
continue;
num_tests += do_kmem_cache_size(size, ctor, rcu, zero,
&failures);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0484/1266] configfs_lookup(): dont leave ->s_dentry dangling on failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0483/1266] lib/test_meminit: use && for bools Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0485/1266] drm/amdgpu: set sub_block_index for mca ras sub-blocks Greg Kroah-Hartman
` (514 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Breno Leitao, Al Viro,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 10da12d352b7b2bb330a8609fdda9a58bf0e9856 ]
Normally ->s_dentry is cleared when dentry it's pointing to becomes
negative (on eviction, realistically). However, that only happens
if dentry gets to be positive in the first place; in case of inode
allocation failure dentry never becomes positive, so ->d_iput()
is not called at all.
We do part of what normally would've been done by configfs_d_iput()
(dropping the reference to configfs_dirent) manually, but we do
not clear ->s_dentry there. Sloppy as it is, it does not matter in
case of configfs_create_{dir,link}() - there configfs_dirent does
not survive dropping the sole reference to it.
However, for configfs_lookup() it *does* survive, with a dangling
pointer to soon to be freed dentry sitting it its ->s_dentry.
Subsequent getdents(2) in that directory will end up dereferencing
that pointer in order to pick the inode number. Use after free...
This is the minimal fix; the right approach is to set the linkage
between dentry and configfs_dirent only after we know that we have
an inode, but that takes more surgery and the bug had been there
since 2006, so...
Fixes: 3d0f89bb1694 ("configfs: Add permission and ownership to configfs objects") # 2.6.16-rc3
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/configfs/dir.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 2df99cd1034d4e..c3fac94f66f212 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -462,6 +462,9 @@ static struct dentry * configfs_lookup(struct inode *dir,
inode = configfs_create(dentry, mode);
if (IS_ERR(inode)) {
+ spin_lock(&configfs_dirent_lock);
+ sd->s_dentry = NULL;
+ spin_unlock(&configfs_dirent_lock);
configfs_put(sd);
return ERR_CAST(inode);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0485/1266] drm/amdgpu: set sub_block_index for mca ras sub-blocks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0484/1266] configfs_lookup(): dont leave ->s_dentry dangling on failure Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0486/1266] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
` (513 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunxiang Li, Hawking Zhang,
Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <Yunxiang.Li@amd.com>
[ Upstream commit baa286df5fb366e4aee5b747443dfc7194fdaa59 ]
The mca ras sub-blocks (mp0, mp1, mpio) all share the
AMDGPU_RAS_BLOCK__MCA block id and are distinguished only by
sub_block_index. The ras manager object for an mca block is selected
with:
con->objs[AMDGPU_RAS_BLOCK__LAST + head->sub_block_index]
Since the rework in commit 7f544c5488cf ("drm/amdgpu: Rework mca ras
sw_init") moved the ras_comm setup into amdgpu_mca_mp*_ras_sw_init() but
left sub_block_index unset, mp0/mp1/mpio all default to index 0 and
collide on the same object slot. mp0 grabs the slot and creates its
sysfs node first; mp1 (and mpio) then find the slot already in use, so
amdgpu_ras_block_late_init() -> amdgpu_ras_sysfs_create() returns
-EINVAL:
amdgpu: mca.mp1 failed to execute ras_block_late_init_default! ret:-22
amdgpu: amdgpu_ras_late_init failed -22
amdgpu: amdgpu_device_ip_late_init failed
amdgpu: Fatal error during GPU init
The error is currently masked because amdgpu_ras_late_init() does not
check the return value of amdgpu_ras_block_late_init_default(), but it
already leaves mp1/mpio without their sysfs nodes and becomes a fatal
init failure as soon as that return value is honored.
Restore the per-sub-block sub_block_index assignment so each mca
sub-block maps to its own object slot.
Fixes: 7f544c5488cf ("drm/amdgpu: Rework mca ras sw_init")
Signed-off-by: Yunxiang Li <Yunxiang.Li@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c
index 8d9ff9e151de1a..9a7f7d2b2767a5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c
@@ -89,6 +89,7 @@ int amdgpu_mca_mp0_ras_sw_init(struct amdgpu_device *adev)
strcpy(ras->ras_block.ras_comm.name, "mca.mp0");
ras->ras_block.ras_comm.block = AMDGPU_RAS_BLOCK__MCA;
+ ras->ras_block.ras_comm.sub_block_index = AMDGPU_RAS_MCA_BLOCK__MP0;
ras->ras_block.ras_comm.type = AMDGPU_RAS_ERROR__MULTI_UNCORRECTABLE;
adev->mca.mp0.ras_if = &ras->ras_block.ras_comm;
@@ -113,6 +114,7 @@ int amdgpu_mca_mp1_ras_sw_init(struct amdgpu_device *adev)
strcpy(ras->ras_block.ras_comm.name, "mca.mp1");
ras->ras_block.ras_comm.block = AMDGPU_RAS_BLOCK__MCA;
+ ras->ras_block.ras_comm.sub_block_index = AMDGPU_RAS_MCA_BLOCK__MP1;
ras->ras_block.ras_comm.type = AMDGPU_RAS_ERROR__MULTI_UNCORRECTABLE;
adev->mca.mp1.ras_if = &ras->ras_block.ras_comm;
@@ -137,6 +139,7 @@ int amdgpu_mca_mpio_ras_sw_init(struct amdgpu_device *adev)
strcpy(ras->ras_block.ras_comm.name, "mca.mpio");
ras->ras_block.ras_comm.block = AMDGPU_RAS_BLOCK__MCA;
+ ras->ras_block.ras_comm.sub_block_index = AMDGPU_RAS_MCA_BLOCK__MPIO;
ras->ras_block.ras_comm.type = AMDGPU_RAS_ERROR__MULTI_UNCORRECTABLE;
adev->mca.mpio.ras_if = &ras->ras_block.ras_comm;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0486/1266] bpftool: Use libbpf error code for flow dissector query
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0485/1266] drm/amdgpu: set sub_block_index for mca ras sub-blocks Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0487/1266] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
` (512 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Woojin Ji, Andrii Nakryiko,
Leon Hwang, Yonghong Song, Quentin Monnet, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Woojin Ji <random6.xyz@gmail.com>
[ Upstream commit 8a7f2bff2165e53595d1e91c160b340f978c0ab7 ]
bpf_prog_query() returns a negative errno on failure.
query_flow_dissector() currently closes the namespace fd and then reads
errno to decide whether -EINVAL means that the running kernel does not
support flow dissector queries.
That errno check controls behavior, not just diagnostics: -EINVAL is
handled as a non-fatal old-kernel case, while any other error makes bpftool
net fail.
The namespace fd is opened read-only, so close() is not expected to
commonly fail in normal use. Still, the BPF_PROG_QUERY error is already
available in err, and reading errno after an intervening close() is
fragile. If close() does change errno, the compatibility branch may be
based on close()'s error instead of the BPF_PROG_QUERY result.
This was reproduced with an LD_PRELOAD fault injector that forced
BPF_PROG_QUERY for BPF_FLOW_DISSECTOR to fail with EINVAL and then
forced close() on the netns fd to fail with EIO. The unpatched bpftool
reported "can't query prog: Input/output error". With this change, the
same injected failure is handled as the intended non-fatal EINVAL
compatibility case.
Use the libbpf-returned error code instead. Keep the existing errno reset
in the non-fatal path to preserve batch mode behavior. The success path
is unchanged.
Fixes: 7f0c57fec80f ("bpftool: show flow_dissector attachment status")
Signed-off-by: Woojin Ji <random6.xyz@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20260603003339.33791-1-random6.xyz@gmail.com
Assisted-by: ChatGPT:gpt-5.5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/net.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index 225d3678b4ed1d..2d07ffea589e07 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -594,14 +594,14 @@ static int query_flow_dissector(struct bpf_attach_info *attach_info)
&attach_flags, prog_ids, &prog_cnt);
close(fd);
if (err) {
- if (errno == EINVAL) {
+ if (err == -EINVAL) {
/* Older kernel's don't support querying
* flow dissector programs.
*/
errno = 0;
return 0;
}
- p_err("can't query prog: %s", strerror(errno));
+ p_err("can't query prog: %s", strerror(-err));
return -1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0487/1266] perf/x86/amd/core: Always use the NMI latency mitigation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0486/1266] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0488/1266] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
` (511 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sandipan Das, Peter Zijlstra (Intel),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit 73a4c02f94a98d94480c3e5c81450215a4da05ba ]
Commit df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation
to use a timestamp") fixed handling of late-arriving NMIs but limited
the mitigation to processors having X86_FEATURE_PERFCTR_CORE. However,
it is unclear if processors without this feature are also affected.
When Mediated vPMU is enabled on affected hardware, it is also possible
to bypass the fix inside KVM guests if X86_FEATURE_PERFCTR_CORE is
removed from the guest CPUID (e.g. using "-cpu host,-perfctr-core" with
QEMU). Hence, use the mitigation at all times.
Fixes: df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp")
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/29a3c970da289ab8f24282933bdb36545c0403e8.1780325517.git.sandipan.das@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/amd/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index 211f429750f5fe..24f356e561e287 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -1364,12 +1364,12 @@ static int __init amd_core_pmu_init(void)
u64 even_ctr_mask = 0ULL;
int i;
- if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
- return 0;
-
/* Avoid calculating the value each time in the NMI handler */
perf_nmi_window = msecs_to_jiffies(100);
+ if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
+ return 0;
+
/*
* If core performance counter extensions exists, we must use
* MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0488/1266] ocfs2: rebase copied fsdlm LVB pointers in locking_state
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0487/1266] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0489/1266] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
` (510 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit 93612d48fa42b3d1a637eb9279e15281c611c000 ]
The locking_state debugfs iterator snapshots struct ocfs2_lock_res by
value under ocfs2_dlm_tracking_lock and later formats that copy in
ocfs2_dlm_seq_show(). That is fine for the inline fields, but the
userspace fsdlm stack stores the LVB through lksb_fsdlm.sb_lvbptr. Once
the iterator drops the tracking lock, a copied non-NULL sb_lvbptr still
points into the original lockres owner, so teardown can free that
container before the debugfs dump walks the raw LVB bytes.
Rebase the copied sb_lvbptr to the copied l_lksb before dumping the raw
LVB. The seq snapshot already carries the inline LVB storage reserved in
struct ocfs2_dlm_lksb, so the debugfs reader can dump the copied bytes
without borrowing the original lockres lifetime.
The buggy scenario involves two paths, with each column showing the order
within that path:
locking_state reader: lockres teardown:
1. ocfs2_dlm_seq_start()/next() 1. file release or another owner
copies struct ocfs2_lock_res teardown reaches
2. ocfs2_dlm_seq_show() formats ocfs2_lock_res_free()
the copied row 2. the lockres is removed from the
3. ocfs2_dlm_lvb() follows the tracking list
copied sb_lvbptr 3. the owner frees the original
lockres container
Validation reproduced this kernel report:
KASAN slab-use-after-free in ocfs2_dlm_seq_show+0x1bd/0x430
RIP: 0033:0x7f8ec4b1e29d
The buggy address belongs to the object at ffff88810a1e0800 which belongs
to the cache kmalloc-1k of size 1024
The buggy address is located 368 bytes inside of freed 1024-byte region
[ffff88810a1e0800, ffff88810a1e0c00)
Read of size 1
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
ocfs2_dlm_seq_show+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
seq_read_iter+0x29d/0x790
seq_read+0x20a/0x280
find_held_lock+0x2b/0x80
rcu_read_unlock+0x18/0x70
full_proxy_read+0x9e/0xd0
vfs_read+0x12c/0x590
ksys_read+0xd2/0x170
do_user_addr_fault+0x65a/0x890
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
ocfs2_file_open+0x13e/0x300
do_dentry_open+0x233/0x7f0
vfs_open+0x5a/0x1b0
path_openat+0x66d/0x1540
do_file_open+0x186/0x2b0
do_sys_openat2+0xce/0x150
__x64_sys_openat+0xd0/0x140
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x313/0x590
ocfs2_file_release+0x138/0x260
__fput+0x1df/0x4b0
fput_close_sync+0xd2/0x170
__x64_sys_close+0x55/0x90
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Link: https://lore.kernel.org/20260525041726.4112882-1-rollkingzzc@gmail.com
Fixes: cf4d8d75d8ab ("ocfs2: add fsdlm to stackglue")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlmglue.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 9148a98a5fbe10..5c9f06090e3916 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3135,6 +3135,22 @@ static void *ocfs2_dlm_seq_next(struct seq_file *m, void *v, loff_t *pos)
* - Add last pr/ex unlock times and first lock wait time in usecs
*/
#define OCFS2_DLM_DEBUG_STR_VERSION 4
+
+/*
+ * The debug iterator snapshots lockres by value, so a userspace-stack LVB
+ * pointer copied from the original lockres must be rebased to the copied
+ * lksb before the dump walks the raw bytes.
+ */
+static void ocfs2_dlm_seq_rebase_lvb(struct ocfs2_lock_res *lockres)
+{
+ if (!ocfs2_stack_supports_plocks())
+ return;
+
+ if (lockres->l_lksb.lksb_fsdlm.sb_lvbptr)
+ lockres->l_lksb.lksb_fsdlm.sb_lvbptr =
+ (char *)&lockres->l_lksb + sizeof(struct dlm_lksb);
+}
+
static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
{
int i;
@@ -3195,6 +3211,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
lockres->l_blocking);
/* Dump the raw LVB */
+ ocfs2_dlm_seq_rebase_lvb(lockres);
lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
for(i = 0; i < DLM_LVB_LEN; i++)
seq_printf(m, "0x%x\t", lvb[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0489/1266] ocfs2: fix buffer head management in ocfs2_read_blocks()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0488/1266] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0490/1266] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
` (509 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov,
syzbot+caacd220635a9cc3bac9, Joseph Qi, Mark Fasheh, Joel Becker,
Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 6371a07148ee979af22a9d6f4c277462953a9a4a ]
In ocfs2_read_blocks(), caller should't assume that buffer head returned
by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops
b_count from 1 to 0. If it is not so, buffer head remains on hold and
likely to be returned by the next call to 'sb_getblk()' unchanged - that
is, with BH_Uptodate bit set even if it has failed validation previously,
thus allowing to insert that buffer head into OCFS2 metadata cache and
submit it to upper layers. To avoid such a scenario, BH_Uptodate should
be cleared immediately after 'validate()' callback has detected some data
inconsistency.
Link: https://lore.kernel.org/20260529094128.494293-1-dmantipov@yandex.ru
Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+caacd220635a9cc3bac9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=caacd220635a9cc3bac9
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/buffer_head_io.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index 45ca3cb7c0974c..71f3787bf82f07 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -350,8 +350,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
wait_on_buffer(bh);
put_bh(bh);
bhs[i] = NULL;
- } else if (bh && buffer_uptodate(bh)) {
- clear_buffer_uptodate(bh);
}
continue;
}
@@ -380,8 +378,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
BUG_ON(buffer_jbd(bh));
clear_buffer_needs_validate(bh);
status = validate(sb, bh);
- if (status)
+ if (status) {
+ if (buffer_uptodate(bh))
+ clear_buffer_uptodate(bh);
goto read_failure;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0490/1266] ocfs2: reject FITRIM ranges shorter than a cluster
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0489/1266] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0491/1266] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
` (508 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit ca1afd88f5eaaff9168e1466e5401385edf59543 ]
ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its
too-short range validation only checks sb->s_blocksize.
On filesystems with a cluster size larger than the block size, a FITRIM
range that is at least one block but shorter than one cluster is accepted
and shifted down to len == 0. The later start + len - 1 and len -= ...
arithmetic then underflows and can drive trimming past the requested
range.
Reject ranges shorter than s_clustersize instead. That preserves the
existing -EINVAL behavior for requests that cannot discard even one
allocation unit and keeps zero-cluster trims out of the group walk.
Link: https://lore.kernel.org/20260528151247.361854-1-rollkingzzc@gmail.com
Fixes: aa89762c5480 ("ocfs2: return EINVAL if the given range to discard is less than block size")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index af40f0da3a95ca..bcdd9f25b2f509 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7546,7 +7546,7 @@ int ocfs2_trim_mainbm(struct super_block *sb, struct fstrim_range *range)
len = range->len >> osb->s_clustersize_bits;
minlen = range->minlen >> osb->s_clustersize_bits;
- if (minlen >= osb->bitmap_cpg || range->len < sb->s_blocksize)
+ if (minlen >= osb->bitmap_cpg || range->len < osb->s_clustersize)
return -EINVAL;
trace_ocfs2_trim_mainbm(start, len, minlen);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0491/1266] ocfs2/dlm: require a ref for locking_state debugfs open
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0490/1266] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0492/1266] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
` (507 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit 03ad858ce8064861ea580021976dc19b7aabb549 ]
debug_lockres_open() copies inode->i_private into struct debug_lockres and
debug_lockres_release() later drops that pointer with dlm_put(). That
only works if open successfully pins the struct dlm_ctxt.
Today open calls dlm_grab(dlm) but ignores its return value. Once the
last domain unregister has removed the context from dlm_domains,
dlm_grab() returns NULL, yet open still stores the raw pointer and returns
success. The later release path is outside the debugfs removal barrier,
so it can call dlm_put() after dlm_free_ctxt_mem() has freed the context.
KASAN reports this as a slab-use-after-free in dlm_put() called from
debug_lockres_release().
Fail the open when dlm_grab() cannot acquire the reference and unwind the
seq_file private state before returning. That keeps locking_state from
handing out a file descriptor whose release path does not own the
dlm_ctxt.
The buggy scenario involves two paths, with each column showing the order
within that path:
locking_state debugfs open: last domain unregister:
1. debug_lockres_open() reads 1. dlm_unregister_domain() calls
inode->i_private. dlm_complete_dlm_shutdown().
2. debug_lockres_open() calls 2. shutdown removes the dlm_ctxt from
dlm_grab(dlm) and gets NULL. dlm_domains.
3. open still stores the raw dlm 3. final teardown reaches
pointer in dl->dl_ctxt and dlm_free_ctxt_mem() and frees it.
returns success.
4. debug_lockres_release() later
calls dlm_put(dl->dl_ctxt).
Validation reproduced this kernel report:
KASAN slab-use-after-free in dlm_put+0x82/0x200
RIP: 0033:0x7f4d349bc9e0
The buggy address belongs to the object at ffff888103a3c000 which belongs
to the cache kmalloc-2k of size 2048
The buggy address is located 816 bytes inside of freed 2048-byte region
[ffff888103a3c000, ffff888103a3c800)
Write of size 4
Call trace:
dump_stack_lvl+0x66/0xa0 (?:?)
print_report+0xd0/0x630 (?:?)
dlm_put+0x82/0x200 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x188/0x2f0 (?:?)
kasan_report+0xe4/0x120 (?:?)
kasan_check_range+0x105/0x1b0 (?:?)
debug_lockres_release+0x53/0x80 (fs/ocfs2/dlm/dlmdebug.c:587)
dlm_put+0x9/0x200 (?:?)
debug_lockres_release+0x5c/0x80 (fs/ocfs2/dlm/dlmdebug.c:587)
full_proxy_release+0x67/0x90 (?:?)
__fput+0x1df/0x4b0 (?:?)
do_raw_spin_lock+0x10f/0x1b0 (?:?)
fput_close_sync+0xd2/0x170 (?:?)
__x64_sys_close+0x55/0x90 (?:?)
do_syscall_64+0x10c/0x640 (arch/x86/entry/syscall_64.c:87)
irqentry_exit+0xac/0x6e0 (?:?)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Freed by task stack:
kasan_save_stack+0x33/0x60 (?:?)
kasan_save_track+0x14/0x30 (?:?)
kasan_save_free_info+0x3b/0x60 (?:?)
__kasan_slab_free+0x5f/0x80 (?:?)
kfree+0x30f/0x580 (?:?)
dlm_put+0x1ce/0x200 (?:?)
dlm_unregister_domain+0xf6/0xb30 (?:?)
o2cb_cluster_disconnect+0x6b/0x90 (?:?)
ocfs2_cluster_disconnect+0x41/0x70 (?:?)
ocfs2_dlm_shutdown+0x1c4/0x220 (?:?)
ocfs2_dismount_volume+0x38a/0x550 (?:?)
generic_shutdown_super+0xc3/0x220 (?:?)
kill_block_super+0x29/0x60 (?:?)
deactivate_locked_super+0x66/0xe0 (?:?)
cleanup_mnt+0x13d/0x210 (?:?)
task_work_run+0xfa/0x170 (?:?)
exit_to_user_mode_loop+0xd6/0x430 (?:?)
do_syscall_64+0x3cb/0x640 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Link: https://lore.kernel.org/20260531044714.1640172-1-rollkingzzc@gmail.com
Fixes: 4e3d24ed1a12 ("ocfs2/dlm: Dumps the lockres' into a debugfs file")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlm/dlmdebug.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index be5e9ed7da8d94..e62ed98df7de4b 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -612,6 +612,7 @@ static int debug_lockres_open(struct inode *inode, struct file *file)
struct dlm_ctxt *dlm = inode->i_private;
struct debug_lockres *dl;
void *buf;
+ int status = -ENOMEM;
buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (!buf)
@@ -624,16 +625,23 @@ static int debug_lockres_open(struct inode *inode, struct file *file)
dl->dl_len = PAGE_SIZE;
dl->dl_buf = buf;
- dlm_grab(dlm);
- dl->dl_ctxt = dlm;
+ /* ->release uses dl_ctxt after open, so it needs a real pin. */
+ dl->dl_ctxt = dlm_grab(dlm);
+ if (!dl->dl_ctxt) {
+ status = -ENOENT;
+ goto bailseq;
+ }
return 0;
+bailseq:
+ seq_release_private(inode, file);
bailfree:
kfree(buf);
bail:
- mlog_errno(-ENOMEM);
- return -ENOMEM;
+ if (status != -ENOENT)
+ mlog_errno(status);
+ return status;
}
static int debug_lockres_release(struct inode *inode, struct file *file)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0492/1266] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0491/1266] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0493/1266] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
` (506 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Ginger, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 57dcfd9049d497c31151787a0696d59f0a98f8e6 ]
Move atomic_inc(&ocfs2_control_opened) and the handshake state update
inside ocfs2_control_lock to close a race window where
ocfs2_control_release() can observe ocfs2_control_opened dropping to zero
(resetting ocfs2_control_this_node and running_proto) while
ocfs2_control_install_private() is about to bump the counter and mark the
connection valid.
Link: https://lore.kernel.org/20260601121618.1263346-1-joseph.qi@linux.alibaba.com
Fixes: 3cfd4ab6b6b4 ("ocfs2: Add the local node id to the handshake.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: Ginger <ginger.jzllee@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/stack_user.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 38c0d6f64fce38..eeb1c29b033e63 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -327,18 +327,14 @@ static int ocfs2_control_install_private(struct file *file)
ocfs2_control_this_node = p->op_this_node;
running_proto.pv_major = p->op_proto.pv_major;
running_proto.pv_minor = p->op_proto.pv_minor;
- }
-
-out_unlock:
- mutex_unlock(&ocfs2_control_lock);
-
- if (!rc && set_p) {
- /* We set the global values successfully */
atomic_inc(&ocfs2_control_opened);
ocfs2_control_set_handshake_state(file,
OCFS2_CONTROL_HANDSHAKE_VALID);
}
+out_unlock:
+ mutex_unlock(&ocfs2_control_lock);
+
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0493/1266] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0492/1266] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0494/1266] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
` (505 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit a625c94144c9b66d32e1f374f909f38db46161c1 ]
The MSS calculation in nf_osf_match_one() manually shifts bytes to
construct a 16-bit value before passing it to ntohs().
This works on little-endian hosts but it does not work on big-endian as
the bytes are being always shifted and set in the same way for all
architectures.
Use get_unaligned_be16() to fix this on big-endian systems. It also
simplifies the code.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_osf.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 6d3dfbeb398cb4..b61656cb0f3eb5 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -95,11 +95,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
switch (*optp) {
case OSFOPT_MSS:
- mss = optp[3];
- mss <<= 8;
- mss |= optp[2];
-
- mss = ntohs((__force __be16)mss);
+ mss = get_unaligned_be16(&optp[2]);
break;
case OSFOPT_TS:
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0494/1266] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0493/1266] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0495/1266] netfilter: conntrack: revert ct extension genid infrastructure Greg Kroah-Hartman
` (504 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 9e37388b8070afe73d4ab2d973b28593ed65f3ad ]
nf_ct_seqadj_init() is called without holding the ct lock. This can race
with nf_ct_seq_adjust() when a connection is in CLOSE state due to an
RST or connection reopening. In addition for SYN_RECV state, concurrent
processing of packets can trigger nf_ct_seq_adjust() too. These
situations create a read/write data race.
As synproxy is the only user of nf_ct_seqadj_init() at the moment, fix
this by holding ct->lock inside nf_ct_seqadj_init() until all is done.
Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_seqadj.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 7ab2b25b57bcc0..b7e99f34dfce86 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -17,12 +17,14 @@ int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
if (off == 0)
return 0;
+ spin_lock_bh(&ct->lock);
set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
seqadj = nfct_seqadj(ct);
this_way = &seqadj->seq[dir];
this_way->offset_before = off;
this_way->offset_after = off;
+ spin_unlock_bh(&ct->lock);
return 0;
}
EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0495/1266] netfilter: conntrack: revert ct extension genid infrastructure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0494/1266] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0496/1266] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
` (503 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 35e21a4dccc5c255ba59ccfbfeb4629ed21da972 ]
This infrastructure is not used anymore after moving ct timeout and
helper to use datapath refcount to track object use.
Revert commit c56716c69ce1 ("netfilter: extensions: introduce extension
genid count") this patch disables all ct extensions (leading to NULL)
for unconfirmed conntracks, when this is only targeted at ct helper and
ct timeout. There is also codebase that dereferences the ct extension
without checking for NULL which could lead to crash.
Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netfilter/nf_conntrack_extend.h | 12 ----
net/netfilter/nf_conntrack_core.c | 61 +--------------------
net/netfilter/nf_conntrack_extend.c | 32 +----------
3 files changed, 2 insertions(+), 103 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 0b247248b03239..fd5c4dbf72caf7 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -38,7 +38,6 @@ enum nf_ct_ext_id {
struct nf_ct_ext {
u8 offset[NF_CT_EXT_NUM];
u8 len;
- unsigned int gen_id;
char data[] __aligned(8);
};
@@ -52,8 +51,6 @@ static inline bool nf_ct_ext_exist(const struct nf_conn *ct, u8 id)
return (ct->ext && __nf_ct_ext_exist(ct->ext, id));
}
-void *__nf_ct_ext_find(const struct nf_ct_ext *ext, u8 id);
-
static inline void *nf_ct_ext_find(const struct nf_conn *ct, u8 id)
{
struct nf_ct_ext *ext = ct->ext;
@@ -61,19 +58,10 @@ static inline void *nf_ct_ext_find(const struct nf_conn *ct, u8 id)
if (!ext || !__nf_ct_ext_exist(ext, id))
return NULL;
- if (unlikely(ext->gen_id))
- return __nf_ct_ext_find(ext, id);
-
return (void *)ct->ext + ct->ext->offset[id];
}
/* Add this type, returns pointer to data or NULL. */
void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp);
-/* ext genid. if ext->id != ext_genid, extensions cannot be used
- * anymore unless conntrack has CONFIRMED bit set.
- */
-extern atomic_t nf_conntrack_ext_genid;
-void nf_ct_ext_bump_genid(void);
-
#endif /* _NF_CONNTRACK_EXTEND_H */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0081c1a0d5e563..06995cdb36bef9 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -836,33 +836,6 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
&nf_conntrack_hash[reply_hash]);
}
-static bool nf_ct_ext_valid_pre(const struct nf_ct_ext *ext)
-{
- /* if ext->gen_id is not equal to nf_conntrack_ext_genid, some extensions
- * may contain stale pointers to e.g. helper that has been removed.
- *
- * The helper can't clear this because the nf_conn object isn't in
- * any hash and synchronize_rcu() isn't enough because associated skb
- * might sit in a queue.
- */
- return !ext || ext->gen_id == atomic_read(&nf_conntrack_ext_genid);
-}
-
-static bool nf_ct_ext_valid_post(struct nf_ct_ext *ext)
-{
- if (!ext)
- return true;
-
- if (ext->gen_id != atomic_read(&nf_conntrack_ext_genid))
- return false;
-
- /* inserted into conntrack table, nf_ct_iterate_cleanup()
- * will find it. Disable nf_ct_ext_find() id check.
- */
- WRITE_ONCE(ext->gen_id, 0);
- return true;
-}
-
int
nf_conntrack_hash_check_insert(struct nf_conn *ct)
{
@@ -878,9 +851,6 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
zone = nf_ct_zone(ct);
- if (!nf_ct_ext_valid_pre(ct->ext))
- return -EAGAIN;
-
local_bh_disable();
do {
sequence = read_seqcount_begin(&nf_conntrack_generation);
@@ -914,18 +884,6 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
goto chaintoolong;
}
- /* If genid has changed, we can't insert anymore because ct
- * extensions could have stale pointers and nf_ct_iterate_destroy
- * might have completed its table scan already.
- *
- * Increment of the ext genid right after this check is fine:
- * nf_ct_iterate_destroy blocks until locks are released.
- */
- if (!nf_ct_ext_valid_post(ct->ext)) {
- err = -EAGAIN;
- goto out;
- }
-
smp_wmb();
/* The caller holds a reference to this object */
refcount_set(&ct->ct_general.use, 2);
@@ -1207,11 +1165,6 @@ __nf_conntrack_confirm(struct sk_buff *skb)
return NF_DROP;
}
- if (!nf_ct_ext_valid_pre(ct->ext)) {
- NF_CT_STAT_INC(net, insert_failed);
- goto dying;
- }
-
/* We have to check the DYING flag after unlink to prevent
* a race against nf_ct_get_next_corpse() possibly called from
* user context, else we insert an already 'dead' hash, blocking
@@ -1274,16 +1227,6 @@ __nf_conntrack_confirm(struct sk_buff *skb)
nf_conntrack_double_unlock(hash, reply_hash);
local_bh_enable();
- /* ext area is still valid (rcu read lock is held,
- * but will go out of scope soon, we need to remove
- * this conntrack again.
- */
- if (!nf_ct_ext_valid_post(ct->ext)) {
- nf_ct_kill(ct);
- NF_CT_STAT_INC_ATOMIC(net, drop);
- return NF_DROP;
- }
-
help = nfct_help(ct);
if (help && help->helper)
nf_conntrack_event_cache(IPCT_HELPER, ct);
@@ -2493,13 +2436,11 @@ nf_ct_iterate_destroy(int (*iter)(struct nf_conn *i, void *data), void *data)
*/
synchronize_net();
- nf_ct_ext_bump_genid();
iter_data.data = data;
nf_ct_iterate_cleanup(iter, &iter_data);
/* Another cpu might be in a rcu read section with
- * rcu protected pointer cleared in iter callback
- * or hidden via nf_ct_ext_bump_genid() above.
+ * rcu protected pointer cleared in iter callback.
*
* Wait until those are done.
*/
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index dd62cc12e77507..0da105e1ded939 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -27,8 +27,6 @@
#define NF_CT_EXT_PREALLOC 128u /* conntrack events are on by default */
-atomic_t nf_conntrack_ext_genid __read_mostly = ATOMIC_INIT(1);
-
static const u8 nf_ct_ext_type_len[NF_CT_EXT_NUM] = {
[NF_CT_EXT_HELPER] = sizeof(struct nf_conn_help),
#if IS_ENABLED(CONFIG_NF_NAT)
@@ -118,10 +116,8 @@ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
if (!new)
return NULL;
- if (!ct->ext) {
+ if (!ct->ext)
memset(new->offset, 0, sizeof(new->offset));
- new->gen_id = atomic_read(&nf_conntrack_ext_genid);
- }
new->offset[id] = newoff;
new->len = newlen;
@@ -131,29 +127,3 @@ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
return (void *)new + newoff;
}
EXPORT_SYMBOL(nf_ct_ext_add);
-
-/* Use nf_ct_ext_find wrapper. This is only useful for unconfirmed entries. */
-void *__nf_ct_ext_find(const struct nf_ct_ext *ext, u8 id)
-{
- unsigned int gen_id = atomic_read(&nf_conntrack_ext_genid);
- unsigned int this_id = READ_ONCE(ext->gen_id);
-
- if (!__nf_ct_ext_exist(ext, id))
- return NULL;
-
- if (this_id == 0 || ext->gen_id == gen_id)
- return (void *)ext + ext->offset[id];
-
- return NULL;
-}
-EXPORT_SYMBOL(__nf_ct_ext_find);
-
-void nf_ct_ext_bump_genid(void)
-{
- unsigned int value = atomic_inc_return(&nf_conntrack_ext_genid);
-
- if (value == UINT_MAX)
- atomic_set(&nf_conntrack_ext_genid, 1);
-
- msleep(HZ);
-}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0496/1266] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0495/1266] netfilter: conntrack: revert ct extension genid infrastructure Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0497/1266] IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() Greg Kroah-Hartman
` (502 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit b0f02608fbcd607b5131cceb91fc0a035264e61c ]
For GRE flows, validate that the ct master helper (if any) is pptp
before calling nf_ct_gre_keymap_destroy(), so the helper data area
can be accessed safely. Note that only the pptp helper provides a
.destroy callback.
Fixes: e56894356f60 ("netfilter: conntrack: remove l4proto destroy hook")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_core.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 06995cdb36bef9..b086670ec90dd3 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -565,9 +565,23 @@ static void destroy_gre_conntrack(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CT_PROTO_GRE
struct nf_conn *master = ct->master;
+ struct nf_conn_help *help;
+
+ if (!master)
+ return;
+
+ help = nfct_help(master);
+ if (help) {
+ struct nf_conntrack_helper *helper;
- if (master)
- nf_ct_gre_keymap_destroy(master);
+ rcu_read_lock();
+ helper = rcu_dereference(help->helper);
+ /* Only pptp helper has a destroy callback. */
+ if (helper && helper->destroy)
+ nf_ct_gre_keymap_destroy(master);
+
+ rcu_read_unlock();
+ }
#endif
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0497/1266] IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0496/1266] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0498/1266] RDMA/irdma: Fix OOB read during CQ MR registration Greg Kroah-Hartman
` (501 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 9b2207bc5cdb955bdae34b3eec80f04979e17081 ]
Codex pointed out that cm_init_av_by_path() can call cm_set_av_port()
which takes a reference on the cm device, but then can immediately return
error if ib_init_ah_attr_from_path() fails.
Since callers like ib_send_cm_req() put the av on the stack this leaks
that cm device reference.
Re-order cm_init_av_by_path() so it doesn't touch the av until it has done
all its failable work, and then update the av in one shot so it is either
left alone or fully init'd.
Sashiko also pointed out that the cm_destroy_av() prior to
cm_init_av_by_path() is harmful as it leaves the AV broken in the error
case and thus the REJ won't send. Since cm_init_av_by_path() is now atomic
it is safe to delete the cm_destroy_av(). On succees the av from
cm_init_av_for_response() is cleaned up by cm_init_av_by_path(), on
failure the 'goto rejected' guarentees the av is destroyed during
ib_destroy_cm_id().
Fixes: 76039ac9095f ("IB/cm: Protect cm_dev, cm_ports and mad_agent with kref and lock")
Link: https://patch.msgid.link/r/0-v1-38292501f539+14f-ib_cm_av_leak_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cm.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 50bb3c43f40bf6..8d0d77628d9c90 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -514,6 +514,7 @@ static int cm_init_av_by_path(struct sa_path_rec *path,
struct rdma_ah_attr new_ah_attr;
struct cm_device *cm_dev;
struct cm_port *port;
+ u16 pkey_index;
int ret;
port = get_cm_port_from_path(path, sgid_attr);
@@ -522,12 +523,10 @@ static int cm_init_av_by_path(struct sa_path_rec *path,
cm_dev = port->cm_dev;
ret = ib_find_cached_pkey(cm_dev->ib_device, port->port_num,
- be16_to_cpu(path->pkey), &av->pkey_index);
+ be16_to_cpu(path->pkey), &pkey_index);
if (ret)
return ret;
- cm_set_av_port(av, port);
-
/*
* av->ah_attr might be initialized based on wc or during
* request processing time which might have reference to sgid_attr.
@@ -542,6 +541,8 @@ static int cm_init_av_by_path(struct sa_path_rec *path,
if (ret)
return ret;
+ av->pkey_index = pkey_index;
+ cm_set_av_port(av, port);
av->timeout = path->packet_life_time + 1;
rdma_move_ah_attr(&av->ah_attr, &new_ah_attr);
return 0;
@@ -2169,8 +2170,10 @@ static int cm_req_handler(struct cm_work *work)
cm_id_priv->av.ah_attr.roce.dmac);
work->path[0].hop_limit = grh->hop_limit;
- /* This destroy call is needed to pair with cm_init_av_for_response */
- cm_destroy_av(&cm_id_priv->av);
+ /*
+ * cm_init_av_by_path() will internally pair with the above
+ * cm_init_av_for_response() if it succeeds.
+ */
ret = cm_init_av_by_path(&work->path[0], gid_attr, &cm_id_priv->av);
if (ret) {
int err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0498/1266] RDMA/irdma: Fix OOB read during CQ MR registration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0497/1266] IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0499/1266] RDMA/irdma: Initialize iwmr->access during " Greg Kroah-Hartman
` (500 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 4385ddd654d90245eeb83b3cb539670ab5c85ba4 ]
Sashiko pointed out an unrelated bug during a previous patch:
https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com
This change fixes the bug by eliminating the cqmr->split field which
was not being set properly and instead just checks the CQ resize
feature flag directly.
The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE
is set, but it was not being set until CQ creation time, which is _after_
CQ memory registration (the only other place where it is referenced).
As a result, it would always be false during MR registration and would
therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2
HW and beyond:
cqmr->shadow = (dma_addr_t)arr[req->cq_pages];
The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal
to iwmr->page_cnt and therefore equal to the size of arr, which would cause
an OOB read by one.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://patch.msgid.link/r/20260602214423.1315105-2-jmoroni@google.com
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 4 ++--
drivers/infiniband/hw/irdma/verbs.h | 1 -
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 91d5b1b0d6b1b2..6928888b068eaa 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2133,7 +2133,6 @@ static int irdma_create_cq(struct ib_cq *ibcq,
}
cqmr_shadow = &iwpbl_shadow->cq_mr;
info.shadow_area_pa = cqmr_shadow->cq_pbl.addr;
- cqmr->split = true;
} else {
info.shadow_area_pa = cqmr->shadow;
}
@@ -2509,7 +2508,8 @@ static int irdma_handle_q_mem(struct irdma_device *iwdev,
case IRDMA_MEMREG_TYPE_CQ:
hmc_p = &cqmr->cq_pbl;
- if (!cqmr->split)
+ if (!(iwdev->rf->sc_dev.hw_attrs.uk_attrs.feature_flags &
+ IRDMA_FEATURE_CQ_RESIZE))
cqmr->shadow = (dma_addr_t)arr[req->cq_pages];
if (lvl)
diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h
index 97abd45a5cee2e..346c8adebf1cd5 100644
--- a/drivers/infiniband/hw/irdma/verbs.h
+++ b/drivers/infiniband/hw/irdma/verbs.h
@@ -62,7 +62,6 @@ struct irdma_hmc_pble {
struct irdma_cq_mr {
struct irdma_hmc_pble cq_pbl;
dma_addr_t shadow;
- bool split;
};
struct irdma_qp_mr {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0499/1266] RDMA/irdma: Initialize iwmr->access during MR registration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0498/1266] RDMA/irdma: Fix OOB read during CQ MR registration Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0500/1266] arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well Greg Kroah-Hartman
` (499 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 1521d560b7a1a39e437d37fffd9b55435d329ad1 ]
Initialize iwmr->access during initial user mem registration so
that it contains a valid value during a subsequent rereg_mr.
Otherwise, a rereg_mr that doesn't set IB_MR_REREG_ACCESS (for
example, one that only changes the PD) ends up clearing the
access flags in HW since iwmr->access is zero-initialized, which
is not intended.
Fixes: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
Link: https://patch.msgid.link/r/20260604154104.4035581-1-jmoroni@google.com
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 6928888b068eaa..8ffbc790c1681e 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2853,6 +2853,7 @@ static int irdma_reg_user_mr_type_mem(struct irdma_mr *iwmr, int access,
int err;
lvl = iwmr->page_cnt != 1 ? PBLE_LEVEL_1 | PBLE_LEVEL_2 : PBLE_LEVEL_0;
+ iwmr->access = access;
err = irdma_setup_pbles(iwdev->rf, iwmr, lvl);
if (err)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0500/1266] arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0499/1266] RDMA/irdma: Initialize iwmr->access during " Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0501/1266] bpf: Check tail zero of bpf_prog_info Greg Kroah-Hartman
` (498 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Frank Li,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 748835fcb2eb2120234aef9556d282272501b96b ]
With deferrable card binding the sound card driver tries to
get the mclk configuration before it is setup in sai3 node.
Fix this by setting the sai clock config for the audio codec as well.
Fixes: d8f9d8126582 ("arm64: dts: imx8mp: Add analog audio output on i.MX8MP TQMa8MPxL/MBa8MPxL")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts
index 5430b62a3b2827..8dc8d2e12a7aff 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts
+++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts
@@ -473,6 +473,9 @@ tlv320aic3x04: audio-codec@18 {
reset-gpios = <&gpio4 29 GPIO_ACTIVE_LOW>;
iov-supply = <®_vcc_1v8>;
ldoin-supply = <®_vcc_3v3>;
+ assigned-clocks = <&clk IMX8MP_CLK_SAI3>;
+ assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL1_OUT>;
+ assigned-clock-rates = <12288000>;
};
se97_1c: temperature-sensor@1c {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0501/1266] bpf: Check tail zero of bpf_prog_info
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0500/1266] arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0502/1266] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
` (497 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mykyta Yatsenko, Leon Hwang,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit 786be2b05980a5828e67fc564ad7517e2adbe9bd ]
Since there're 4 bytes padding at the end of struct bpf_prog_info, they
won't be checked by bpf_check_uarg_tail_zero().
pahole -C bpf_prog_info ./vmlinux
struct bpf_prog_info {
...
__u32 attach_btf_obj_id; /* 220 4 */
__u32 attach_btf_id; /* 224 4 */
/* size: 232, cachelines: 4, members: 38 */
/* sum members: 224 */
/* sum bitfield members: 1 bits, bit holes: 1, sum bit holes: 31 bits */
/* padding: 4 */
/* forced alignments: 9 */
/* last cacheline: 40 bytes */
} __attribute__((__aligned__(8)));
If a future kernel extension adds a new 4-byte field, older userspace
programs allocating this structure on the stack might inadvertently pass
uninitialized stack garbage into the new field, permanently breaking
backward compatibility. -- sashiko [1]
Fix it by changing sizeof(info) to
offsetofend(struct bpf_prog_info, attach_btf_id).
And, add "__u32 :32" to the tail of struct bpf_prog_info.
[1] https://lore.kernel.org/bpf/20260513224823.6494FC19425@smtp.kernel.org/
Fixes: aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and fdinfo")
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260605155249.20772-3-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/bpf.h | 1 +
kernel/bpf/syscall.c | 5 +++--
tools/include/uapi/linux/bpf.h | 1 +
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 6950169329ef1e..a1e17df7c49ada 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -6460,6 +6460,7 @@ struct bpf_prog_info {
__u32 verified_insns;
__u32 attach_btf_obj_id;
__u32 attach_btf_id;
+ __u32 :32;
} __attribute__((aligned(8)));
struct bpf_map_info {
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 2207f9e7a56742..5fa86a2ab14a6b 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4403,10 +4403,11 @@ static int bpf_prog_get_info_by_fd(struct file *file,
u32 info_len = attr->info.info_len;
struct bpf_prog_kstats stats;
char __user *uinsns;
- u32 ulen;
+ u32 ulen, len;
int err;
- err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
+ len = offsetofend(struct bpf_prog_info, attach_btf_id);
+ err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len);
if (err)
return err;
info_len = min_t(u32, sizeof(info), info_len);
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 8967952de0c2ee..d3b14f18c78f6b 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -6463,6 +6463,7 @@ struct bpf_prog_info {
__u32 verified_insns;
__u32 attach_btf_obj_id;
__u32 attach_btf_id;
+ __u32 :32;
} __attribute__((aligned(8)));
struct bpf_map_info {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0502/1266] bpf: Update transport_header when encapsulating UDP tunnel in lwt
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0501/1266] bpf: Check tail zero of bpf_prog_info Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0503/1266] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Greg Kroah-Hartman
` (496 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Leon Hwang,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit 82d7d0adbc678064543e9d254864f6b4ea4a388c ]
Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
When a driver, e.g. ice, reuses the stale skb->transport_header to
offload checksum computation to NIC hardware, VxLAN packets encapsulated
by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.
Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
encapsulated packet uses UDP, so checksum offload works correctly.
Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: Leon Hwang <leon.huangfu@shopee.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260602150931.49629-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/lwt_bpf.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 4a0797f0a154b2..efbd9eecb00d17 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -590,6 +590,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
{
+ bool is_udp_tunnel;
struct iphdr *iph;
bool ipv4;
int err;
@@ -603,10 +604,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
ipv4 = true;
if (unlikely(len < iph->ihl * 4))
return -EINVAL;
+ is_udp_tunnel = iph->protocol == IPPROTO_UDP;
+ if (unlikely(is_udp_tunnel && len < iph->ihl * 4 + sizeof(struct udphdr)))
+ return -EINVAL;
} else if (iph->version == 6) {
ipv4 = false;
if (unlikely(len < sizeof(struct ipv6hdr)))
return -EINVAL;
+ is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == NEXTHDR_UDP;
+ if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) + sizeof(struct udphdr)))
+ return -EINVAL;
} else {
return -EINVAL;
}
@@ -628,6 +635,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
if (ingress)
skb_postpush_rcsum(skb, iph, len);
skb_reset_network_header(skb);
+ if (is_udp_tunnel) {
+ size_t iph_sz = ipv4 ? iph->ihl * 4 : sizeof(struct ipv6hdr);
+
+ skb_set_transport_header(skb, skb_network_offset(skb) + iph_sz);
+ }
memcpy(skb_network_header(skb), hdr, len);
bpf_compute_data_pointers(skb);
skb_clear_hash(skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0503/1266] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0502/1266] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0504/1266] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
` (495 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Loic Poulain,
Jeff Johnson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 88a240d86d3d64521f9194abe185ac71cc74d0bd ]
The firmware response dispatcher copies all synchronous HAL responses
into the 4096-byte hal_buf without validating the response length. A
response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow
with firmware-controlled content.
Add a bounds check on the response length.
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-2-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 17e1919d1cd828..daab434b19d581 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -3353,6 +3353,10 @@ int wcn36xx_smd_rsp_process(struct rpmsg_device *rpdev,
case WCN36XX_HAL_EXIT_IMPS_RSP:
case WCN36XX_HAL_UPDATE_CHANNEL_LIST_RSP:
case WCN36XX_HAL_ADD_BCN_FILTER_RSP:
+ if (len > WCN36XX_HAL_BUF_SIZE) {
+ wcn36xx_warn("HAL response too large: %d\n", len);
+ break;
+ }
memcpy(wcn->hal_buf, buf, len);
wcn->hal_rsp_len = len;
complete(&wcn->hal_rsp_compl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0504/1266] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0503/1266] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0505/1266] wifi: wcn36xx: fix OOB read from short trigger BA firmware response Greg Kroah-Hartman
` (494 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Loic Poulain,
Jeff Johnson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit df2187acfca6c6cca372c5d35f42394d9c270b09 ]
The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
Fixes: 43efa3c0f241 ("wcn36xx: Implement print_reg indication")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index daab434b19d581..32a0e41c41ca9a 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2865,6 +2865,12 @@ static int wcn36xx_smd_print_reg_info_ind(struct wcn36xx *wcn,
return -EIO;
}
+ if (rsp->count > (len - sizeof(*rsp)) / sizeof(rsp->regs[0])) {
+ wcn36xx_warn("Truncated print reg info indication: count %u, len %zu\n",
+ rsp->count, len);
+ return -EIO;
+ }
+
wcn36xx_dbg(WCN36XX_DBG_HAL,
"reginfo indication, scenario: 0x%x reason: 0x%x\n",
rsp->scenario, rsp->reason);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0505/1266] wifi: wcn36xx: fix OOB read from short trigger BA firmware response
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0504/1266] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0506/1266] ALSA: seq: Fix partial userptr event expansion Greg Kroah-Hartman
` (493 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Loic Poulain,
Jeff Johnson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit b5e6f21923ca89d90256e7346301056f6502691e ]
The firmware response length is only checked against sizeof(*rsp) (20
bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read
at buf + 20 without verifying the response contains it. This causes an
out-of-bounds read of stale heap data, corrupting the BA session state.
Add validation that the response includes the candidate data.
Fixes: 16be1ac55944 ("wcn36xx: Parse trigger_ba response properly")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-4-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 32a0e41c41ca9a..57de3747cbcffa 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2659,6 +2659,9 @@ static int wcn36xx_smd_trigger_ba_rsp(void *buf, int len, struct add_ba_info *ba
if (rsp->candidate_cnt < 1)
return rsp->status ? rsp->status : -EINVAL;
+ if (len < sizeof(*rsp) + sizeof(*candidate))
+ return -EINVAL;
+
candidate = (struct wcn36xx_hal_trigger_ba_rsp_candidate *)(buf + sizeof(*rsp));
for (i = 0; i < STACFG_MAX_TC; i++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0506/1266] ALSA: seq: Fix partial userptr event expansion
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0505/1266] wifi: wcn36xx: fix OOB read from short trigger BA firmware response Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0507/1266] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
` (492 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Takashi Iwai,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 2b7bd6f548292aec92a386deebe62324d21d62a9 ]
snd_seq_expand_var_event_at() clamps the number of bytes to copy to the
remaining variable-event length, but passes the original buffer size to
expand_var_event().
For SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the
size argument from userspace. On the final chunk, when the remaining
event data is shorter than the caller's buffer, this can read past the
declared event data and can spuriously fail with -EFAULT if the extra
bytes cross an unmapped page.
Pass the clamped length instead. The chained and kernel-backed paths
already reclamp in dump_var_event(), but the user-pointer path handles
the size directly.
Fixes: ea46f79709b6 ("ALSA: seq: Add snd_seq_expand_var_event_at() helper")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260606040913.230213-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/seq_memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index a5265789d5544e..85bcf04c74ea39 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -211,7 +211,7 @@ int snd_seq_expand_var_event_at(const struct snd_seq_event *event, int count,
len -= offset;
if (len > count)
len = count;
- err = expand_var_event(event, offset, count, buf, true);
+ err = expand_var_event(event, offset, len, buf, true);
if (err < 0)
return err;
return len;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0507/1266] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0506/1266] ALSA: seq: Fix partial userptr event expansion Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0508/1266] ALSA: seq: Clear variable event pointer on read Greg Kroah-Hartman
` (491 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rui Qi, Paul Walmsley, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Qi <qirui.001@bytedance.com>
[ Upstream commit 8ac35bac70e7e581d673b76878f7691cdadc33b8 ]
In the non-frame-pointer version of walk_stackframe, each value read
from the stack is treated as a potential return address and has 0x4
subtracted before being used as the program counter. This was intended
to convert the return address (the instruction after a call) back to
the call site, but it is incorrect:
1. RISC-V has variable-length instructions due to the RVC (compressed
instruction) extension. A call instruction can be either 4 bytes
(regular) or 2 bytes (compressed, e.g. c.jal). Subtracting a fixed
0x4 assumes all call instructions are 4 bytes, which is wrong for
compressed instructions.
2. Stack traces conventionally report return addresses, not call sites.
Other architectures (ARM64, x86, ARM) do not subtract instruction
size from return addresses in their stack unwinding code.
3. The frame-pointer version of walk_stackframe already dropped the
-0x4 offset. Commit b785ec129bd9 ("riscv/ftrace: Add
HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support") replaced "pc =
frame->ra - 0x4" with ftrace_graph_ret_addr(), and the commit
message explicitly noted that "the original calculation, pc =
frame->ra - 4, is buggy when the instruction at the return address
happened to be a compressed inst." The non-FP version was simply
overlooked.
Remove the bogus -0x4 offset to match the FP version and the
conventions used by other architectures.
Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Link: https://patch.msgid.link/20260603115329.791603-2-qirui.001@bytedance.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/stacktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
index 124ad8fe626fbe..aa0b2f284dca91 100644
--- a/arch/riscv/kernel/stacktrace.c
+++ b/arch/riscv/kernel/stacktrace.c
@@ -129,7 +129,7 @@ void notrace walk_stackframe(struct task_struct *task,
while (!kstack_end(ksp)) {
if (__kernel_text_address(pc) && unlikely(!fn(arg, pc)))
break;
- pc = READ_ONCE_NOCHECK(*ksp++) - 0x4;
+ pc = READ_ONCE_NOCHECK(*ksp++);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0508/1266] ALSA: seq: Clear variable event pointer on read
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0507/1266] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0509/1266] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
` (490 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Takashi Iwai, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
[ Upstream commit 705dd6dcbc0ea87351c660c1a6443f85f1001c76 ]
snd_seq_read() copies a queued variable-length event header to userspace
before expanding the payload. Queued variable-length events use
SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first
extension cell.
The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the
copy, but it leaves data.ext.ptr untouched. A userspace sequencer client
can therefore write a direct variable event to itself and read back the
extension-cell kernel address from the returned header.
Clear the temporary header pointer before copy_to_user(). The original
queued event remains unchanged and is still passed to
snd_seq_expand_var_event(), so payload expansion keeps using the
internal chain.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Link: https://patch.msgid.link/20260607004129.61345-1-kylebot@openai.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/seq_clientmgr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 9d71decaddd69d..1fddeb91c9f46f 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -488,6 +488,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
memcpy(&tmpev, &cell->event, aligned_size);
tmpev.data.ext.len &= ~SNDRV_SEQ_EXT_MASK;
+ tmpev.data.ext.ptr = NULL;
if (copy_to_user(buf, &tmpev, aligned_size)) {
err = -EFAULT;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0509/1266] ACPI: IPMI: Fix message kref handling on dead device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0508/1266] ALSA: seq: Clear variable event pointer on read Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0510/1266] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
` (489 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Rafael J. Wysocki,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 63320db6a5d84ec3fed8b3d36ba5244d07ddd108 ]
acpi_ipmi_space_handler() takes an extra reference on tx_msg before
checking whether the selected IPMI device is dead. The reference
belongs to the tx_msg_list entry and is normally dropped by
ipmi_cancel_tx_msg() or ipmi_flush_tx_msg() after the message is removed
from the list.
On the dead-device path, the message has not been queued yet, but the
error path still calls ipmi_msg_release() directly. That bypasses
kref_put() and frees tx_msg while the queued-message reference is still
recorded in the kref count.
Take the queued-message reference only after the dead-device check
succeeds, immediately before adding tx_msg to the list.
Fixes: 7b9844772237 ("ACPI / IPMI: Add reference counting for ACPI IPMI transfers")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260603163108.2149359-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_ipmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index 0555f68c2dfd68..148d9486106cad 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -545,7 +545,6 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
return AE_TYPE;
}
- acpi_ipmi_msg_get(tx_msg);
mutex_lock(&driver_data.ipmi_lock);
/* Do not add a tx_msg that can not be flushed. */
if (ipmi_device->dead) {
@@ -553,6 +552,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
ipmi_msg_release(tx_msg);
return AE_NOT_EXIST;
}
+ acpi_ipmi_msg_get(tx_msg);
spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0510/1266] cpufreq: Documentation: fix conservative governor freq_step description
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0509/1266] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0511/1266] IB/mlx5: Dont take the rereg_mr fallback without a new translation Greg Kroah-Hartman
` (488 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengjie Zhang, Zhongqiu Han,
Rafael J. Wysocki, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <zhangpengjie2@huawei.com>
[ Upstream commit 03120e1425262c7d11f93362a88e579a1720390b ]
The conservative governor documentation incorrectly states that setting
freq_step to 0 will use the default 5% frequency step. In reality, since
at least commit 8e677ce83bf4 ("[CPUFREQ] conservative: fixup governor to
function more like ondemand logic"), freq_step=0 has always caused the
governor to skip frequency updates entirely.
Correct the documentation to reflect the actual behavior: freq_step=0
disables frequency changes by the governor entirely.
Fixes: 2a0e49279850 ("cpufreq: User/admin documentation update and consolidation")
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/20260603055635.1549943-1-zhangpengjie2@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/pm/cpufreq.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index d2f37309cca3b3..5247eabb92065a 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -569,8 +569,8 @@ This governor exposes the following tunables:
100 (5 by default).
This is how much the frequency is allowed to change in one go. Setting
- it to 0 will cause the default frequency step (5 percent) to be used
- and setting it to 100 effectively causes the governor to periodically
+ it to 0 disables frequency changes by the governor entirely and setting
+ it to 100 effectively causes the governor to periodically
switch the frequency between the ``scaling_min_freq`` and
``scaling_max_freq`` policy limits.
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0511/1266] IB/mlx5: Dont take the rereg_mr fallback without a new translation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0510/1266] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0512/1266] IB/mlx5: Properly support implicit ODP rereg_mr Greg Kroah-Hartman
` (487 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 55d339d200c908de83a408d023cfb7be779b0dd7 ]
Jumping to mlx5_ib_reg_user_mr() without IB_MR_REREG_TRANS set will use
garbage values for start, length, and iova. Recovering the original mr
parameters for ODP and DMABUF to properly recreate it is too hard in this
flow, so just fail it.
Fixes: ef3642c4f54d ("RDMA/mlx5: Fix error unwinds for rereg_mr")
Link: https://patch.msgid.link/r/1-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/mr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 6968092b6a413e..b6727f4647915b 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1721,7 +1721,7 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
}
/* DM or ODP MR's don't have a normal umem so we can't re-use it */
if (!mr->umem || is_odp_mr(mr) || is_dmabuf_mr(mr))
- goto recreate;
+ return ERR_PTR(-EOPNOTSUPP);
/*
* Only one active MR can refer to a umem at one time, revoke
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0512/1266] IB/mlx5: Properly support implicit ODP rereg_mr
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0511/1266] IB/mlx5: Dont take the rereg_mr fallback without a new translation Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0513/1266] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
` (486 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit ee7a8335069150c3f1893a697ab30bbeca00d796 ]
Due to all the child mkeys in the implicit ODP configuration we cannot
change anything in place for the parent mkey. Instead the whole thing
needs to be rebuilt if any change is requested. If the user does not
specify a translation then force the implicit values which will then fall
through the logic into mlx5_ib_reg_user_mr() to allocate a completely new
MR.
Since implicit children were also touching the mr->pd, this removes
another case where the access was racy.
Fixes: ef3642c4f54d ("RDMA/mlx5: Fix error unwinds for rereg_mr")
Link: https://sashiko.dev/#/patchset/20260427-security-bug-fixes-v3-0-4621fa52de0e%40nvidia.com?part=4
Link: https://patch.msgid.link/r/3-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/mr.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index b6727f4647915b..25348f732ac541 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1707,6 +1707,21 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
if (!(flags & IB_MR_REREG_PD))
new_pd = ib_mr->pd;
+ if (mr->is_odp_implicit && !(flags & IB_MR_REREG_TRANS)) {
+ if (!(new_access_flags & IB_ACCESS_ON_DEMAND))
+ return ERR_PTR(-EOPNOTSUPP);
+
+ /*
+ * Due to all the child mkeys we cannot actually change an
+ * implicit MR in place. If the user did not specify a new
+ * translation then force the fixed implicit MR values.
+ */
+ start = 0;
+ iova = 0;
+ length = U64_MAX;
+ flags |= IB_MR_REREG_TRANS;
+ }
+
if (!(flags & IB_MR_REREG_TRANS)) {
struct ib_umem *umem;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0513/1266] spi: ep93xx: fix double-free of zeropage on DMA setup failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0512/1266] IB/mlx5: Properly support implicit ODP rereg_mr Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0514/1266] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
` (485 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 7886054b06f762f62054957a8f6de0f14e6b7541 ]
If DMA setup fails after allocating the zeropage, the error path frees
the page but leaves espi->zeropage dangling. A subsequent call to
ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page
again.
Clear the pointer after freeing in the error path of
ep93xx_spi_setup_dma().
Fixes: 626a96db1169 ("spi/ep93xx: add DMA support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260529-ep93xx-v1-1-9185070ca1fc@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ep93xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index a1d60e51c053e4..22677e37f47e19 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -625,6 +625,7 @@ static int ep93xx_spi_setup_dma(struct ep93xx_spi *espi)
espi->dma_rx = NULL;
fail_free_page:
free_page((unsigned long)espi->zeropage);
+ espi->zeropage = NULL;
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0514/1266] firmware_loader: Fix recursive lock in device_cache_fw_images()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0513/1266] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0515/1266] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
` (484 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e70e4c6f6eee43357ba7,
Dmitry Vyukov, Danilo Krummrich, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <dvyukov@google.com>
[ Upstream commit d3ec78f8f8d48a04a9fac38d47275c34645e5103 ]
A recursive locking deadlock can occur in the firmware loader's power
management notification handler.
During system suspend or hibernation preparation, fw_pm_notify() calls
device_cache_fw_images(). This function acquires fw_lock to set the
firmware cache state to FW_LOADER_START_CACHE and then iterates over all
devices using dpm_for_each_dev() while still holding the lock.
For each device, dev_cache_fw_image() schedules asynchronous work to cache
the firmware. If memory allocation for the async work entry fails (e.g., in
out-of-memory conditions), async_schedule_node_domain() falls back to
executing the work function synchronously in the current thread.
The synchronous execution path (__async_dev_cache_fw_image() ->
cache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire
fw_lock again. Since the current thread already holds fw_lock, this results
in a recursive locking deadlock.
Fix this by releasing fw_lock immediately after updating the cache state
and before calling dpm_for_each_dev(). The lock is only needed to protect
the state update. Concurrent firmware requests will correctly see the
FW_LOADER_START_CACHE state and use the piggyback mechanism, which is
independently protected by its own fwc->name_lock.
Fixes: ac39b3ea73aa ("firmware loader: let caching firmware piggyback on loading firmware")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+e70e4c6f6eee43357ba7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e70e4c6f6eee43357ba7
Link: https://syzkaller.appspot.com/ai_job?id=8b4af9fd-24af-423f-8acb-1159fd34c1a5
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://patch.msgid.link/48b092a5-f49d-48a4-95f4-f65bebfc6bc3@mail.kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/firmware_loader/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index f3133ba831c5e0..4f4614811d0952 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -1506,9 +1506,10 @@ static void device_cache_fw_images(void)
mutex_lock(&fw_lock);
fwc->state = FW_LOADER_START_CACHE;
- dpm_for_each_dev(NULL, dev_cache_fw_image);
mutex_unlock(&fw_lock);
+ dpm_for_each_dev(NULL, dev_cache_fw_image);
+
/* wait for completion of caching firmware for all devices */
async_synchronize_full_domain(&fw_cache_domain);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0515/1266] configfs: fix lockless traversals of ->s_children
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0514/1266] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0516/1266] watchdog: unregister PM notifier on watchdog unregister Greg Kroah-Hartman
` (483 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Al Viro, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 9b9e8bb81c41fd27e7b57a1c936fde140548535f ]
Having the parent directory locked protects entries from removal
by another thread, but it does *not* protect cursors from being
moved around by lseek() - or freed, for that matter.
Fixes: 6f6107640625 ("configfs: Introduce configfs_dirent_lock")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/configfs/dir.c | 54 +++++++++++++++++++++++++++++++++++------------
1 file changed, 41 insertions(+), 13 deletions(-)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index c3fac94f66f212..972fb89ad22140 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -225,15 +225,16 @@ static int configfs_dirent_exists(struct configfs_dirent *parent_sd,
{
struct configfs_dirent * sd;
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
if (sd->s_element) {
- const unsigned char *existing = configfs_get_name(sd);
- if (strcmp(existing, new))
- continue;
- else
+ if (strcmp(configfs_get_name(sd), new) == 0) {
+ spin_unlock(&configfs_dirent_lock);
return -EEXIST;
+ }
}
}
+ spin_unlock(&configfs_dirent_lock);
return 0;
}
@@ -551,11 +552,28 @@ static void configfs_detach_rollback(struct dentry *dentry)
configfs_detach_rollback(sd->s_dentry);
}
+/*
+ * Find the next non-cursor. configfs_dirent_lock held by caller.
+ */
+static struct configfs_dirent *next_dirent(struct configfs_dirent *parent,
+ struct configfs_dirent *last)
+{
+ struct configfs_dirent *s;
+
+ s = list_prepare_entry(last, &parent->s_children, s_sibling);
+
+ list_for_each_entry_continue(s, &parent->s_children, s_sibling) {
+ if (s->s_element)
+ return s;
+ }
+ return NULL;
+}
+
static void detach_attrs(struct config_item * item)
{
struct dentry * dentry = dget(item->ci_dentry);
- struct configfs_dirent * parent_sd;
- struct configfs_dirent * sd, * tmp;
+ struct configfs_dirent *parent_sd;
+ struct configfs_dirent *sd, *next;
if (!dentry)
return;
@@ -564,15 +582,19 @@ static void detach_attrs(struct config_item * item)
dentry->d_name.name);
parent_sd = dentry->d_fsdata;
- list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) {
- if (!sd->s_element || !(sd->s_type & CONFIGFS_NOT_PINNED))
+
+ spin_lock(&configfs_dirent_lock);
+ for (sd = next_dirent(parent_sd, NULL); sd; sd = next) {
+ next = next_dirent(parent_sd, sd);
+ if (!(sd->s_type & CONFIGFS_NOT_PINNED))
continue;
- spin_lock(&configfs_dirent_lock);
list_del_init(&sd->s_sibling);
spin_unlock(&configfs_dirent_lock);
configfs_drop_dentry(sd, dentry);
configfs_put(sd);
+ spin_lock(&configfs_dirent_lock);
}
+ spin_unlock(&configfs_dirent_lock);
/**
* Drop reference from dget() on entrance.
@@ -621,18 +643,20 @@ static void detach_groups(struct config_group *group)
struct dentry * dentry = dget(group->cg_item.ci_dentry);
struct dentry *child;
struct configfs_dirent *parent_sd;
- struct configfs_dirent *sd, *tmp;
+ struct configfs_dirent *sd, *next;
if (!dentry)
return;
parent_sd = dentry->d_fsdata;
- list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) {
- if (!sd->s_element ||
- !(sd->s_type & CONFIGFS_USET_DEFAULT))
+ spin_lock(&configfs_dirent_lock);
+ for (sd = next_dirent(parent_sd, NULL); sd; sd = next) {
+ next = next_dirent(parent_sd, sd);
+ if (!(sd->s_type & CONFIGFS_USET_DEFAULT))
continue;
child = sd->s_dentry;
+ spin_unlock(&configfs_dirent_lock);
inode_lock(d_inode(child));
@@ -644,7 +668,9 @@ static void detach_groups(struct config_group *group)
d_delete(child);
dput(child);
+ spin_lock(&configfs_dirent_lock);
}
+ spin_unlock(&configfs_dirent_lock);
/**
* Drop reference from dget() on entrance.
@@ -1096,6 +1122,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd,
struct configfs_dirent *p;
struct configfs_dirent *ret = NULL;
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(p, &root_sd->s_children, s_sibling) {
if (p->s_type & CONFIGFS_DIR &&
p->s_element == subsys_item) {
@@ -1103,6 +1130,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd,
break;
}
}
+ spin_unlock(&configfs_dirent_lock);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0516/1266] watchdog: unregister PM notifier on watchdog unregister
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0515/1266] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0517/1266] scsi: target: Fix hexadecimal CHAP_I handling Greg Kroah-Hartman
` (482 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Guenter Roeck,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit a298c7302ee9584a7a1ac1e8acbede8d98ab51a4 ]
watchdog_register_device() registers wdd->pm_nb when
WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not
remove it. This leaves an embedded notifier block on the PM notifier chain
after the watchdog device has been unregistered.
A later suspend/resume notification can then call watchdog_pm_notifier()
with a stale watchdog_device pointer, or at minimum after wdd->wd_data has
been cleared by watchdog_dev_unregister().
Unregister the PM notifier before tearing down the watchdog device.
Fixes: 60bcd91aafd2 ("watchdog: introduce watchdog_dev_suspend/resume")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://lore.kernel.org/r/20260601192005.1970805-1-dbgh9129@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/watchdog_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 5b55ccae06d4b0..2d0bb5e4c9c283 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -381,6 +381,9 @@ static void __watchdog_unregister_device(struct watchdog_device *wdd)
if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status))
unregister_reboot_notifier(&wdd->reboot_nb);
+ if (test_bit(WDOG_NO_PING_ON_SUSPEND, &wdd->status))
+ unregister_pm_notifier(&wdd->pm_nb);
+
watchdog_dev_unregister(wdd);
ida_simple_remove(&watchdog_ida, wdd->id);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0517/1266] scsi: target: Fix hexadecimal CHAP_I handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0516/1266] watchdog: unregister PM notifier on watchdog unregister Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0518/1266] scsi: target: Remove tcm_loop target reset handling Greg Kroah-Hartman
` (481 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Disseldorp, Lee Duncan,
John Garry, Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <ddiss@suse.de>
[ Upstream commit 7e161211f1dd5288b4ea802b30e70ef919ebc3da ]
A mutual CHAP handshake requires target processing of an initiator-sent
CHAP_I identifier. The RFC 3720 specification states:
11.1.4. Challenge Handshake Authentication Protocol (CHAP)
...
CHAP_A=<A> CHAP_I=<I> CHAP_C=<C>
...
Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,
Algorithm, Identifier, Challenge, and Response as defined in
[RFC1994], N is a text string, A,A1,A2, and I are numbers
CHAP_I parsing currently calls extract_param(), which returns the
@identifier string (stripped of any 0b/0B or 0x/0X prefix) and a @type
which indicates DECIMAL, HEX, or BASE64 encoding (based on any stripped
prefix).
Any HEX encoded CHAP_I string is further processed via:
ret = kstrtoul(&identifier[2], 0, &id);
This is incorrect for two reasons:
* The @identifier string has already been stripped of the 0x/0X prefix,
so skipping the first two bytes omits part of the number.
* The kstrtoul() call specifies a base of 0, which will see
&identifier[2] parsed as a decimal, unless a '0x' or (octal) '0' is
erroneously present at that offset.
Fix this by passing the (zero-offset) identifier string to kstrtoul()
along with a base=16 parameter. Also add an explicit error handler for
BASE64 encoding.
Hex-encoded CHAP_I handling can be testing using the libiscsi EncodedI
test linked below.
Reported-by: Sashiko (gemini/gemini-3.1-pro-preview)
Link: https://sashiko.dev/#/patchset/20260521151121.808477-1-hossu.alexandru%40gmail.com
Link: https://github.com/sahlberg/libiscsi/pull/473
Fixes: 85db7391310b ("scsi: target: iscsi: Validate CHAP_R length before base64 decode")
Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Link: https://patch.msgid.link/20260605122019.24146-2-ddiss@suse.de
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/iscsi/iscsi_target_auth.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 02a4c9aff98d51..41e4def46ede69 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -437,9 +437,11 @@ static int chap_server_compute_hash(
}
if (type == HEX)
- ret = kstrtoul(&identifier[2], 0, &id);
+ ret = kstrtoul(identifier, 16, &id);
+ else if (type == DECIMAL)
+ ret = kstrtoul(identifier, 10, &id);
else
- ret = kstrtoul(identifier, 0, &id);
+ ret = -EINVAL;
if (ret < 0) {
pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0518/1266] scsi: target: Remove tcm_loop target reset handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0517/1266] scsi: target: Fix hexadecimal CHAP_I handling Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0519/1266] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
` (480 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Christie, Hannes Reinecke,
Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit 7c08d430835a90414cd962e3a9602e5b002dee3b ]
tcm_loop_target_reset is supposed to handle all the LUNs on a target but
it's only doing a TMR_LUN_RESET so only that one LUN is handled. This
will cause us to return early while IOs to other LUNs are still hung in
lower layers. This just removes the target reset handler for the driver
because LIO doesn't support target resets and for the common case where
this is run from the scsi-ml error hamdler we have already tried an
abort and lun reset so waiting again is most likely useless.
Fixes: 1333eee56cdf ("scsi: target: tcm_loop: Drain commands in target_reset handler")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260530052349.5134-1-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/loopback/tcm_loop.c | 64 ------------------------------
1 file changed, 64 deletions(-)
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 72d374c94ce2b3..b6a97a842a7d69 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -268,69 +268,6 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
}
-static bool tcm_loop_flush_work_iter(struct request *rq, void *data)
-{
- struct scsi_cmnd *sc = blk_mq_rq_to_pdu(rq);
- struct tcm_loop_cmd *tl_cmd = scsi_cmd_priv(sc);
- struct se_cmd *se_cmd = &tl_cmd->tl_se_cmd;
-
- flush_work(&se_cmd->work);
- return true;
-}
-
-static int tcm_loop_target_reset(struct scsi_cmnd *sc)
-{
- struct tcm_loop_hba *tl_hba;
- struct tcm_loop_tpg *tl_tpg;
- struct Scsi_Host *sh = sc->device->host;
- int ret;
-
- /*
- * Locate the tcm_loop_hba_t pointer
- */
- tl_hba = *(struct tcm_loop_hba **)shost_priv(sh);
- if (!tl_hba) {
- pr_err("Unable to perform device reset without active I_T Nexus\n");
- return FAILED;
- }
- /*
- * Locate the tl_tpg pointer from TargetID in sc->device->id
- */
- tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
- if (!tl_tpg)
- return FAILED;
-
- /*
- * Issue a LUN_RESET to drain all commands that the target core
- * knows about. This handles commands not yet marked CMD_T_COMPLETE.
- */
- ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, 0, TMR_LUN_RESET);
- if (ret != TMR_FUNCTION_COMPLETE)
- return FAILED;
-
- /*
- * Flush any deferred target core completion work that may still be
- * queued. Commands that already had CMD_T_COMPLETE set before the TMR
- * are skipped by the TMR drain, but their async completion work
- * (transport_lun_remove_cmd → percpu_ref_put, release_cmd → scsi_done)
- * may still be pending in target_completion_wq.
- *
- * The SCSI EH will reuse in-flight scsi_cmnd structures for recovery
- * commands (e.g. TUR) immediately after this handler returns SUCCESS —
- * if deferred work is still pending, the memset in queuecommand would
- * zero the se_cmd while the work accesses it, leaking the LUN
- * percpu_ref and hanging configfs unlink forever.
- *
- * Use blk_mq_tagset_busy_iter() to find all started requests and
- * flush_work() on each — the same pattern used by mpi3mr, scsi_debug,
- * and other SCSI drivers to drain outstanding commands during reset.
- */
- blk_mq_tagset_busy_iter(&sh->tag_set, tcm_loop_flush_work_iter, NULL);
-
- tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;
- return SUCCESS;
-}
-
static const struct scsi_host_template tcm_loop_driver_template = {
.show_info = tcm_loop_show_info,
.proc_name = "tcm_loopback",
@@ -339,7 +276,6 @@ static const struct scsi_host_template tcm_loop_driver_template = {
.change_queue_depth = scsi_change_queue_depth,
.eh_abort_handler = tcm_loop_abort_task,
.eh_device_reset_handler = tcm_loop_device_reset,
- .eh_target_reset_handler = tcm_loop_target_reset,
.this_id = -1,
.sg_tablesize = 256,
.max_sectors = 0xFFFF,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0519/1266] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0518/1266] scsi: target: Remove tcm_loop target reset handling Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0520/1266] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
` (479 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Leonardo Scorcia, Linus Walleij,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <l.scorcia@gmail.com>
[ Upstream commit 1c3044cab23a056ea28da47da1cdd667a39df0b8 ]
The correct Schmitt trigger register offset for pins 34-39 is 0xA00.
Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Fixes: 264667112ef0 ("pinctrl: mediatek: Add MT8516 Pinctrl driver")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-mt8516.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8516.c b/drivers/pinctrl/mediatek/pinctrl-mt8516.c
index 950275c47122bb..43b434ed7d4690 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt8516.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt8516.c
@@ -244,7 +244,7 @@ static const struct mtk_pin_ies_smt_set mt8516_smt_set[] = {
MTK_PIN_IES_SMT_SPEC(24, 25, 0xA00, 12),
MTK_PIN_IES_SMT_SPEC(26, 30, 0xA00, 0),
MTK_PIN_IES_SMT_SPEC(31, 33, 0xA00, 1),
- MTK_PIN_IES_SMT_SPEC(34, 39, 0xA900, 2),
+ MTK_PIN_IES_SMT_SPEC(34, 39, 0xA00, 2),
MTK_PIN_IES_SMT_SPEC(40, 40, 0xA10, 11),
MTK_PIN_IES_SMT_SPEC(41, 43, 0xA00, 10),
MTK_PIN_IES_SMT_SPEC(44, 47, 0xA00, 11),
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0520/1266] pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0519/1266] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0521/1266] vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() Greg Kroah-Hartman
` (478 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Leonardo Scorcia, Linus Walleij,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <l.scorcia@gmail.com>
[ Upstream commit 439bc91d20188901dac698bed4921caac76d9074 ]
The correct Schmitt trigger register offset for pins 34-39 is 0xA00. Value
was verified with SoC data sheet.
Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Fixes: 82d70627e94a ("pinctrl: mediatek: Add MT8167 Pinctrl driver")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-mt8167.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8167.c b/drivers/pinctrl/mediatek/pinctrl-mt8167.c
index ba7f30c3296fec..07148f4a8c008b 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt8167.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt8167.c
@@ -244,7 +244,7 @@ static const struct mtk_pin_ies_smt_set mt8167_smt_set[] = {
MTK_PIN_IES_SMT_SPEC(24, 25, 0xA00, 12),
MTK_PIN_IES_SMT_SPEC(26, 30, 0xA00, 0),
MTK_PIN_IES_SMT_SPEC(31, 33, 0xA00, 1),
- MTK_PIN_IES_SMT_SPEC(34, 39, 0xA900, 2),
+ MTK_PIN_IES_SMT_SPEC(34, 39, 0xA00, 2),
MTK_PIN_IES_SMT_SPEC(40, 40, 0xA10, 11),
MTK_PIN_IES_SMT_SPEC(41, 43, 0xA00, 10),
MTK_PIN_IES_SMT_SPEC(44, 47, 0xA00, 11),
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0521/1266] vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0520/1266] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0522/1266] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
` (477 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Zhu, Dev Jain,
Uladzislau Rezki (Sony), Nicholas Piggin, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Zhu <zhuhui@kylinos.cn>
[ Upstream commit c55dd3b46c1208d6d2ea737a8aefef4aa4c70cb8 ]
find_vm_area() can return NULL if the given address is not a valid vmalloc
area. Check the return value before dereferencing it to avoid a kernel
crash.
Link: https://lore.kernel.org/20260529014130.671291-1-hui.zhu@linux.dev
Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings")
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/vmalloc.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 897f2109f6ada8..5a6ef0ae032a7f 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -209,7 +209,9 @@ static inline bool is_vm_area_hugepages(const void *addr)
* allocated in the vmalloc layer.
*/
#ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC
- return find_vm_area(addr)->page_order > 0;
+ struct vm_struct *area = find_vm_area(addr);
+
+ return area && area->page_order > 0;
#else
return false;
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0522/1266] hwspinlock: qcom: avoid uninitialized struct members
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0521/1266] vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() Greg Kroah-Hartman
@ 2026-07-21 15:15 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0523/1266] sched/fair: Fix cpu_util runnable_avg arithmetic Greg Kroah-Hartman
` (476 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 8752c396ce3b2136b3d4c906fe103f6efb6782d9 ]
The reg_field is allocated on stack, so using the REG_FIELD macro will
ensure that unused members do not have uninitialized values.
Fixes: 19a0f61224d2 ("hwspinlock: qcom: Add support for Qualcomm HW Mutex block")
Link: https://sashiko.dev/#/patchset/20260319105947.6237-1-wsa%2Brenesas%40sang-engineering.com
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260512091339.31085-2-wsa+renesas@sang-engineering.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwspinlock/qcom_hwspinlock.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/hwspinlock/qcom_hwspinlock.c b/drivers/hwspinlock/qcom_hwspinlock.c
index a0fd67fd293444..1daba80c6d6bd7 100644
--- a/drivers/hwspinlock/qcom_hwspinlock.c
+++ b/drivers/hwspinlock/qcom_hwspinlock.c
@@ -178,7 +178,6 @@ static struct regmap *qcom_hwspinlock_probe_mmio(struct platform_device *pdev,
static int qcom_hwspinlock_probe(struct platform_device *pdev)
{
struct hwspinlock_device *bank;
- struct reg_field field;
struct regmap *regmap;
size_t array_size;
u32 stride;
@@ -200,9 +199,7 @@ static int qcom_hwspinlock_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, bank);
for (i = 0; i < QCOM_MUTEX_NUM_LOCKS; i++) {
- field.reg = base + i * stride;
- field.lsb = 0;
- field.msb = 31;
+ struct reg_field field = REG_FIELD(base + i * stride, 0, 31);
bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
regmap, field);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0523/1266] sched/fair: Fix cpu_util runnable_avg arithmetic
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-07-21 15:15 ` [PATCH 6.6 0522/1266] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0524/1266] wifi: mt76: fix argument to ieee80211_is_first_frag() Greg Kroah-Hartman
` (475 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongyan Xia, Peter Zijlstra (Intel),
Vincent Guittot, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xia <hongyan.xia@transsion.com>
[ Upstream commit 29922fdfc2a4008d66418bedd0ebf5038fc54efa ]
If we take runnable_avg in max(runnable_avg, util_avg) in cpu_util(), we
should then add or subtract task runnable_avg, but the arithmetic below
is still with task util_avg. This mixes runnable_avg with util_avg which
is incorrect.
Fix by always doing arithmetic with runnable_avg and only take
max(runnable_avg, util_avg) at the last step.
Fixes: 7d0583cf9ec7 ("sched/fair, cpufreq: Introduce 'runnable boosting'")
Signed-off-by: Hongyan Xia <hongyan.xia@transsion.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://patch.msgid.link/20260605094318.37931-1-hongyan.xia@transsion.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 2fc9fe94d3f1f4..c3a6b66b836c00 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7711,25 +7711,32 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target)
static unsigned long
cpu_util(int cpu, struct task_struct *p, int dst_cpu, int boost)
{
+ bool add_task = p && task_cpu(p) != cpu && dst_cpu == cpu;
+ bool sub_task = p && task_cpu(p) == cpu && dst_cpu != cpu;
struct cfs_rq *cfs_rq = &cpu_rq(cpu)->cfs;
unsigned long util = READ_ONCE(cfs_rq->avg.util_avg);
unsigned long runnable;
- if (boost) {
- runnable = READ_ONCE(cfs_rq->avg.runnable_avg);
- util = max(util, runnable);
- }
-
/*
* If @dst_cpu is -1 or @p migrates from @cpu to @dst_cpu remove its
* contribution. If @p migrates from another CPU to @cpu add its
* contribution. In all the other cases @cpu is not impacted by the
* migration so its util_avg is already correct.
*/
- if (p && task_cpu(p) == cpu && dst_cpu != cpu)
- lsub_positive(&util, task_util(p));
- else if (p && task_cpu(p) != cpu && dst_cpu == cpu)
+ if (add_task)
util += task_util(p);
+ else if (sub_task)
+ lsub_positive(&util, task_util(p));
+
+ if (boost) {
+ runnable = READ_ONCE(cfs_rq->avg.runnable_avg);
+ if (add_task)
+ runnable += READ_ONCE(p->se.avg.runnable_avg);
+ else if (sub_task)
+ lsub_positive(&runnable,
+ READ_ONCE(p->se.avg.runnable_avg));
+ util = max(util, runnable);
+ }
if (sched_feat(UTIL_EST)) {
unsigned long util_est;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0524/1266] wifi: mt76: fix argument to ieee80211_is_first_frag()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0523/1266] sched/fair: Fix cpu_util runnable_avg arithmetic Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0525/1266] wifi: mt76: mt7915: fix potential tx_retries underflow Greg Kroah-Hartman
` (474 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjoern A. Zeeb, Felix Fietkau,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjoern A. Zeeb <bz@FreeBSD.org>
[ Upstream commit 5832743279da8c6ae72f715bad2f7141eca6f4b8 ]
ieee80211_is_first_frag() operates on the seq_ctrl not the frame_control
header field. Pass the correct one in; otherwise the results may vary.
Sponsored by: The FreeBSD Foundation
Fixes: 30ce7f4456ae4 ("mt76: validate rx CCMP PN")
Link: https://cgit.freebsd.org/src/commit/sys/contrib/dev/mediatek/mt76/mac80211.c?id=c67fd35e58c6ee1e19877a7fe5998885683abedc
Signed-off-by: Bjoern A. Zeeb <bz@FreeBSD.org>
Link: https://patch.msgid.link/83s4psnr-popo-8789-757o-npr2n9n7rs2o@SerrOFQ.bet
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index bf4541e76ba228..61543ab7c2560f 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1137,7 +1137,7 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
* All further fragments will be validated by mac80211 only.
*/
if (ieee80211_is_frag(hdr) &&
- !ieee80211_is_first_frag(hdr->frame_control))
+ !ieee80211_is_first_frag(hdr->seq_ctrl))
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0525/1266] wifi: mt76: mt7915: fix potential tx_retries underflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0524/1266] wifi: mt76: fix argument to ieee80211_is_first_frag() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0526/1266] wifi: mt76: mt7921: " Greg Kroah-Hartman
` (473 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ryder Lee, Felix Fietkau,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit 05e72b6167970043348bfbe8f72a3b67a38a9f1c ]
When FIELD_GET returns 0 for the retry count, subtracting 1 causes
an unsigned integer underflow, resulting in tx_retries becoming a
very large value (0xFFFFFFFF for u32).
Fix by checking if count is non-zero before subtracting 1.
Fixes: 943e4fb96e6f ("wifi: mt76: mt7915: report tx retries/failed counts for non-WED path")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Link: https://patch.msgid.link/20260605113306.3485554-1-ryder.lee@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index e2983dbf05a90e..ae91a9815fd22a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -916,16 +916,16 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
}
if (!mtk_wed_device_active(&mdev->mmio.wed) && wcid) {
- u32 tx_retries = 0, tx_failed = 0;
+ u32 tx_retries = 0, tx_failed = 0, count;
if (v3 && (info & MT_TX_FREE_MPDU_HEADER_V3)) {
- tx_retries =
- FIELD_GET(MT_TX_FREE_COUNT_V3, info) - 1;
+ count = FIELD_GET(MT_TX_FREE_COUNT_V3, info);
+ tx_retries = count ? count - 1 : 0;
tx_failed = tx_retries +
!!FIELD_GET(MT_TX_FREE_STAT_V3, info);
} else if (!v3 && (info & MT_TX_FREE_MPDU_HEADER)) {
- tx_retries =
- FIELD_GET(MT_TX_FREE_COUNT, info) - 1;
+ count = FIELD_GET(MT_TX_FREE_COUNT, info);
+ tx_retries = count ? count - 1 : 0;
tx_failed = tx_retries +
!!FIELD_GET(MT_TX_FREE_STAT, info);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0526/1266] wifi: mt76: mt7921: fix potential tx_retries underflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0525/1266] wifi: mt76: mt7915: fix potential tx_retries underflow Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0527/1266] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
` (472 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ryder Lee, Felix Fietkau,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit 3c5671ed81b1fff97fa868dae771690599db94f7 ]
When FIELD_GET returns 0 for the retry count, subtracting 1 causes
an unsigned integer underflow, resulting in tx_retries becoming a
very large value (0xFFFFFFFF for u32).
Fix by checking if count is non-zero before subtracting 1.
Fixes: 9aecfa754c7f ("wifi: mt76: mt7921e: report tx retries/failed counts in tx free event")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Link: https://patch.msgid.link/20260605113306.3485554-2-ryder.lee@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index cd4eee3749226d..5099e6f79448fc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -536,8 +536,9 @@ static void mt7921_mac_tx_free(struct mt792x_dev *dev, void *data, int len)
stat = FIELD_GET(MT_TX_FREE_STATUS, info);
if (wcid) {
- wcid->stats.tx_retries +=
- FIELD_GET(MT_TX_FREE_COUNT, info) - 1;
+ u32 count = FIELD_GET(MT_TX_FREE_COUNT, info);
+
+ wcid->stats.tx_retries += count ? count - 1 : 0;
wcid->stats.tx_failed += !!stat;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0527/1266] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0526/1266] wifi: mt76: mt7921: " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0528/1266] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
` (471 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Boris Burkov,
Qu Wenruo, Filipe Manana, David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae ]
In the beginning of the loop, we try to obtain a locked delayed ref head,
if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(),
which can return an error pointer. If the error pointer is -EAGAIN we do
a continue and go back to the beginning of the loop, which will not try
again to call btrfs_select_ref_head() since 'locked_ref' is no longer
NULL but it's ERR_PTR(-EAGAIN), and then we do:
spin_lock(&locked_ref->lock);
against a ERR_PTR(-EAGAIN) value, generating an invalid pointer
dereference.
Fix this by ensuring that 'locked_ref' is set to NULL when
btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count'
as well, to prevent infinite looping. We do this by doing a goto to the
bottom of the loop that already sets 'locked_ref' to NULL and does a
cond_resched(), with an increment to 'count' right before the goto.
These measures were in place before the refactoring in commit 0110a4c43451
("btrfs: refactor __btrfs_run_delayed_refs loop") but were unintentionally
lost afterwards.
Reported-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/ag8ARRwykv8bpJ87@stanley.mountain/
Fixes: 0110a4c43451 ("btrfs: refactor __btrfs_run_delayed_refs loop")
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index fbeb515e178f35..72d32a254cdb5c 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2061,7 +2061,8 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
locked_ref = btrfs_obtain_ref_head(trans);
if (IS_ERR_OR_NULL(locked_ref)) {
if (PTR_ERR(locked_ref) == -EAGAIN) {
- continue;
+ count++;
+ goto again;
} else {
break;
}
@@ -2109,7 +2110,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
* Either success case or btrfs_run_delayed_refs_for_head
* returned -EAGAIN, meaning we need to select another head
*/
-
+again:
locked_ref = NULL;
cond_resched();
} while ((nr != -1 && count < nr) || locked_ref);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0528/1266] fbdev: sm501fb: Fix buffer errors in OF binding code
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0527/1266] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0529/1266] hwmon: (it87) Clamp negative values to zero in set_fan() Greg Kroah-Hartman
` (470 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Laight, Helge Deller,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Laight <david.laight.linux@gmail.com>
[ Upstream commit d8421e09382cfe0bd2a044c8b0a822f64855dd4e ]
The code that gets the frame buffer mode from OF has 'use after free',
'buffer overrun' and memory leaks.
info->edid_data isn't free if the probe functions fail or if
pd->def_mode is set.
If both the CRT and PANEL are enabled info->edid_data is used after
being freed and is freed twice.
The string returned by of_get_property(np, "mode", &len) is just
written over either the static "640x480-16@60" or the module parameter
string without any regard for the length (which is most likely longer).
Use kstrump() for the OF mode and free everything before freeing 'info.
Fixes: 4295f9bf74a88 ("video, sm501: add OF binding to support SM501")
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sm501fb.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index b9d72f368c6c69..6223f966ea928c 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -95,6 +95,7 @@ struct sm501fb_info {
void __iomem *fbmem; /* remapped framebuffer */
size_t fbmem_len; /* length of remapped region */
u8 *edid_data;
+ char *fb_mode;
};
/* per-framebuffer private data */
@@ -1788,12 +1789,11 @@ static int sm501fb_init_fb(struct fb_info *fb, enum sm501_controller head,
fb->var.yres_virtual = fb->var.yres;
} else {
if (info->edid_data) {
- ret = fb_find_mode(&fb->var, fb, fb_mode,
+ ret = fb_find_mode(&fb->var, fb,
+ info->fb_mode ?: fb_mode,
fb->monspecs.modedb,
fb->monspecs.modedb_len,
&sm501_default_mode, default_bpp);
- /* edid_data is no longer needed, free it */
- kfree(info->edid_data);
} else {
ret = fb_find_mode(&fb->var, fb,
NULL, NULL, 0, NULL, 8);
@@ -1969,7 +1969,7 @@ static int sm501fb_probe(struct platform_device *pdev)
/* Get EDID */
cp = of_get_property(np, "mode", &len);
if (cp)
- strcpy(fb_mode, cp);
+ info->fb_mode = kstrdup(cp, GFP_KERNEL);
prop = of_get_property(np, "edid", &len);
if (prop && len == EDID_LENGTH) {
info->edid_data = kmemdup(prop, EDID_LENGTH,
@@ -2026,6 +2026,12 @@ static int sm501fb_probe(struct platform_device *pdev)
goto err_started_crt;
}
+ /* These aren't needed any more */
+ kfree(info->edid_data);
+ kfree(info->fb_mode);
+ info->edid_data = NULL;
+ info->fb_mode = NULL;
+
/* we registered, return ok */
return 0;
@@ -2043,6 +2049,8 @@ static int sm501fb_probe(struct platform_device *pdev)
framebuffer_release(info->fb[HEAD_CRT]);
err_alloc:
+ kfree(info->edid_data);
+ kfree(info->fb_mode);
kfree(info);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0529/1266] hwmon: (it87) Clamp negative values to zero in set_fan()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0528/1266] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0530/1266] btrfs: zoned: dont account data relocation space-info in statfs free space Greg Kroah-Hartman
` (469 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Guenter Roeck,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 7f8581c70a3bd50a932d3d2d253e99c5ec3eda74 ]
set_fan() parses user input with kstrtol() and passes the resulting
value to FAN16_TO_REG() on chips with 16-bit fan support.
Negative fan speeds are not meaningful and should be rejected before
conversion. Worst scenario, one may be able to abuse undefined
behaviour of signed overflow to possibly induce rpm * 2 == 0 in
FAN16_TO_REG(), thus causing a division by zero.
Instead, clamp val < 0 to zero and keep the conversion in its valid
input domain, avoiding unsafe arithmetic in the register conversion
path.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 17d648bf5786 ("it87: Add support for the IT8716F")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20260529141839.1639287-1-n.zhandarovich@fintech.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/it87.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 51882f7386cc81..716afea0db2400 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -1400,6 +1400,9 @@ static ssize_t set_fan(struct device *dev, struct device_attribute *attr,
if (kstrtol(buf, 10, &val) < 0)
return -EINVAL;
+ if (val < 0)
+ val = 0;
+
err = it87_lock(data);
if (err)
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0530/1266] btrfs: zoned: dont account data relocation space-info in statfs free space
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0529/1266] hwmon: (it87) Clamp negative values to zero in set_fan() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0531/1266] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
` (468 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Naohiro Aota,
Johannes Thumshirn, David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
[ Upstream commit 52416a27aabc43eab3792fd0ca9f5dabeab58f31 ]
Don't account the free space in a data relocation space-info sub-group as
usable free space in statfs.
This is misleading as no user allocations can be made in this space-info
sub-group. It is only a target for relocation.
Fixes: f92ee31e031c ("btrfs: introduce btrfs_space_info sub-group")
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 2045ac3d94c4df..671f1eb26ec658 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2048,7 +2048,8 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
int mixed = 0;
list_for_each_entry(found, &fs_info->space_info, list) {
- if (found->flags & BTRFS_BLOCK_GROUP_DATA) {
+ if (found->flags & BTRFS_BLOCK_GROUP_DATA &&
+ found->subgroup_id != BTRFS_SUB_GROUP_DATA_RELOC) {
int i;
total_free_data += found->disk_total - found->disk_used;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0531/1266] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0530/1266] btrfs: zoned: dont account data relocation space-info in statfs free space Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0532/1266] spi: meson-spifc: fix runtime PM leak on remove Greg Kroah-Hartman
` (467 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit bade9a3150d44ed20b8c6484c4c8a943b7289abb ]
Sashiko noticed mlx4 was using whatever random access flags were provided
when IB_MR_REREG_ACCESS is not used. Since IB_MR_REREG_TRANS needs
access_flags it used the random ones which means it doesn't work sensibly
if userspace provides only IB_MR_REREG_TRANS.
Keep track of the current access_flag of the MR and use it if the user
does not specify one.
Also fixup a little confusion around mmr.access, it is the HW access flags
so the convert_access() was missing. But nothing reads this by the time
rereg_mr can happen.
Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
Link: https://patch.msgid.link/r/0-v1-29ca7a402625+ddd6-mlx4_rereg_flags_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx4/mlx4_ib.h | 1 +
drivers/infiniband/hw/mlx4/mr.c | 9 +++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 41ca1114a9958e..f9eb4d32ad754a 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -137,6 +137,7 @@ struct mlx4_ib_mr {
dma_addr_t page_map;
u32 npages;
u32 max_pages;
+ int access_flags;
struct mlx4_mr mmr;
struct ib_umem *umem;
size_t page_map_size;
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index e331c04967df8d..1f2f924b5c30e4 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -439,6 +439,7 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (err)
goto err_mr;
+ mr->access_flags = access_flags;
mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
mr->ibmr.page_size = 1U << shift;
@@ -499,6 +500,8 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
if (err)
goto release_mpt_entry;
+ } else {
+ mr_access_flags = mmr->access_flags;
}
if (flags & IB_MR_REREG_TRANS) {
@@ -540,8 +543,10 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
* return a failure. But dereg_mr will free the resources.
*/
err = mlx4_mr_hw_write_mpt(dev->dev, &mmr->mmr, pmpt_entry);
- if (!err && flags & IB_MR_REREG_ACCESS)
- mmr->mmr.access = mr_access_flags;
+ if (!err && flags & IB_MR_REREG_ACCESS) {
+ mmr->access_flags = mr_access_flags;
+ mmr->mmr.access = convert_access(mr_access_flags);
+ }
release_mpt_entry:
mlx4_mr_hw_put_mpt(dev->dev, pmpt_entry);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0532/1266] spi: meson-spifc: fix runtime PM leak on remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0531/1266] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0533/1266] ASoC: codecs: aw88261: fix incorrect masks for boost regs Greg Kroah-Hartman
` (466 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 606c0826bd90384a54571c0c5475ca41f50164ea ]
pm_runtime_get_sync() increments the runtime PM usage counter even when it
returns an error. meson_spifc_remove() uses it to resume the controller
before disabling runtime PM, but never drops the usage counter again.
Balance the get with pm_runtime_put_noidle() after disabling runtime PM,
matching the teardown pattern used by other SPI controller drivers.
Found by static analysis. I do not have hardware to test this.
Fixes: c3e4bc5434d2 ("spi: meson: Add support for Amlogic Meson SPIFC")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://patch.msgid.link/20260609052647.5-1-ruoyuw560@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-meson-spifc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c
index 06626f406f6847..fd1f294af02e23 100644
--- a/drivers/spi/spi-meson-spifc.c
+++ b/drivers/spi/spi-meson-spifc.c
@@ -363,6 +363,7 @@ static void meson_spifc_remove(struct platform_device *pdev)
pm_runtime_get_sync(&pdev->dev);
clk_disable_unprepare(spifc->clk);
pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
}
#ifdef CONFIG_PM_SLEEP
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0533/1266] ASoC: codecs: aw88261: fix incorrect masks for boost regs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0532/1266] spi: meson-spifc: fix runtime PM leak on remove Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0534/1266] vduse: hold vduse_lock across IDR lookup in open path Greg Kroah-Hartman
` (465 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Val Packett, Luca Weiss, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 79c053a1ff9d3ab31cefbc791e8d7816ba830491 ]
The boost-related register fields used in aw88261_reg_force_set use the
exact same definitions as the rest of the fields, where the mask must be
inverted when passing it to regmap_update_bits, but they weren't
inverted here.
Fixes: 028a2ae25691 ("ASoC: codecs: Add aw88261 amplifier driver")
Signed-off-by: Val Packett <val@packett.cool>
Tested-by: Luca Weiss <luca.weiss@fairphone.com>
Link: https://patch.msgid.link/20260529200550.529719-7-val@packett.cool
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/aw88261.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sound/soc/codecs/aw88261.c b/sound/soc/codecs/aw88261.c
index f2a9c33ff4a649..eed05b2508dd79 100644
--- a/sound/soc/codecs/aw88261.c
+++ b/sound/soc/codecs/aw88261.c
@@ -284,22 +284,22 @@ static void aw88261_reg_force_set(struct aw88261 *aw88261)
if (aw88261->frcset_en == AW88261_FRCSET_ENABLE) {
/* set FORCE_PWM */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL3_REG,
- AW88261_FORCE_PWM_MASK, AW88261_FORCE_PWM_FORCEMINUS_PWM_VALUE);
+ ~AW88261_FORCE_PWM_MASK, AW88261_FORCE_PWM_FORCEMINUS_PWM_VALUE);
/* set BOOST_OS_WIDTH */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL5_REG,
- AW88261_BST_OS_WIDTH_MASK, AW88261_BST_OS_WIDTH_50NS_VALUE);
+ ~AW88261_BST_OS_WIDTH_MASK, AW88261_BST_OS_WIDTH_50NS_VALUE);
/* set BURST_LOOPR */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL6_REG,
- AW88261_BST_LOOPR_MASK, AW88261_BST_LOOPR_340K_VALUE);
+ ~AW88261_BST_LOOPR_MASK, AW88261_BST_LOOPR_340K_VALUE);
/* set RSQN_DLY */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL7_REG,
- AW88261_RSQN_DLY_MASK, AW88261_RSQN_DLY_35NS_VALUE);
+ ~AW88261_RSQN_DLY_MASK, AW88261_RSQN_DLY_35NS_VALUE);
/* set BURST_SSMODE */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL8_REG,
- AW88261_BURST_SSMODE_MASK, AW88261_BURST_SSMODE_FAST_VALUE);
+ ~AW88261_BURST_SSMODE_MASK, AW88261_BURST_SSMODE_FAST_VALUE);
/* set BST_BURST */
regmap_update_bits(aw88261->regmap, AW88261_BSTCTRL9_REG,
- AW88261_BST_BURST_MASK, AW88261_BST_BURST_30MA_VALUE);
+ ~AW88261_BST_BURST_MASK, AW88261_BST_BURST_30MA_VALUE);
} else {
dev_dbg(aw88261->aw_pa->dev, "needn't set reg value");
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0534/1266] vduse: hold vduse_lock across IDR lookup in open path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0533/1266] ASoC: codecs: aw88261: fix incorrect masks for boost regs Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0535/1266] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
` (464 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qihang Tang, Michael S. Tsirkin,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <q.h.hack.winter@gmail.com>
[ Upstream commit e440e077748939839d9f76e24383b76b785f80ce ]
vduse_dev_open() looks up struct vduse_dev through the IDR and then
acquires dev->lock only after vduse_lock has been dropped.
This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the
same object from the IDR and free it before the open path locks the
device, leading to a use-after-free.
Close this race by keeping vduse_lock held until dev->lock has been
acquired in the open path, matching the lock ordering already used by
the destroy path.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508094659.94647-1-q.h.hack.winter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 21 +++++++--------------
1 file changed, 7 insertions(+), 14 deletions(-)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index d7bda179ef79f8..96edccd80663e1 100644
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -1395,26 +1395,18 @@ static int vduse_dev_release(struct inode *inode, struct file *file)
return 0;
}
-static struct vduse_dev *vduse_dev_get_from_minor(int minor)
+static int vduse_dev_open(struct inode *inode, struct file *file)
{
+ int ret = -EBUSY;
struct vduse_dev *dev;
mutex_lock(&vduse_lock);
- dev = idr_find(&vduse_idr, minor);
- mutex_unlock(&vduse_lock);
-
- return dev;
-}
-
-static int vduse_dev_open(struct inode *inode, struct file *file)
-{
- int ret;
- struct vduse_dev *dev = vduse_dev_get_from_minor(iminor(inode));
-
- if (!dev)
+ dev = idr_find(&vduse_idr, iminor(inode));
+ if (!dev) {
+ mutex_unlock(&vduse_lock);
return -ENODEV;
+ }
- ret = -EBUSY;
mutex_lock(&dev->lock);
if (dev->connected)
goto unlock;
@@ -1424,6 +1416,7 @@ static int vduse_dev_open(struct inode *inode, struct file *file)
file->private_data = dev;
unlock:
mutex_unlock(&dev->lock);
+ mutex_unlock(&vduse_lock);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0535/1266] vhost/vdpa: validate virtqueue index in mmap and fault paths
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0534/1266] vduse: hold vduse_lock across IDR lookup in open path Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0536/1266] vduse: Requeue failed read to send_list head Greg Kroah-Hartman
` (463 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugenio Pérez,
Michael S. Tsirkin, Qihang Tang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <q.h.hack.winter@gmail.com>
[ Upstream commit 929e4f044621c8cc30b612fb74e1410bef09e41b ]
vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a
virtqueue index for get_vq_notification(), but they do not validate
that the index is smaller than v->nvqs.
The ioctl path already performs both a bounds check and
array_index_nospec(), but the mmap/fault path only checks that the
index fits in u16. This allows an out-of-range queue index to reach
driver-specific get_vq_notification() callbacks.
Fix this by extracting a unified vhost_vdpa_get_vq_notification()
helper that validates the queue index against v->nvqs and applies
array_index_nospec() before calling the driver callback. Both the
mmap and fault paths use this helper, and the bounds checking is
consolidated into a single location.
>From source inspection, the most defensible impact is out-of-bounds
access in the callback path, potentially leading to invalid PFN
remaps and crash/DoS.
Fixes: ddd89d0a059d ("vhost_vdpa: support doorbell mapping via mmap")
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508075821.92656-1-q.h.hack.winter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vdpa.c | 29 ++++++++++++++++++++++-------
1 file changed, 22 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index f4da76fa235eae..3645d83f240d9d 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1377,16 +1377,32 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
}
#ifdef CONFIG_MMU
-static vm_fault_t vhost_vdpa_fault(struct vm_fault *vmf)
+static int
+vhost_vdpa_get_vq_notification(struct vhost_vdpa *v, unsigned long index,
+ struct vdpa_notification_area *notify)
{
- struct vhost_vdpa *v = vmf->vma->vm_file->private_data;
struct vdpa_device *vdpa = v->vdpa;
const struct vdpa_config_ops *ops = vdpa->config;
+
+ if (index > 65535 || index >= v->nvqs)
+ return -EINVAL;
+
+ index = array_index_nospec(index, v->nvqs);
+
+ *notify = ops->get_vq_notification(vdpa, index);
+
+ return 0;
+}
+
+static vm_fault_t vhost_vdpa_fault(struct vm_fault *vmf)
+{
+ struct vhost_vdpa *v = vmf->vma->vm_file->private_data;
struct vdpa_notification_area notify;
struct vm_area_struct *vma = vmf->vma;
- u16 index = vma->vm_pgoff;
+ unsigned long index = vma->vm_pgoff;
- notify = ops->get_vq_notification(vdpa, index);
+ if (vhost_vdpa_get_vq_notification(v, index, ¬ify))
+ return VM_FAULT_SIGBUS;
return vmf_insert_pfn(vma, vmf->address & PAGE_MASK, PFN_DOWN(notify.addr));
}
@@ -1409,8 +1425,6 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
return -EINVAL;
if (vma->vm_flags & VM_READ)
return -EINVAL;
- if (index > 65535)
- return -EINVAL;
if (!ops->get_vq_notification)
return -ENOTSUPP;
@@ -1418,7 +1432,8 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
* support the doorbell which sits on the page boundary and
* does not share the page with other registers.
*/
- notify = ops->get_vq_notification(vdpa, index);
+ if (vhost_vdpa_get_vq_notification(v, index, ¬ify))
+ return -EINVAL;
if (notify.addr & (PAGE_SIZE - 1))
return -EINVAL;
if (vma->vm_end - vma->vm_start != notify.size)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0536/1266] vduse: Requeue failed read to send_list head
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0535/1266] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0537/1266] vhost/net: complete zerocopy ubufs only once Greg Kroah-Hartman
` (462 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin, Xie Yongji,
Zhang Tianci, Jason Wang, Eugenio Pérez, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Tianci <zhangtianci.1997@bytedance.com>
[ Upstream commit 373ec43ded742b2f3aecf14731ffe1a57f438f38 ]
When copy_to_iter() fails in vduse_dev_read_iter(), put the message back
at the head of send_list to preserve FIFO ordering and retry the oldest
pending request first.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Suggested-by: Xie Yongji <xieyongji@bytedance.com>
Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260226115550.1814-2-zhangtianci.1997@bytedance.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index 96edccd80663e1..60a63757fcbb58 100644
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -193,6 +193,12 @@ static void vduse_enqueue_msg(struct list_head *head,
list_add_tail(&msg->list, head);
}
+static void vduse_enqueue_msg_head(struct list_head *head,
+ struct vduse_dev_msg *msg)
+{
+ list_add(&msg->list, head);
+}
+
static void vduse_dev_broken(struct vduse_dev *dev)
{
struct vduse_dev_msg *msg, *tmp;
@@ -353,7 +359,7 @@ static ssize_t vduse_dev_read_iter(struct kiocb *iocb, struct iov_iter *to)
spin_lock(&dev->msg_lock);
if (ret != size) {
ret = -EFAULT;
- vduse_enqueue_msg(&dev->send_list, msg);
+ vduse_enqueue_msg_head(&dev->send_list, msg);
goto unlock;
}
vduse_enqueue_msg(&dev->recv_list, msg);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0537/1266] vhost/net: complete zerocopy ubufs only once
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0536/1266] vduse: Requeue failed read to send_list head Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0538/1266] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
` (461 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qing Ming, Michael S. Tsirkin,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Ming <a0yami@mailbox.org>
[ Upstream commit 8f6898fe80794f2d7c3d38c1158c806e4074a1c4 ]
vhost-net initializes one ubuf_info per outstanding zerocopy TX
descriptor and hands it to the backend socket. The networking stack may
then clone a zerocopy skb before all skb references are released. For
example, batman-adv fragmentation reaches skb_split(), which calls
skb_zerocopy_clone() and increments the same ubuf_info refcount.
vhost_zerocopy_complete() currently treats every ubuf callback as a
completed vhost descriptor. It dereferences ubuf->ctx, writes the
descriptor completion state, and drops the vhost_net_ubuf_ref even when
the callback only releases a cloned skb reference. A backend reset can
therefore wait for and free the vhost_net_ubuf_ref while another cloned
skb still carries the same ubuf_info. A later completion then
dereferences the freed ubufs pointer.
KASAN reports the stale completion as:
BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0
BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0
vhost_zerocopy_complete
skb_copy_ubufs
__dev_forward_skb2
veth_xmit
The freed object was allocated from vhost_net_ioctl() while setting the
backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend
removal, while delayed skb completion still reached
vhost_zerocopy_complete().
Honor the generic ubuf_info refcount before touching vhost state, and run
the vhost descriptor completion only for the final ubuf reference. This
matches the msg_zerocopy_complete() ownership rule for cloned zerocopy
skbs.
Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
Signed-off-by: Qing Ming <a0yami@mailbox.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260601104300.197210-1-a0yami@mailbox.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/net.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index b26d9a8e4e0558..2953ab6e0c1d1c 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -390,13 +390,20 @@ static void vhost_zerocopy_signal_used(struct vhost_net *net,
static void vhost_zerocopy_callback(struct sk_buff *skb,
struct ubuf_info *ubuf_base, bool success)
{
- struct ubuf_info_msgzc *ubuf = uarg_to_msgzc(ubuf_base);
- struct vhost_net_ubuf_ref *ubufs = ubuf->ctx;
- struct vhost_virtqueue *vq = ubufs->vq;
+ struct ubuf_info_msgzc *ubuf;
+ struct vhost_net_ubuf_ref *ubufs;
+ struct vhost_virtqueue *vq;
int cnt;
- rcu_read_lock_bh();
+ /* Only the final cloned skb reference completes the vhost descriptor. */
+ if (!refcount_dec_and_test(&ubuf_base->refcnt))
+ return;
+
+ ubuf = uarg_to_msgzc(ubuf_base);
+ ubufs = ubuf->ctx;
+ vq = ubufs->vq;
+ rcu_read_lock_bh();
/* set len to mark this desc buffers done DMA */
vq->heads[ubuf->desc].len = success ?
VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0538/1266] tools/virtio: check mmap return value in vringh_test
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0537/1266] vhost/net: complete zerocopy ubufs only once Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0539/1266] ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() Greg Kroah-Hartman
` (460 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, longlong yan, Michael S. Tsirkin,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: longlong yan <yanlonglong@kylinos.cn>
[ Upstream commit ec6177dfe98b9be1c3ede6c0dfe4394ea2a76959 ]
In parallel_test(), the return values of mmap() for both host_map and
guest_map are not checked against MAP_FAILED. If mmap() fails, the
subsequent code will dereference the invalid pointer, leading to a
segmentation fault.
Add MAP_FAILED checks after both mmap() calls, using err() to report
the error and exit, consistent with the existing error handling style
in this file (e.g., the open() call on line 149).
Fixes: 1515c5ce26ae ("tools/virtio: add vring_test.")
Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260605021446.1611-1-yanlonglong@kylinos.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/virtio/vringh_test.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/virtio/vringh_test.c b/tools/virtio/vringh_test.c
index 98ff808d6f0c2d..16f3723b467129 100644
--- a/tools/virtio/vringh_test.c
+++ b/tools/virtio/vringh_test.c
@@ -159,7 +159,12 @@ static int parallel_test(u64 features,
/* Parent and child use separate addresses, to check our mapping logic! */
host_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
+ if (host_map == MAP_FAILED)
+ err(1, "mmap host_map");
+
guest_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
+ if (guest_map == MAP_FAILED)
+ err(1, "mmap guest_map");
pipe(to_guest);
pipe(to_host);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0539/1266] ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0538/1266] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0540/1266] ASoC: cs35l56: Dont leave parent IRQ disabled if system_suspend fails Greg Kroah-Hartman
` (459 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 85f7bf03632bfcdd6cedfb3945b7e387d9487d73 ]
Call wm_adsp2_remove() in cs35l56_remove() and the error path of
cs35l56_common_probe().
Depends on commit 7d3fb78b5503 ("ASoC: wm_adsp: Fix NULL dereference
when removing firmware controls").
The call to wm_halo_init() during driver probe should be paired with
a call to wm_adsp2_remove() but this was missing. The consequence
would be a memory leak of the control lists in the cs_dsp driver.
Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260610093432.557375-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs35l56.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c
index 015269f0db54cf..15637b60ac2ea1 100644
--- a/sound/soc/codecs/cs35l56.c
+++ b/sound/soc/codecs/cs35l56.c
@@ -1318,11 +1318,14 @@ int cs35l56_common_probe(struct cs35l56_private *cs35l56)
cs35l56_dai, ARRAY_SIZE(cs35l56_dai));
if (ret < 0) {
dev_err_probe(cs35l56->base.dev, ret, "Register codec failed\n");
- goto err;
+ goto err_remove_wm_adsp;
}
return 0;
+err_remove_wm_adsp:
+ wm_adsp2_remove(&cs35l56->dsp);
+
err:
gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0);
regulator_bulk_disable(ARRAY_SIZE(cs35l56->supplies), cs35l56->supplies);
@@ -1420,6 +1423,8 @@ void cs35l56_remove(struct cs35l56_private *cs35l56)
flush_workqueue(cs35l56->dsp_wq);
destroy_workqueue(cs35l56->dsp_wq);
+ wm_adsp2_remove(&cs35l56->dsp);
+
pm_runtime_dont_use_autosuspend(cs35l56->base.dev);
pm_runtime_suspend(cs35l56->base.dev);
pm_runtime_disable(cs35l56->base.dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0540/1266] ASoC: cs35l56: Dont leave parent IRQ disabled if system_suspend fails
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0539/1266] ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0541/1266] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
` (458 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 53cebeb017164254cde5e31c94d8deef9e4fff97 ]
In cs35l56_system_suspend() re-enable the parent IRQ if the call to
pm_runtime_force_suspend() returns an error.
Fixes: f9dc6b875ec0 ("ASoC: cs35l56: Add basic system suspend handling")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260610105556.612830-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs35l56.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c
index 15637b60ac2ea1..832ff2cd3d24e9 100644
--- a/sound/soc/codecs/cs35l56.c
+++ b/sound/soc/codecs/cs35l56.c
@@ -1055,6 +1055,7 @@ static int __maybe_unused cs35l56_runtime_resume_i2c_spi(struct device *dev)
int cs35l56_system_suspend(struct device *dev)
{
struct cs35l56_private *cs35l56 = dev_get_drvdata(dev);
+ int ret;
dev_dbg(dev, "system_suspend\n");
@@ -1070,7 +1071,11 @@ int cs35l56_system_suspend(struct device *dev)
if (cs35l56->base.irq)
disable_irq(cs35l56->base.irq);
- return pm_runtime_force_suspend(dev);
+ ret = pm_runtime_force_suspend(dev);
+ if ((ret < 0) && cs35l56->base.irq)
+ enable_irq(cs35l56->base.irq);
+
+ return ret;
}
EXPORT_SYMBOL_GPL(cs35l56_system_suspend);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0541/1266] bonding: 3ad: fix mux port state on oper down
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0540/1266] ASoC: cs35l56: Dont leave parent IRQ disabled if system_suspend fails Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0542/1266] ext4: fix kernel BUG in ext4_write_inline_data_end Greg Kroah-Hartman
` (457 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis Scalbert, Jay Vosburgh,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Scalbert <louis.scalbert@6wind.com>
[ Upstream commit 807afc7544b865d4d09068a415fd5b71bf5665cc ]
When the bonding interface has carrier down due to the absence of
usable slaves and a slave transitions from down to up, the bonding
interface briefly goes carrier up, then down again, and finally up
once LACP negotiates collecting and distributing on the port.
When lacp_strict mode is on, the interface should not transition to
carrier up until LACP negotiation is complete.
This happens because the actor and partner port states remain in
Collecting_Distributing when the port goes down. When the port
comes back up, it temporarily remains in this state until LACP
renegotiation occurs.
Previously this was mostly cosmetic, but since the bonding carrier
state may depend on the LACP negotiation state, it causes the
interface to flap.
According to IEEE 802.3ad-2000 and IEEE 802.1ax-2014, Collecting and
Distributing should be reset when a port goes down:
- In the Receive state machine, port_enabled == FALSE causes a
transition to the PORT_DISABLED state, which is expected to clear
Partner_Oper_Port_State.Synchronization.
- In the Mux state machine, Partner_Oper_Port_State.Synchronization ==
FALSE causes a transition to the ATTACHED state, which disables
Collecting and Distributing.
However, Partner_Oper_Port_State.Synchronization is not cleared in the
PORT_DISABLED state.
Clear Partner_Oper_Port_State.Synchronization in the Receive
PORT_DISABLED state.
Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20260603150331.1919611-6-louis.scalbert@6wind.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_3ad.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index d1da96f3efd406..447a9e832d8583 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1284,6 +1284,7 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
fallthrough;
case AD_RX_PORT_DISABLED:
port->sm_vars &= ~AD_PORT_MATCHED;
+ port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION;
break;
case AD_RX_LACP_DISABLED:
port->sm_vars &= ~AD_PORT_SELECTED;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0542/1266] ext4: fix kernel BUG in ext4_write_inline_data_end
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0541/1266] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0543/1266] selftests/bpf: Fix bpf_iter/task_vma test Greg Kroah-Hartman
` (456 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0c89d865531d053abb2d,
Aditya Prakash Srivastava, Jan Kara, Theodore Tso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Prakash Srivastava <aditya.ansh182@gmail.com>
[ Upstream commit ad09aa45965d3fafaf9963bc78109b73c0f9ac8d ]
When the data=journal mount option is used, the ext4_journalled_write_end()
function incorrectly calls ext4_write_inline_data_end() without checking
if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode.
If a previous attempt to convert the inline data to an extent failed (e.g.
due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but
the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next
call to ext4_write_begin() will not prepare the inline data xattr for
writing, but ext4_journalled_write_end() will incorrectly attempt to write
to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in
ext4_write_inline_data() since i_inline_size was not expanded.
Fix this by ensuring that ext4_journalled_write_end() only calls
ext4_write_inline_data_end() if the EXT4_STATE_MAY_INLINE_DATA flag is
set, mirroring the behavior of ext4_write_end() and ext4_da_write_end().
Reported-by: syzbot+0c89d865531d053abb2d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0c89d865531d053abb2d
Fixes: 3fdcfb668fd7 ("ext4: add journalled write support for inline data")
Signed-off-by: Aditya Prakash Srivastava <aditya.ansh182@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260608065227.3018-1-aditya.ansh182@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index d72e7f3263eaf9..6a0afec3542bb4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1431,7 +1431,8 @@ static int ext4_journalled_write_end(struct file *file,
BUG_ON(!ext4_handle_valid(handle));
- if (ext4_has_inline_data(inode))
+ if (ext4_has_inline_data(inode) &&
+ ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
return ext4_write_inline_data_end(inode, pos, len, copied,
folio);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0543/1266] selftests/bpf: Fix bpf_iter/task_vma test
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0542/1266] ext4: fix kernel BUG in ext4_write_inline_data_end Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0544/1266] cxl/test: Fix integer overflow in mock LSA bounds checks Greg Kroah-Hartman
` (455 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Leon Hwang,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <yonghong.song@linux.dev>
[ Upstream commit 2e8ad1ff712d2a397e407c9fde60901f68d077dc ]
For selftest bpf_iter/task_vma, I got a failure like below on my qemu run:
test_task_vma_common:FAIL:compare_output unexpected compare_output:
actual
'561593546000-561593585000r--p0000000000:241256579534/root/devshare/bpf-next/tools/testing/selftests/bpf/test_progs'
!= expected
'561593546000-561593585000r--p0000000000:245551546830/root/devshare/bpf-next/tools/testing/selftests/bpf/test_progs'
Further debugging found out file->f_inode->i_ino value may exceed 32bit,
e.g., i_ino = 0x14c2eae35, but the format string is '%u'. This caused
inode mismatch between bpf iter and proc result.
Fix the issue by using format string '%llu' to accommodate 64bit i_ino.
Fixes: e8168840e16c ("selftests/bpf: Add test for bpf_iter_task_vma")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260610051831.1346659-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/progs/bpf_iter_task_vma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_task_vma.c b/tools/testing/selftests/bpf/progs/bpf_iter_task_vma.c
index dd923dc637d5c6..97f7e8d5b6c9d5 100644
--- a/tools/testing/selftests/bpf/progs/bpf_iter_task_vma.c
+++ b/tools/testing/selftests/bpf/progs/bpf_iter_task_vma.c
@@ -52,7 +52,7 @@ SEC("iter/task_vma") int proc_maps(struct bpf_iter__task_vma *ctx)
bpf_d_path(&file->f_path, d_path_buf, D_PATH_BUF_SIZE);
BPF_SEQ_PRINTF(seq, "%08llx ", vma->vm_pgoff << 12);
- BPF_SEQ_PRINTF(seq, "%02x:%02x %u", MAJOR(dev), MINOR(dev),
+ BPF_SEQ_PRINTF(seq, "%02x:%02x %llu", MAJOR(dev), MINOR(dev),
file->f_inode->i_ino);
BPF_SEQ_PRINTF(seq, "\t%s\n", d_path_buf);
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0544/1266] cxl/test: Fix integer overflow in mock LSA bounds checks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0543/1266] selftests/bpf: Fix bpf_iter/task_vma test Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0545/1266] cxl/test: Zero out LSA backing memory to avoid leaking to user Greg Kroah-Hartman
` (454 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alison Schofield, Dave Jiang,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 81eafcada109b653977c4dfbd2b6a72470025a01 ]
Pre-existing issue discovered by sashiko-bot.
mock_get_lsa() and mock_set_lsa() validate the requested LSA range with
"offset + length > LSA_SIZE". Both offset and length are u32 and, in
mock_get_lsa(), both are taken directly from the user-supplied payload.
The addition is evaluated modulo 2^32, so a large offset combined with a
small length wraps around and passes the check.
Rewrite the checks to first bound offset, then compare length against the
remaining LSA size.
Suggested-by: sashiko-bot
Fixes: 7d3eb23c4ccf ("tools/testing/cxl: Introduce a mock memory device + driver")
Link: https://lore.kernel.org/linux-cxl/20260605143748.235271F00893@smtp.kernel.org/
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/cxl/test/mem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/cxl/test/mem.c b/tools/testing/cxl/test/mem.c
index 0ed100617d9937..6d4ffcce326dff 100644
--- a/tools/testing/cxl/test/mem.c
+++ b/tools/testing/cxl/test/mem.c
@@ -940,7 +940,7 @@ static int mock_get_lsa(struct cxl_mockmem_data *mdata,
return -EINVAL;
offset = le32_to_cpu(get_lsa->offset);
length = le32_to_cpu(get_lsa->length);
- if (offset + length > LSA_SIZE)
+ if (offset > LSA_SIZE || length > LSA_SIZE - offset)
return -EINVAL;
if (length > cmd->size_out)
return -EINVAL;
@@ -960,7 +960,7 @@ static int mock_set_lsa(struct cxl_mockmem_data *mdata,
return -EINVAL;
offset = le32_to_cpu(set_lsa->offset);
length = cmd->size_in - sizeof(*set_lsa);
- if (offset + length > LSA_SIZE)
+ if (offset > LSA_SIZE || length > LSA_SIZE - offset)
return -EINVAL;
memcpy(lsa + offset, &set_lsa->data[0], length);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0545/1266] cxl/test: Zero out LSA backing memory to avoid leaking to user
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0544/1266] cxl/test: Fix integer overflow in mock LSA bounds checks Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0546/1266] of: cpu: add check in __of_find_n_match_cpu_property() Greg Kroah-Hartman
` (453 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alison Schofield, Dave Jiang,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit 60f065dbaf46e65830da62a0041761f0c039e086 ]
Memory through vmalloc() is not zeroed out. When this memory is copied
into output payload, it leaks memory content to user. Use vzalloc()
instead to zero out the memory.
Suggested-by: sashiko-bot
Link: https://lore.kernel.org/linux-cxl/20260605173146.2B9A31F00893@smtp.kernel.org/
Fixes: 7d3eb23c4ccf ("tools/testing/cxl: Introduce a mock memory device + driver")
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260605184426.4070913-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/cxl/test/mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/cxl/test/mem.c b/tools/testing/cxl/test/mem.c
index 6d4ffcce326dff..718f943ab3570f 100644
--- a/tools/testing/cxl/test/mem.c
+++ b/tools/testing/cxl/test/mem.c
@@ -1396,7 +1396,7 @@ static int cxl_mock_mem_probe(struct platform_device *pdev)
return -ENOMEM;
dev_set_drvdata(dev, mdata);
- mdata->lsa = vmalloc(LSA_SIZE);
+ mdata->lsa = vzalloc(LSA_SIZE);
if (!mdata->lsa)
return -ENOMEM;
mdata->fw = vmalloc(FW_SIZE);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0546/1266] of: cpu: add check in __of_find_n_match_cpu_property()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0545/1266] cxl/test: Zero out LSA backing memory to avoid leaking to user Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0547/1266] bpf: Tighten cgroup storage cookie checks for prog arrays Greg Kroah-Hartman
` (452 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Shtylyov, Rob Herring (Arm),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
[ Upstream commit 5901eda2ed99ba0d3661da6eb265970559323bb3 ]
In __of_find_n_match_cpu_property(), checking the variable ac for 0 won't
prevent a possible overflow when multiplying it by sizeof(*cell). Besides,
of_read_number() (called in the *for* loop) can't return correct result if
that variable (which equals the #address-cells prop's value) exceeds 2, so
additionally checking for that seems logical...
Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
Fixes: f3cea45a77c8 ("of: Fix iteration bug over CPU reg properties")
Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
Link: https://patch.msgid.link/0c7bf7e9-887c-42d5-bcfb-0ba7fe1e70b6@auroraos.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/cpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/of/cpu.c b/drivers/of/cpu.c
index d17b2f851082cb..8b618e8c5ddf77 100644
--- a/drivers/of/cpu.c
+++ b/drivers/of/cpu.c
@@ -60,7 +60,7 @@ static bool __of_find_n_match_cpu_property(struct device_node *cpun,
cell = of_get_property(cpun, prop_name, &prop_len);
if (!cell && !ac && arch_match_cpu_phys_id(cpu, 0))
return true;
- if (!cell || !ac)
+ if (!cell || !ac || ac > 2)
return false;
prop_len /= sizeof(*cell) * ac;
for (tid = 0; tid < prop_len; tid++) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0547/1266] bpf: Tighten cgroup storage cookie checks for prog arrays
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0546/1266] of: cpu: add check in __of_find_n_match_cpu_property() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0548/1266] s390/process: Fix kernel thread function pointer type Greg Kroah-Hartman
` (451 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Daniel Borkmann,
Yonghong Song, Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 10627ddc0167aab5c1c390a10ef461e9937aba08 ]
The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local
storage") is still incomplete. The prog-array compatibility check
treats a program with no cgroup storage as compatible with any stored
storage cookie. This allows a storage-less program to bridge a tail
call chain between an entry program and a storage-using callee even
though cgroup local storage at runtime still follows the caller's
context, that is, A -> B(no storage) -> C(storage) path.
Requiring exact cookie equality would break the legitimate case of a
storage-less leaf program being tail called from a storage-using one.
Instead, only accept a zero storage cookie if the program cannot
perform tail calls itself. This keeps A -> B(no storage) working
while rejecting the A -> B(no storage) -> C(storage) bridge.
Fixes: abad3d0bad72 ("bpf: Fix oob access in cgroup local storage")
Reported-by: Lin Ma <malin89@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260610105539.705887-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 4669a57265ad75..9fa984ee076bcc 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2365,7 +2365,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
cookie = aux->cgroup_storage[i] ?
aux->cgroup_storage[i]->cookie : 0;
ret = map->owner->storage_cookie[i] == cookie ||
- !cookie;
+ (!cookie && !aux->tail_call_reachable);
}
if (ret &&
map->owner->attach_func_proto != aux->attach_func_proto) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0548/1266] s390/process: Fix kernel thread function pointer type
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0547/1266] bpf: Tighten cgroup storage cookie checks for prog arrays Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0549/1266] Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device Greg Kroah-Hartman
` (450 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Gordeev, Heiko Carstens,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit d0478f5d3cba1095bfdeb43a9b063c10cdebef14 ]
In case of a kernel thread __ret_from_fork() calls the specified function
indirectly. Fix the kernel thread function pointer, since kernel threads
return an int instead of void.
Fixes: 56e62a737028 ("s390: convert to generic entry")
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/process.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 2580004177248b..4055359fd54ffa 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -48,7 +48,7 @@ void ret_from_fork(void) asm("ret_from_fork");
void __ret_from_fork(struct task_struct *prev, struct pt_regs *regs)
{
- void (*func)(void *arg);
+ int (*func)(void *arg);
schedule_tail(prev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0549/1266] Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0548/1266] s390/process: Fix kernel thread function pointer type Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0550/1266] Bluetooth: hci: validate codec capability element length Greg Kroah-Hartman
` (449 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit 6b8cbcf08de0db62254d1981f83db0f94681ccd9 ]
hu->serdev is NULL for hci_uart attached via non-serdev paths, but
qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name,
causing a NULL pointer dereference.
Fix by guarding the dereference with a NULL check and falling back to
"hci_ldisc_qca" for the non-serdev case.
Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_qca.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index ac737ee143614c..2986b18655a150 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1008,7 +1008,7 @@ static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
skb_put_data(skb, buf, strlen(buf));
snprintf(buf, sizeof(buf), "Driver: %s\n",
- hu->serdev->dev.driver->name);
+ hu->serdev ? hu->serdev->dev.driver->name : "hci_ldisc_qca");
skb_put_data(skb, buf, strlen(buf));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0550/1266] Bluetooth: hci: validate codec capability element length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0549/1266] Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0551/1266] Bluetooth: vhci: validate devcoredump state before side effects Greg Kroah-Hartman
` (448 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit c38fbcdc407925c7088f7e5f11c1fff73d2d35a2 ]
Read Local Codec Capabilities returns a sequence of capability elements.
Each element starts with a one-byte length followed by that many payload
bytes.
hci_read_codec_capabilities() checks that the skb contains the length
byte, but then validates only caps->len against the remaining skb
length. A malformed controller response with one remaining byte and
caps->len set to one passes that check even though the element needs two
bytes. The parser then records a two-byte capability and copies one
byte beyond the advertised response payload into the codec list.
Validate the full element size, including the length byte, before adding
it to the accumulated capability length. This preserves all well-formed
capability elements and drops only truncated controller responses.
Fixes: 8961987f3f5f ("Bluetooth: Enumerate local supported codec and cache details")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_codec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_codec.c b/net/bluetooth/hci_codec.c
index 3cc135bb1d30ca..5bc5003c387c66 100644
--- a/net/bluetooth/hci_codec.c
+++ b/net/bluetooth/hci_codec.c
@@ -100,7 +100,7 @@ static void hci_read_codec_capabilities(struct hci_dev *hdev, __u8 transport,
caps = (void *)skb->data;
if (skb->len < sizeof(*caps))
goto error;
- if (skb->len < caps->len)
+ if (skb->len < sizeof(caps->len) + caps->len)
goto error;
len += sizeof(caps->len) + caps->len;
skb_pull(skb, sizeof(caps->len) + caps->len);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0551/1266] Bluetooth: vhci: validate devcoredump state before side effects
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0550/1266] Bluetooth: hci: validate codec capability element length Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0552/1266] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
` (447 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit 88c2404a3c59c3126453919388dbd5ed98ed01bd ]
The VHCI force_devcoredump debugfs hook accepts a small test record from
userspace. It validates the requested terminal state only after
registering, initializing and appending a Bluetooth devcoredump.
As a result, an invalid state returns -EINVAL but still leaves queued
devcoredump work behind. With a non-zero timeout field, the rejected
write can still emit a devcoredump after the timeout expires.
Reject unsupported states before allocating the skb or changing the HCI
devcoredump state machine.
Fixes: ab4e4380d4e1 ("Bluetooth: Add vhci devcoredump support")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_vhci.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 0935045051699f..c0588fe110a2d4 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -337,7 +337,17 @@ static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
if (copy_from_user(&dump_data, user_buf, count))
return -EFAULT;
+ switch (dump_data.state) {
+ case HCI_DEVCOREDUMP_DONE:
+ case HCI_DEVCOREDUMP_ABORT:
+ case HCI_DEVCOREDUMP_TIMEOUT:
+ break;
+ default:
+ return -EINVAL;
+ }
+
data_size = count - offsetof(struct devcoredump_test_data, data);
+
skb = alloc_skb(data_size, GFP_ATOMIC);
if (!skb)
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0552/1266] fs: efs: remove unneeded debug prints
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0551/1266] Bluetooth: vhci: validate devcoredump state before side effects Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0553/1266] RDMA/mlx5: Remove raw RSS QP restrack tracking Greg Kroah-Hartman
` (446 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxwell Doose, Andrew Morton,
Fabian Frederick, Christian Brauner, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
[ Upstream commit 89009392c80da5da00876c8334ff20028e6e3eb6 ]
The current code uses debug prints conditionally compiled with #ifdef
DEBUG. However, that code, when compiled, causes compiler errors due to
incompatible formatters and undefined variables, notably:
fs/efs/file.c: In function `efs_get_block':
fs/efs/file.c:26:35: error: `block' undeclared (first use in this
function); did you mean `iblock'?
26 | __func__, block, inode->i_blocks, inode->i_size);
| ^~~~~
and:
fs/efs/file.c: In function `efs_bmap':
./include/linux/kern_levels.h:5:25: error: format `%ld' expects
argument of type `long int', but argument 4 has type `blkcnt_t' {aka
`long long unsigned int'} [-Werror=format=]
5 | #define KERN_SOH "\001" /* ASCII Start Of Header */
| ^~~~~~
which also extends to the other formatters. As this part of the code has
been dead for just about 14 years now, it has not been modernized to stay
compatible with the most recent gcc compilers. Fix these issues by
removing the debug prints.
Link: https://lore.kernel.org/20260605035251.89305-2-m32285159@gmail.com
Fixes: f403d1dbac6d ("fs/efs: add pr_fmt / use __func__")
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/efs/file.c | 21 +++------------------
1 file changed, 3 insertions(+), 18 deletions(-)
diff --git a/fs/efs/file.c b/fs/efs/file.c
index 9e641da6fab276..9153dfe79bbcc9 100644
--- a/fs/efs/file.c
+++ b/fs/efs/file.c
@@ -18,16 +18,9 @@ int efs_get_block(struct inode *inode, sector_t iblock,
if (create)
return error;
- if (iblock >= inode->i_blocks) {
-#ifdef DEBUG
- /*
- * i have no idea why this happens as often as it does
- */
- pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
- __func__, block, inode->i_blocks, inode->i_size);
-#endif
+ if (iblock >= inode->i_blocks)
return 0;
- }
+
phys = efs_map_block(inode, iblock);
if (phys)
map_bh(bh_result, inode->i_sb, phys);
@@ -42,16 +35,8 @@ int efs_bmap(struct inode *inode, efs_block_t block) {
}
/* are we about to read past the end of a file ? */
- if (!(block < inode->i_blocks)) {
-#ifdef DEBUG
- /*
- * i have no idea why this happens as often as it does
- */
- pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
- __func__, block, inode->i_blocks, inode->i_size);
-#endif
+ if (!(block < inode->i_blocks))
return 0;
- }
return efs_map_block(inode, block);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0553/1266] RDMA/mlx5: Remove raw RSS QP restrack tracking
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0552/1266] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0554/1266] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
` (445 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrisious Haddad, Michael Guralnik,
Edward Srouji, Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <phaddad@nvidia.com>
[ Upstream commit 666031fed8f0fdfc29b20d125a628c1b0a04cdaf ]
Raw RSS QP restrack tracking wasn't working to begin with as it was
only tracking the first raw RSS QP which was added, since at creation
the raw RSS QP number is reserved so the QP number for this qp type
was always zero.
The following raw RSS QP additions were always failing silently.
Since the fix isn't trivial and there were no users that required or
complained about this issue we are dropping this for now instead of fixing.
Fixes: 968f0b6f9c01 ("RDMA/mlx5: Consolidate into special function all create QP calls")
Link: https://patch.msgid.link/r/20260607-restrack-uaf-fix-v1-2-d72e45eb76c2@nvidia.com
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/qp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0a9ae84600b204..df4acd9de4918c 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3090,6 +3090,7 @@ static int create_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
int err;
if (params->is_rss_raw) {
+ rdma_restrack_no_track(&qp->ibqp.res);
err = create_rss_raw_qp_tir(dev, pd, qp, params);
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0554/1266] RDMA/mlx5: Fix undefined shift of user RQ WQE size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0553/1266] RDMA/mlx5: Remove raw RSS QP restrack tracking Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0555/1266] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Greg Kroah-Hartman
` (444 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Edward Srouji,
Jason Gunthorpe, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit d881d60223aac8fdc12b227d89c76e131e92a9cd ]
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on
the user-provided rq_wqe_shift, which is only checked to be greater than
32, so shifts of 32 are still accepted. A shift of 31 also overflows a
signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any
invalid values.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Link: https://patch.msgid.link/r/20260611-maher-sec-fixes-v1-1-cd8eb2542869@nvidia.com
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/qp.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index df4acd9de4918c..6bbf12732051d8 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -451,16 +451,13 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
if (ucmd) {
qp->rq.wqe_cnt = ucmd->rq_wqe_count;
- if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
- return -EINVAL;
qp->rq.wqe_shift = ucmd->rq_wqe_shift;
- if ((1 << qp->rq.wqe_shift) /
- sizeof(struct mlx5_wqe_data_seg) <
- wq_sig)
+ if (check_shl_overflow(1, qp->rq.wqe_shift, &wqe_size))
+ return -EINVAL;
+ if (wqe_size / sizeof(struct mlx5_wqe_data_seg) < wq_sig)
return -EINVAL;
qp->rq.max_gs =
- (1 << qp->rq.wqe_shift) /
- sizeof(struct mlx5_wqe_data_seg) -
+ wqe_size / sizeof(struct mlx5_wqe_data_seg) -
wq_sig;
qp->rq.max_post = qp->rq.wqe_cnt;
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0555/1266] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0554/1266] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0556/1266] ASoC: codecs: hdac_hdmi: Validate written enum value Greg Kroah-Hartman
` (443 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Jason Gunthorpe,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 ]
Free the UAR index returned by the hardware.
Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation")
Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d523bc9052ede3..10422dee6db818 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2282,7 +2282,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd,
if (!dyn_uar)
return err;
- mlx5_cmd_uar_dealloc(dev->mdev, idx, context->devx_uid);
+ mlx5_cmd_uar_dealloc(dev->mdev, uar_index, context->devx_uid);
free_bfreg:
mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0556/1266] ASoC: codecs: hdac_hdmi: Validate written enum value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0555/1266] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0557/1266] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
` (442 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 0b08baeccdcf52fad328ad645f5b4fbee04eea34 ]
hdac_hdmi_set_pin_port_mux() uses the written enum value to index the
texts array before calling snd_soc_dapm_put_enum_double(), which validates
that the value is within the enum item range.
An out-of-range value can therefore make the driver read past the texts
array before the helper rejects the write. Move the lookup after the helper
has accepted the value.
Fixes: 4a3478debf36 ("ASoC: hdac_hdmi: Add jack reporting")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-2-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/hdac_hdmi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 0ddfb0cb376fde..7707f0b5562d4d 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -906,12 +906,14 @@ static int hdac_hdmi_set_pin_port_mux(struct snd_kcontrol *kcontrol,
struct hdac_device *hdev = dev_to_hdac_dev(dapm->dev);
struct hdac_hdmi_priv *hdmi = hdev_to_hdmi_priv(hdev);
struct hdac_hdmi_pcm *pcm;
- const char *cvt_name = e->texts[ucontrol->value.enumerated.item[0]];
+ const char *cvt_name;
ret = snd_soc_dapm_put_enum_double(kcontrol, ucontrol);
if (ret < 0)
return ret;
+ cvt_name = e->texts[ucontrol->value.enumerated.item[0]];
+
if (port == NULL)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0557/1266] ASoC: fsl: fsl_audmix: Validate written enum values
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0556/1266] ASoC: codecs: hdac_hdmi: Validate written enum value Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0558/1266] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
` (441 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 3cd17e4e2871114d5579fa7bc8da66faf7fc1930 ]
fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src()
convert the user-provided enum item with snd_soc_enum_item_to_val()
before checking whether the item is within the enum's item count.
The generic snd_soc_put_enum_double() helper performs that
validation, but these callbacks use the converted value first: the
clock-source path tests it with BIT(), and the output-source path
indexes the prms transition table with it.
Reject out-of-range enum items before converting them.
Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-4-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_audmix.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
index d8e44470f501e7..8bc02ceda13c2b 100644
--- a/sound/soc/fsl/fsl_audmix.c
+++ b/sound/soc/fsl/fsl_audmix.c
@@ -117,6 +117,9 @@ static int fsl_audmix_put_mix_clk_src(struct snd_kcontrol *kcontrol,
unsigned int *item = ucontrol->value.enumerated.item;
unsigned int reg_val, val, mix_clk;
+ if (item[0] >= e->items)
+ return -EINVAL;
+
/* Get current state */
reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
mix_clk = ((reg_val & FSL_AUDMIX_CTR_MIXCLK_MASK)
@@ -157,6 +160,9 @@ static int fsl_audmix_put_out_src(struct snd_kcontrol *kcontrol,
unsigned int reg_val, val, mask = 0, ctr = 0;
int ret;
+ if (item[0] >= e->items)
+ return -EINVAL;
+
/* Get current state */
reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0558/1266] ASoC: tegra: tegra210_ahub: Validate written enum value
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0557/1266] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0559/1266] net/sched: cls_flow: Dont expose folded kernel pointers Greg Kroah-Hartman
` (440 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 1d8aabb413b5638670dfd1162169edc0ba276a2e ]
tegra_ahub_put_value_enum() reads e->values[item[0]] before
checking whether item[0] is within the enum item range. The existing
check therefore happens too late to prevent an out-of-range read of the
values array.
Move the check before the array access.
Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-5-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_ahub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c
index 140cb27f73287e..f7918bcd918d47 100644
--- a/sound/soc/tegra/tegra210_ahub.c
+++ b/sound/soc/tegra/tegra210_ahub.c
@@ -60,13 +60,15 @@ static int tegra_ahub_put_value_enum(struct snd_kcontrol *kctl,
struct soc_enum *e = (struct soc_enum *)kctl->private_value;
struct snd_soc_dapm_update update[TEGRA_XBAR_UPDATE_MAX_REG] = { };
unsigned int *item = uctl->value.enumerated.item;
- unsigned int value = e->values[item[0]];
+ unsigned int value;
unsigned int i, bit_pos, reg_idx = 0, reg_val = 0;
int change = 0;
if (item[0] >= e->items)
return -EINVAL;
+ value = e->values[item[0]];
+
if (value) {
/* Get the register index and value to set */
reg_idx = (value - 1) / (8 * cmpnt->val_bytes);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0559/1266] net/sched: cls_flow: Dont expose folded kernel pointers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0558/1266] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0560/1266] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
` (439 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Victor Nogueira,
Jamal Hadi Salim, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit f294fc71c4a0fa4964f6428a1b4e7929c1d83125 ]
The flow classifier falls back to addr_fold() for fields that are missing
from packet headers. In map mode, userspace controls mask, xor, rshift,
addend and divisor, and can observe the resulting classid through class
statistics. This allows a tc classifier in a user/network namespace to
recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct().
Align with standard kernel practices for pointer hashing and replace the
XOR folding with a keyed siphash (which is cryptographically secure)
Fixes: e5dfb815181f ("[NET_SCHED]: Add flow classifier")
Reported-by: Kyle Zeng <kylebot@openai.com>
Tested-by: Kyle Zeng <kylebot@openai.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260610101839.14135-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_flow.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index d92ffdaf546c39..9ba13953d3a5e6 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -21,6 +21,7 @@
#include <net/inet_sock.h>
#include <net/pkt_cls.h>
+#include <linux/siphash.h>
#include <net/ip.h>
#include <net/route.h>
#include <net/flow_dissector.h>
@@ -57,11 +58,15 @@ struct flow_filter {
struct rcu_work rwork;
};
+static siphash_aligned_key_t flow_keys_secret __read_mostly;
+
static inline u32 addr_fold(void *addr)
{
- unsigned long a = (unsigned long)addr;
-
- return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
+#ifdef CONFIG_64BIT
+ return (u32)siphash_1u64((u64)addr, &flow_keys_secret);
+#else
+ return (u32)siphash_1u32((u32)addr, &flow_keys_secret);
+#endif
}
static u32 flow_get_src(const struct sk_buff *skb, const struct flow_keys *flow)
@@ -596,6 +601,7 @@ static int flow_init(struct tcf_proto *tp)
return -ENOBUFS;
INIT_LIST_HEAD(&head->filters);
rcu_assign_pointer(tp->root, head);
+ net_get_random_once(&flow_keys_secret, sizeof(flow_keys_secret));
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0560/1266] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump().
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0559/1266] net/sched: cls_flow: Dont expose folded kernel pointers Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0561/1266] bridge: cfm: reject invalid CCM interval at configuration time Greg Kroah-Hartman
` (438 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Ido Schimmel,
David Ahern, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 2821e85c058f81c9948a2fb1a634f7b47457d51c ]
rocker_router_fib_event() calls fib_rule_get() during RCU dump.
If the fib_rule is dying, refcount_inc() will complain about it.
Let's call refcount_inc_not_zero() in fib_rules_dump().
Fixes: 5d7bfd141924 ("ipv4: fib_rules: Dump FIB rules when registering FIB notifier")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260610061744.2030996-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/fib_rules.h | 5 +++++
net/core/fib_rules.c | 6 +++++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 82da359bca035d..c47f6f6d3cada6 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -107,6 +107,11 @@ static inline void fib_rule_get(struct fib_rule *rule)
refcount_inc(&rule->refcnt);
}
+static inline bool fib_rule_get_safe(struct fib_rule *rule)
+{
+ return refcount_inc_not_zero(&rule->refcnt);
+}
+
static inline void fib_rule_put(struct fib_rule *rule)
{
if (refcount_dec_and_test(&rule->refcnt))
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 75282222e0b456..e31873c87c0a36 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -328,7 +328,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
if (err != -EAGAIN) {
if ((arg->flags & FIB_LOOKUP_NOREF) ||
- likely(refcount_inc_not_zero(&rule->refcnt))) {
+ likely(fib_rule_get_safe(rule))) {
arg->rule = rule;
goto out;
}
@@ -386,8 +386,12 @@ int fib_rules_dump(struct net *net, struct notifier_block *nb, int family,
if (!ops)
return -EAFNOSUPPORT;
list_for_each_entry_rcu(rule, &ops->rules_list, list) {
+ if (!fib_rule_get_safe(rule))
+ continue;
+
err = call_fib_rule_notifier(nb, FIB_EVENT_RULE_ADD,
rule, family, extack);
+ fib_rule_put(rule);
if (err)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0561/1266] bridge: cfm: reject invalid CCM interval at configuration time
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0560/1266] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0562/1266] sctp: validate embedded address parameter length Greg Kroah-Hartman
` (437 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Nikolay Aleksandrov, Ido Schimmel, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit f3e02edd8322b31b8e6517faa6ba053bf29d1e26 ]
ccm_tx_work_expired() re-arms itself via queue_delayed_work() using
the configured exp_interval converted by interval_to_us(). When
exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,
interval_to_us() returns 0, causing the worker to fire immediately in
a tight loop that allocates skbs until OOM.
Fix this by validating exp_interval at configuration time:
- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range
[BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the
netlink policy so userspace cannot set an invalid value.
- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has
not yet been configured (defaults to 0 from kzalloc).
Fixes: 2be665c3940d ("bridge: cfm: Netlink SET configuration Interface.")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260609065116.2818837-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_cfm.c | 6 ++++++
net/bridge/br_cfm_netlink.c | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_cfm.c b/net/bridge/br_cfm.c
index a3c755d0a09de9..a89aec83141648 100644
--- a/net/bridge/br_cfm.c
+++ b/net/bridge/br_cfm.c
@@ -805,6 +805,12 @@ int br_cfm_cc_ccm_tx(struct net_bridge *br, const u32 instance,
goto save;
}
+ if (!interval_to_us(mep->cc_config.exp_interval)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Invalid CCM interval");
+ return -EINVAL;
+ }
+
/* Start delayed work to transmit CCM frames. It is done with zero delay
* to send first frame immediately
*/
diff --git a/net/bridge/br_cfm_netlink.c b/net/bridge/br_cfm_netlink.c
index 2faab44652e7c0..91b9922dc3f25e 100644
--- a/net/bridge/br_cfm_netlink.c
+++ b/net/bridge/br_cfm_netlink.c
@@ -34,7 +34,9 @@ br_cfm_cc_config_policy[IFLA_BRIDGE_CFM_CC_CONFIG_MAX + 1] = {
[IFLA_BRIDGE_CFM_CC_CONFIG_UNSPEC] = { .type = NLA_REJECT },
[IFLA_BRIDGE_CFM_CC_CONFIG_INSTANCE] = { .type = NLA_U32 },
[IFLA_BRIDGE_CFM_CC_CONFIG_ENABLE] = { .type = NLA_U32 },
- [IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL] = { .type = NLA_U32 },
+ [IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL] =
+ NLA_POLICY_RANGE(NLA_U32, BR_CFM_CCM_INTERVAL_3_3_MS,
+ BR_CFM_CCM_INTERVAL_10_MIN),
[IFLA_BRIDGE_CFM_CC_CONFIG_EXP_MAID] = {
.type = NLA_BINARY, .len = CFM_MAID_LENGTH },
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0562/1266] sctp: validate embedded address parameter length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0561/1266] bridge: cfm: reject invalid CCM interval at configuration time Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0563/1266] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
` (436 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko, Xin Long, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit e9361d0ca55c4af12aac09e2572852fa91046229 ]
sctp_verify_asconf() and sctp_verify_param() only validate ADD_IP, DEL_IP,
and SET_PRIMARY parameters against a fixed minimum size of sizeof(struct
sctp_addip_param) + sizeof(struct sctp_paramhdr). This ensures the outer
parameter is large enough to contain an embedded address parameter header,
but does not verify that the embedded address parameter's declared length
fits within the bounds of the outer parameter.
Later, sctp_process_param() and sctp_process_asconf_param() extract the
embedded address parameter and pass it to af->from_addr_param(), which uses
the address parameter length to parse the variable-length address payload.
A malformed peer can therefore advertise an embedded address parameter
length that exceeds the remaining bytes in the enclosing parameter.
Validate that addr_param->p.length does not exceed the space available
after the sctp_addip_param header before processing the embedded address
parameter. Reject malformed parameters when the embedded address length
extends beyond the enclosing parameter bounds.
This prevents out-of-bounds reads when parsing malformed parameters carried
in INIT or ASCONF processing paths.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: sashiko <sashiko-bot@kernel.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/7838b86b69f52add28808fb59034c8f992e97b2d.1781043268.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/sm_make_chunk.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index eb2ed7db3fe16b..611bddad36d4ac 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2662,6 +2662,9 @@ static int sctp_process_param(struct sctp_association *asoc,
goto fall_through;
addr_param = param.v + sizeof(struct sctp_addip_param);
+ if (ntohs(addr_param->p.length) >
+ ntohs(param.p->length) - sizeof(struct sctp_addip_param))
+ break;
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
if (!af)
@@ -3060,13 +3063,16 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
union sctp_addr addr;
struct sctp_af *af;
- addr_param = (void *)asconf_param + sizeof(*asconf_param);
-
if (asconf_param->param_hdr.type != SCTP_PARAM_ADD_IP &&
asconf_param->param_hdr.type != SCTP_PARAM_DEL_IP &&
asconf_param->param_hdr.type != SCTP_PARAM_SET_PRIMARY)
return SCTP_ERROR_UNKNOWN_PARAM;
+ addr_param = (void *)asconf_param + sizeof(*asconf_param);
+ if (ntohs(addr_param->p.length) >
+ ntohs(asconf_param->param_hdr.length) - sizeof(*asconf_param))
+ return SCTP_ERROR_PROTO_VIOLATION;
+
switch (addr_param->p.type) {
case SCTP_PARAM_IPV6_ADDRESS:
if (!asoc->peer.ipv6_address)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0563/1266] net/sched: sch_hfsc: Dont make class passive twice
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0562/1266] sctp: validate embedded address parameter length Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0564/1266] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
` (435 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anirudh Gupta, Jamal Hadi Salim,
Victor Nogueira, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 90b662ea25f5e83bb3b8ccec5b93ced810b92fb8 ]
update_vf() is called from two places for the same class during a single
dequeue when the class's child qdisc (e.g. codel/fq_codel) drops its last
packets while dequeuing:
1. The child calls qdisc_tree_reduce_backlog(), which, now that the child
is empty, invokes hfsc_qlen_notify() -> update_vf(cl, 0, 0) and turns
the class passive (cl_nactive is decremented up the hierarchy).
2. hfsc_dequeue() then calls update_vf(cl, qdisc_pkt_len(skb), cur_time)
to charge the dequeued bytes.
On the second call the class is already passive, but its child qdisc is
still empty, so update_vf() arms go_passive again:
if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC)
go_passive = 1;
The leaf is then skipped by the cl_nactive == 0 check inside the loop,
which does not clear go_passive, so the stale go_passive propagates to the
parent and decrements its cl_nactive a second time. A parent that still
has other active children is driven to cl_nactive == 0 and removed from
the vttree, even though those siblings are still backlogged. They are
never dequeued again and the qdisc stalls.
Fix this by only arming go_passive when the class is actually active, so an
already-passive class no longer triggers a second passive transition. The
byte accounting (cl->cl_total += len) still runs for every ancestor, so
dequeued bytes continue to be counted exactly once.
Fixes: 51eb3b65544c ("sch_hfsc: make hfsc_qlen_notify() idempotent")
Reported-by: Anirudh Gupta <anirudhrudr@gmail.com>
Closes: https://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Tested-by: Anirudh Gupta <anirudhrudr@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610132824.3027549-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 11ae998cda3a85..71f96a8980a7cd 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -753,7 +753,7 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time)
u64 f; /* , myf_bound, delta; */
int go_passive = 0;
- if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC)
+ if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC && cl->cl_nactive)
go_passive = 1;
for (; cl->cl_parent != NULL; cl = cl->cl_parent) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0564/1266] tipc: require net admin for TIPCv2 netlink mutators
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0563/1266] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0565/1266] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
` (434 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Tung Nguyen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 86b0c540e2ea397cde021eecd24145f7c16a3d4e ]
TIPCv2 registers mutating generic-netlink operations without admin
permission flags. Generic netlink only checks CAP_NET_ADMIN when an
operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local
unprivileged process can currently change TIPC state through commands
such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and
bearer enable/disable.
The legacy TIPC netlink API already checks netlink_net_capable(...,
CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators
the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which
maps to the same namespace-aware CAP_NET_ADMIN check that
netlink_net_capable() performs, so the behaviour matches the legacy
path and keeps working for CAP_NET_ADMIN holders in a non-initial user
namespace (containers).
A QEMU/KASAN repro run as uid/gid 65534 with zero effective
capabilities previously succeeded in changing the network id and node
identity, setting and flushing key material, and enabling/disabling a
UDP bearer. With this patch applied the same operations fail with
-EPERM.
Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api")
Link: https://lore.kernel.org/all/20260604163102.2658553-1-dominik.czarnota@trailofbits.com/
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260610124003.3831170-2-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/netlink.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 1a9a5bdaccf4fc..8336a9664703fe 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -152,11 +152,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_BEARER_DISABLE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_disable,
},
{
.cmd = TIPC_NL_BEARER_ENABLE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_enable,
},
{
@@ -168,11 +170,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_BEARER_ADD,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_add,
},
{
.cmd = TIPC_NL_BEARER_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_set,
},
{
@@ -197,11 +201,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_LINK_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_link,
},
{
.cmd = TIPC_NL_LINK_RESET_STATS,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_reset_link_stats,
},
{
@@ -213,6 +219,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_MEDIA_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_media_set,
},
{
@@ -228,6 +235,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_NET_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_net_set,
},
{
@@ -238,6 +246,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_MON_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_monitor,
},
{
@@ -255,6 +264,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_PEER_REMOVE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_peer_rm,
},
#ifdef CONFIG_TIPC_MEDIA_UDP
@@ -269,11 +279,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_KEY_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_key,
},
{
.cmd = TIPC_NL_KEY_FLUSH,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_flush_key,
},
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0565/1266] tipc: prevent snt_unacked underflow on CONN_ACK
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0564/1266] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0566/1266] tipc: reject inverted service ranges from peer bindings Greg Kroah-Hartman
` (433 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Tung Nguyen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit ab3e10b44ba5411779aac7afd2477917dd77750f ]
tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count
from the unsigned 16-bit send counter snt_unacked without checking that it
does not exceed the number of messages actually outstanding:
tsk->snt_unacked -= msg_conn_ack(hdr);
msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK
message. If the ack count is larger than snt_unacked, the subtraction
wraps to a near-maximum value, leaving tsk_conn_cong() permanently true
and starving the connection of further transmits.
Validate the ACK count at the start of the CONN_ACK block and drop the
message if it acknowledges more messages than are outstanding. A peer (or,
for a local connection, the connected peer socket) can otherwise wedge a
TIPC connection's send side by sending an oversized connection ack.
Fixes: 10724cc7bb78 ("tipc: redesign connection-level flow control")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260610124003.3831170-3-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/socket.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e5931e56ef094e..31c6b61f0b0fd9 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1367,6 +1367,9 @@ static void tipc_sk_conn_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
__skb_queue_tail(xmitq, skb);
return;
} else if (mtyp == CONN_ACK) {
+ if (tsk->snt_unacked < msg_conn_ack(hdr))
+ goto exit;
+
was_cong = tsk_conn_cong(tsk);
tipc_sk_push_backlog(tsk, msg_nagle_ack(hdr));
tsk->snt_unacked -= msg_conn_ack(hdr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0566/1266] tipc: reject inverted service ranges from peer bindings
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0565/1266] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0567/1266] cxl/test: Add check after kzalloc() memory in alloc_mock_res() Greg Kroah-Hartman
` (432 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Tung Nguyen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 2afb648f7b99216c687db1f89739c995e1144153 ]
tipc_update_nametbl() inserts a binding advertised by a peer node using
the lower and upper service-range bounds taken directly from the wire,
without checking that lower <= upper. The local bind path validates the
ordering (tipc_uaddr_valid()), but the name-distribution path does not.
A binding with lower > upper is inserted at the far end of the
service-range rbtree (keyed on lower) where no lookup or withdrawal can
ever match it (service_range_foreach_match() requires sr->lower <= end).
The publication, its service_range node and the augmented rbtree entry
are then leaked for the lifetime of the namespace, and there is no
per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.
Reject inverted ranges in the network path as well. A peer node can
otherwise leak unbounded binding-table memory by sending PUBLICATION
items with lower > upper.
Fixes: 37922ea4a310 ("tipc: permit overlapping service ranges in name table")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260610124003.3831170-4-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/name_distr.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 190b49c5cbc3ec..ba4f4906e13b70 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -280,12 +280,21 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
u32 node, u32 dtype)
{
struct publication *p = NULL;
+ u32 lower = ntohl(i->lower);
+ u32 upper = ntohl(i->upper);
struct tipc_socket_addr sk;
- struct tipc_uaddr ua;
u32 key = ntohl(i->key);
+ struct tipc_uaddr ua;
+
+ /* A peer-advertised binding with lower > upper can never be matched
+ * or withdrawn and would leak the publication; the local bind path
+ * rejects such ranges, so reject ranges learned from the network too.
+ */
+ if (lower > upper)
+ return false;
tipc_uaddr(&ua, TIPC_SERVICE_RANGE, TIPC_CLUSTER_SCOPE,
- ntohl(i->type), ntohl(i->lower), ntohl(i->upper));
+ ntohl(i->type), lower, upper);
sk.ref = ntohl(i->port);
sk.node = node;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0567/1266] cxl/test: Add check after kzalloc() memory in alloc_mock_res()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0566/1266] tipc: reject inverted service ranges from peer bindings Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0568/1266] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
` (431 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alison Schofield, Dave Jiang,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit dfe28c8592538152e9611341dae6f7be1735b3f1 ]
alloc_mock_res() calls kzalloc() without checking the return value.
Add scope based resource management to deal with the allocated memory
cleanly.
Reported-by: sashiko-bot
Fixes: 67dcdd4d3b83 ("tools/testing/cxl: Introduce a mocked-up CXL port hierarchy")
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260611230305.197390-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/cxl/test/cxl.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
index ed1361c8b96c48..0bb93bff74be0f 100644
--- a/tools/testing/cxl/test/cxl.c
+++ b/tools/testing/cxl/test/cxl.c
@@ -396,12 +396,16 @@ static void depopulate_all_mock_resources(void)
static struct cxl_mock_res *alloc_mock_res(resource_size_t size, int align)
{
- struct cxl_mock_res *res = kzalloc(sizeof(*res), GFP_KERNEL);
struct genpool_data_align data = {
.align = align,
};
unsigned long phys;
+ struct cxl_mock_res *res __free(kfree) = kzalloc(sizeof(*res),
+ GFP_KERNEL);
+ if (!res)
+ return NULL;
+
INIT_LIST_HEAD(&res->list);
phys = gen_pool_alloc_algo(cxl_mock_pool, size,
gen_pool_first_fit_align, &data);
@@ -416,7 +420,7 @@ static struct cxl_mock_res *alloc_mock_res(resource_size_t size, int align)
list_add(&res->list, &mock_res);
mutex_unlock(&mock_res_lock);
- return res;
+ return no_free_ptr(res);
}
static int populate_cedt(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0568/1266] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0567/1266] cxl/test: Add check after kzalloc() memory in alloc_mock_res() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0569/1266] crypto: cavium/cpt " Greg Kroah-Hartman
` (430 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 7891c64c0520519782470ba29bac8a5761e295d8 ]
The sg_cleanup path used list[i] instead of list[j] when unmapping DMA
buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c b/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
index c80baf1ad90b2f..89030e2711ce41 100644
--- a/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
+++ b/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
@@ -157,8 +157,8 @@ static inline int setup_sgio_components(struct pci_dev *pdev,
sg_cleanup:
for (j = 0; j < i; j++) {
if (list[j].dma_addr) {
- dma_unmap_single(&pdev->dev, list[i].dma_addr,
- list[i].size, DMA_BIDIRECTIONAL);
+ dma_unmap_single(&pdev->dev, list[j].dma_addr,
+ list[j].size, DMA_BIDIRECTIONAL);
}
list[j].dma_addr = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0569/1266] crypto: cavium/cpt - fix DMA cleanup using wrong loop index
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0568/1266] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0570/1266] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
` (429 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 9dbf173bd32d5f81b005008b682bfb50aa093455 ]
The sg_cleanup error path used list[i] instead of list[j] when unmapping
DMA buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
index 153004bdfb5cde..753bdb2ae33f8d 100644
--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
+++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
@@ -108,8 +108,8 @@ static int setup_sgio_components(struct cpt_vf *cptvf, struct buf_ptr *list,
sg_cleanup:
for (j = 0; j < i; j++) {
if (list[j].dma_addr) {
- dma_unmap_single(&pdev->dev, list[i].dma_addr,
- list[i].size, DMA_BIDIRECTIONAL);
+ dma_unmap_single(&pdev->dev, list[j].dma_addr,
+ list[j].size, DMA_BIDIRECTIONAL);
}
list[j].dma_addr = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0570/1266] crypto: rng - Free default RNG on module exit
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0569/1266] crypto: cavium/cpt " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0571/1266] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
` (428 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 606ba888b98e0d26a2c4e5c8dc0542e3ad8f0f3a ]
When the rng module is removed the default RNG will be leaked.
Call crypto_del_default_rng to free it if possible.
Fixes: 7cecadb7cca8 ("crypto: rng - Do not free default RNG when it becomes unused")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/rng.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/crypto/rng.c b/crypto/rng.c
index e462031fef68c6..c49115a5b2668d 100644
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -259,5 +259,16 @@ void crypto_unregister_rngs(struct rng_alg *algs, int count)
}
EXPORT_SYMBOL_GPL(crypto_unregister_rngs);
+static void __exit rng_exit(void)
+{
+ int err;
+
+ err = crypto_del_default_rng();
+ if (err)
+ pr_err("Failed delete default RNG: %d\n", err);
+}
+
+module_exit(rng_exit);
+
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Random Number Generator");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0571/1266] spi: xilinx: use FIFO occupancy register to determine buffer size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0570/1266] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0572/1266] ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO Greg Kroah-Hartman
` (427 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars Pöschel, Michal Simek,
Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars Pöschel <lars.poeschel@edag.com>
[ Upstream commit 47f3b5365536e8c38f264824ab15fdb74454e066 ]
The method the driver uses to determine the size of the FIFO has a
problem. What it currently does is this:
It stops the SPI hardware and writes to the TX FIFO register until TX
FIFO FULL asserts in the status register. But the hardware does not only
have the FIFO, it also has a shift register which can hold a byte. This
can be seen, when writing a byte to the FIFO (while the SPI hardware is
stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size
of 16 for example, the current method returns a 17.
This is a problem, at least when using the driver in irq mode. The same
size determined for the TX FIFO is also assumed for the RX FIFO. When a
SPI transaction wants to write the amount of the FIFO size or more
bytes, the following happens, for example with 16 bytes FIFO size:
The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and
starts the SPI hardware and goes sleep.
The hardware then shifts out 17 bytes (FIFO + shift register) and
simultaneously reads bytes into the RX FIFO, but it only has 16 places,
so it looses one byte. Then TX FIFO empty asserts, wakes the driver
again, which has a fast path and reads 16 bytes from the RX FIFO, but
before reading the last 17th byte (which is lost) it does this:
sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
xilinx_spi_rx(xspi);
rx_words--;
}
It reads the status register and checks if the RX FIFO is not empty.
But it is empty in our case. So this check spins in a while loop
forever locking the driver.
This patch fixes the logic to determine the FIFO size.
Fixes: 4c9a761402d7 ("spi/xilinx: Simplify spi_fill_tx_fifo")
Signed-off-by: Lars Pöschel <lars.poeschel@edag.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260612105244.9076-1-lars.poeschel.linux@edag.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-xilinx.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index b5405d9974ba6b..36362bee7fff81 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -370,11 +370,18 @@ static int xilinx_spi_find_buffer_size(struct xilinx_spi *xspi)
xspi->regs + XIPIF_V123B_RESETR_OFFSET);
/* Fill the Tx FIFO with as many words as possible */
- do {
+ while (1) {
xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+ if (sr & XSPI_SR_TX_FULL_MASK)
+ break;
+
n_words++;
- } while (!(sr & XSPI_SR_TX_FULL_MASK));
+ }
+
+ /* Handle the NO FIFO case separately */
+ if (!n_words)
+ return 1;
return n_words;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0572/1266] ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0571/1266] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0573/1266] power: supply: core: fix supplied_from allocations Greg Kroah-Hartman
` (426 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 69b4141b428bcf2cf7a863950c0d6e5c5ae89ac1 ]
The PLL lock failure path in adau1372_set_power() unwinds by putting
the regmap back in cache-only mode, asserting the optional power-down
GPIO and disabling mclk.
adau1372_enable_pll() enables CLK_CTRL.PLL_EN before polling the PLL
lock bit. If the lock fails on a board without a power-down GPIO, the
error path disables mclk and returns an error, but leaves PLL_EN set in
the hardware register. The normal power-off path already handles the
no-GPIO case by explicitly clearing PLL_EN.
Mirror that cleanup in the PLL lock failure path and clear PLL_EN while
the regmap is still live, before switching it back to cache-only mode.
Fixes: bfe6a264effc ("ASoC: adau1372: Fix clock leak on PLL lock failure")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260604125520.1428905-1-lgs201920130244@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/adau1372.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/soc/codecs/adau1372.c b/sound/soc/codecs/adau1372.c
index 25f123110b5be4..7dc0b5c79e3998 100644
--- a/sound/soc/codecs/adau1372.c
+++ b/sound/soc/codecs/adau1372.c
@@ -812,6 +812,11 @@ static int adau1372_set_power(struct adau1372 *adau1372, bool enable)
if (adau1372->use_pll) {
ret = adau1372_enable_pll(adau1372);
if (ret) {
+ if (!adau1372->pd_gpio)
+ regmap_update_bits(adau1372->regmap,
+ ADAU1372_REG_CLK_CTRL,
+ ADAU1372_CLK_CTRL_PLL_EN,
+ 0);
regcache_cache_only(adau1372->regmap, true);
if (adau1372->pd_gpio)
gpiod_set_value(adau1372->pd_gpio, 1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0573/1266] power: supply: core: fix supplied_from allocations
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0572/1266] ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0574/1266] handshake: Require admin permission for DONE command Greg Kroah-Hartman
` (425 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Tsai, Sebastian Reichel,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Tsai <lucas_tsai@richtek.com>
[ Upstream commit ba61aed9a34671222d1149acfc2f0179a9ce7e80 ]
If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.
Fixes: f6e0b081fb30 ("power_supply: Populate supplied_from hierarchy from the device tree")
Signed-off-by: Lucas Tsai <lucas_tsai@richtek.com>
Link: https://patch.msgid.link/20260609114403.3896073-1-lucas_tsai@richtek.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/power_supply_core.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 1893d37dd575de..4f350db05efa09 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -262,18 +262,13 @@ static int power_supply_check_supplies(struct power_supply *psy)
if (cnt == 1)
return 0;
- /* All supplies found, allocate char ** array for filling */
- psy->supplied_from = devm_kzalloc(&psy->dev, sizeof(*psy->supplied_from),
+ /* All supplies found, allocate char * array for filling */
+ psy->supplied_from = devm_kcalloc(&psy->dev,
+ cnt - 1, sizeof(*psy->supplied_from),
GFP_KERNEL);
if (!psy->supplied_from)
return -ENOMEM;
- *psy->supplied_from = devm_kcalloc(&psy->dev,
- cnt - 1, sizeof(**psy->supplied_from),
- GFP_KERNEL);
- if (!*psy->supplied_from)
- return -ENOMEM;
-
return power_supply_populate_supplied_from(psy);
}
#else
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0574/1266] handshake: Require admin permission for DONE command
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0573/1266] power: supply: core: fix supplied_from allocations Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0575/1266] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
` (424 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Layton, Hannes Reinecke,
Chuck Lever, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 81246a65303d9635266b1334490142caaf86a11f ]
ACCEPT and DONE are the two downcalls of the handshake genl
family, both intended for use by the trusted handshake agent
(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has
no privilege check at all.
The fd-lookup in handshake_nl_done_doit() only confirms that
some pending handshake request exists for the supplied sockfd;
it does not authenticate the sender. An unprivileged process
that guesses or observes a valid sockfd can therefore submit
a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel
consumer to proceed as if the handshake succeeded. A non-zero
status on a forged DONE tears down a legitimate in-flight
handshake before tlshd can report its real result.
Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://patch.msgid.link/20260609141831.90694-1-cel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/netlink/specs/handshake.yaml | 1 +
net/handshake/genl.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/Documentation/netlink/specs/handshake.yaml b/Documentation/netlink/specs/handshake.yaml
index 6d89e30f5fd52b..0888c39ec2bcd0 100644
--- a/Documentation/netlink/specs/handshake.yaml
+++ b/Documentation/netlink/specs/handshake.yaml
@@ -113,6 +113,7 @@ operations:
name: done
doc: Handler reports handshake completion
attribute-set: done
+ flags: [admin-perm]
do:
request:
attributes:
diff --git a/net/handshake/genl.c b/net/handshake/genl.c
index 233be5cbfec91a..8fdec426e580a0 100644
--- a/net/handshake/genl.c
+++ b/net/handshake/genl.c
@@ -36,7 +36,7 @@ static const struct genl_split_ops handshake_nl_ops[] = {
.doit = handshake_nl_done_doit,
.policy = handshake_done_nl_policy,
.maxattr = HANDSHAKE_A_DONE_REMOTE_AUTH,
- .flags = GENL_CMD_CAP_DO,
+ .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
},
};
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0575/1266] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0574/1266] handshake: Require admin permission for DONE command Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0576/1266] net/sched: sch_codel: " Greg Kroah-Hartman
` (423 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anirudh Gupta, Jamal Hadi Salim,
Victor Nogueira, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 097f6fc7b1ae362dd7a9444b2572162fda73b284 ]
Whenever fq_codel drops packets during peek, it calls
qdisc_tree_reduce_backlog. An issue arises because it calls
qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops
to zero, but peek returns an skb, the parent's qlen_notify callback will be
executed even though fq_codel still has 1 packet on the queue and, thus,
will mistakenly deactivate the parent's class causing issues like a recent
report [1] and a wild memory access in qfq:
[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full)
[ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216
[ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000
[ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000
[ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024
[ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000
[ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578
[ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000
[ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0
[ 29.376103][ T360] PKRU: 55555554
[ 29.376258][ T360] Call Trace:
[ 29.376401][ T360] <TASK>
...
[ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057)
[ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the
qlen is restored.
[1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Fixes: 342debc12183 ("codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()")
Reported-by: Anirudh Gupta <anirudhrudr@gmail.com>
Closes: https://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Tested-by: Anirudh Gupta <anirudhrudr@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610192855.3121513-2-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_fq_codel.c | 41 ++++++++++++++++++++++++++++++++++++++--
1 file changed, 39 insertions(+), 2 deletions(-)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 056895df178541..e059d6c145741b 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -278,7 +278,7 @@ static void drop_func(struct sk_buff *skb, void *ctx)
qdisc_qstats_drop(sch);
}
-static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+static struct sk_buff *__fq_codel_dequeue(struct Qdisc *sch)
{
struct fq_codel_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
@@ -315,12 +315,49 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
qdisc_bstats_update(sch, skb);
flow->deficit -= qdisc_pkt_len(skb);
+ return skb;
+}
+
+static void fq_codel_dequeue_drop(struct Qdisc *sch)
+{
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+
if (q->cstats.drop_count) {
qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
q->cstats.drop_len);
q->cstats.drop_count = 0;
q->cstats.drop_len = 0;
}
+}
+
+static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+
+ skb = __fq_codel_dequeue(sch);
+
+ fq_codel_dequeue_drop(sch);
+
+ return skb;
+}
+
+static struct sk_buff *fq_codel_peek(struct Qdisc *sch)
+{
+ struct sk_buff *skb = skb_peek(&sch->gso_skb);
+
+ if (!skb) {
+ skb = __fq_codel_dequeue(sch);
+
+ if (skb) {
+ __skb_queue_head(&sch->gso_skb, skb);
+ /* it's still part of the queue */
+ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ }
+
+ fq_codel_dequeue_drop(sch);
+ }
+
return skb;
}
@@ -707,7 +744,7 @@ static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
.priv_size = sizeof(struct fq_codel_sched_data),
.enqueue = fq_codel_enqueue,
.dequeue = fq_codel_dequeue,
- .peek = qdisc_peek_dequeued,
+ .peek = fq_codel_peek,
.init = fq_codel_init,
.reset = fq_codel_reset,
.destroy = fq_codel_destroy,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0576/1266] net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0575/1266] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0577/1266] net: mana: initialize gdma queue id to INVALID_QUEUE_ID Greg Kroah-Hartman
` (422 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Victor Nogueira,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3 ]
Whenever codel drops packets during peek, it calls
qdisc_tree_reduce_backlog. An issue arises because it calls
qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops
to zero, but peek returns an skb, the parent's qlen_notify callback will
be executed even though codel still has 1 packet on the queue and, thus,
will mistakenly deactivate the parent's class causing issues like a wild
memory access when qfq has codel as a child:
[ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full)
[ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 36.341357][ T370] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216
[ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000
[ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000
[ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024
[ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000
[ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578
[ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000
[ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0
[ 36.344359][ T370] PKRU: 55555554
[ 36.344481][ T370] Call Trace:
...
[ 36.345054][ T370] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 36.345222][ T370] qdisc_reset (net/sched/sch_generic.c:1057)
[ 36.345503][ T370] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 36.345677][ T370] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 36.346335][ T370] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the
qlen is restored.
Fixes: 342debc12183 ("codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610192855.3121513-3-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_codel.c | 48 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 43 insertions(+), 5 deletions(-)
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 63c02040b426ae..0dfdc8b6569955 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -86,7 +86,7 @@ static void drop_func(struct sk_buff *skb, void *ctx)
qdisc_qstats_drop(sch);
}
-static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+static struct sk_buff *__codel_qdisc_dequeue(struct Qdisc *sch)
{
struct codel_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
@@ -95,13 +95,51 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
&q->stats, qdisc_pkt_len, codel_get_enqueue_time,
drop_func, dequeue_func);
+ if (skb)
+ qdisc_bstats_update(sch, skb);
+ return skb;
+}
+
+static void codel_dequeue_drop(struct Qdisc *sch)
+{
+ struct codel_sched_data *q = qdisc_priv(sch);
+
if (q->stats.drop_count) {
- qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
+ qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
+ q->stats.drop_len);
q->stats.drop_count = 0;
q->stats.drop_len = 0;
}
- if (skb)
- qdisc_bstats_update(sch, skb);
+}
+
+static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+
+ skb = __codel_qdisc_dequeue(sch);
+
+ codel_dequeue_drop(sch);
+
+ return skb;
+}
+
+static struct sk_buff *codel_peek(struct Qdisc *sch)
+{
+ struct sk_buff *skb = skb_peek(&sch->gso_skb);
+
+ if (!skb) {
+ skb = __codel_qdisc_dequeue(sch);
+
+ if (skb) {
+ __skb_queue_head(&sch->gso_skb, skb);
+ /* it's still part of the queue */
+ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ }
+
+ codel_dequeue_drop(sch);
+ }
+
return skb;
}
@@ -276,7 +314,7 @@ static struct Qdisc_ops codel_qdisc_ops __read_mostly = {
.enqueue = codel_qdisc_enqueue,
.dequeue = codel_qdisc_dequeue,
- .peek = qdisc_peek_dequeued,
+ .peek = codel_peek,
.init = codel_init,
.reset = codel_reset,
.change = codel_change,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0577/1266] net: mana: initialize gdma queue id to INVALID_QUEUE_ID
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0576/1266] net/sched: sch_codel: " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0578/1266] net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check Greg Kroah-Hartman
` (421 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Garg, Dipayaan Roy,
Haiyang Zhang, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <gargaditya@linux.microsoft.com>
[ Upstream commit 5985474e1cb4034680fac2145497a94b0860be50 ]
mana_gd_create_mana_wq_cq() leaves queue->id as 0 (from kzalloc_obj())
until mana_create_wq_obj() assigns the firmware-returned id. If creation
fails before that, cleanup calls mana_gd_destroy_cq() with id 0, NULLing
gc->cq_table[0] and silently breaking whichever real CQ owns that slot.
Initialize queue->id to INVALID_QUEUE_ID right after allocation, matching
mana_gd_create_eq(). The existing (id >= max_num_cqs) guard then
short-circuits cleanly.
Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com>
Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Link: https://patch.msgid.link/20260608101345.2267320-2-gargaditya@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
index d3c9a3020fbf6e..8a91b056931fa9 100644
--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
@@ -840,6 +840,8 @@ int mana_gd_create_mana_wq_cq(struct gdma_dev *gd,
if (!queue)
return -ENOMEM;
+ queue->id = INVALID_QUEUE_ID;
+
gmi = &queue->mem_info;
err = mana_gd_alloc_memory(gc, spec->queue_size, gmi);
if (err)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0578/1266] net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0577/1266] net: mana: initialize gdma queue id to INVALID_QUEUE_ID Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0579/1266] bpf: Run generic devmap egress prog on private skb Greg Kroah-Hartman
` (420 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Garg, Dipayaan Roy,
Haiyang Zhang, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <gargaditya@linux.microsoft.com>
[ Upstream commit f8fd56977eeea3d6939b1a9cd8bd36f1779b3ad0 ]
mana_create_txq() has several error paths (after mana_alloc_queues() or
mana_create_wq_obj() failure) where tx_qp[i].tx_object stays as the
INVALID_MANA_HANDLE sentinel set at allocation. mana_destroy_txq() then
unconditionally calls mana_destroy_wq_obj() with (u64)-1, which firmware
rejects and logs an error.
Mirror the RX-side pattern in mana_destroy_rxq() and skip the destroy
when the handle is still INVALID_MANA_HANDLE.
Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com>
Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Link: https://patch.msgid.link/20260608101345.2267320-3-gargaditya@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microsoft/mana/mana_en.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index 3cf4ad1d91f67e..0249ba7e3b92cd 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -1880,7 +1880,8 @@ static void mana_destroy_txq(struct mana_port_context *apc)
netif_napi_del(napi);
apc->tx_qp[i].txq.napi_initialized = false;
}
- mana_destroy_wq_obj(apc, GDMA_SQ, apc->tx_qp[i].tx_object);
+ if (apc->tx_qp[i].tx_object != INVALID_MANA_HANDLE)
+ mana_destroy_wq_obj(apc, GDMA_SQ, apc->tx_qp[i].tx_object);
mana_deinit_cq(apc, &apc->tx_qp[i].tx_cq);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0579/1266] bpf: Run generic devmap egress prog on private skb
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0578/1266] net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0580/1266] net/mlx5: Check max_macs devlink param value against max capability Greg Kroah-Hartman
` (419 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Jakub Kicinski,
Toke Høiland-Jørgensen, Sun Jian, Alexei Starovoitov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun Jian <sun.jian.kdev@gmail.com>
[ Upstream commit 6001896f00984d317fb75160ba05c4a885fbe2a0 ]
Generic XDP devmap multi redirect uses skb_clone() for intermediate
destinations and sends the last destination with the original skb. This
can leave multiple destinations sharing the same packet data.
This becomes visible after generic devmap egress-program support was
added: a devmap egress program may mutate packet data, and another
destination sharing the same data can observe that mutation.
Native XDP broadcast redirect does not have this issue because
xdpf_clone() copies the frame data for each destination. Generic XDP
should provide the same per-destination isolation before running a
devmap egress program.
Fix this by making cloned skbs private before running the generic devmap
egress program. Use skb_copy() instead of skb_unshare() so allocation
failure does not consume the skb and the existing caller error paths keep
their ownership semantics.
Fixes: 2ea5eabaf04a ("bpf: devmap: Implement devmap prog execution for generic XDP")
Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://lore.kernel.org/r/20260612114032.244616-2-sun.jian.kdev@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/devmap.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 3f710d5af55d4b..8ce3b152dcd5b9 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -687,6 +687,18 @@ int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
if (unlikely(err))
return err;
+ if (dst->xdp_prog && skb_cloned(skb)) {
+ struct sk_buff *nskb;
+
+ nskb = skb_copy(skb, GFP_ATOMIC);
+ if (!nskb)
+ return -ENOMEM;
+
+ nskb->mac_len = skb->mac_len;
+ consume_skb(skb);
+ skb = nskb;
+ }
+
/* Redirect has already succeeded semantically at this point, so we just
* return 0 even if packet is dropped. Helper below takes care of
* freeing skb.
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0580/1266] net/mlx5: Check max_macs devlink param value against max capability
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0579/1266] bpf: Run generic devmap egress prog on private skb Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0581/1266] net: wwan: t7xx: check skb_clone in control TX Greg Kroah-Hartman
` (418 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Yael Chemla,
Carolina Jubran, Tariq Toukan, Alexander Lobakin, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit d7b0413b35715d7b32cb12d4d424613eff85ed2b ]
The max_macs devlink param is checked against the FW max value only at
param register time (driver load) and inside the validate callback
(devlink param set). The stored DRIVERINIT value persists across FW
resets and devlink reloads without any further checks against the max.
If the FW link type changes from Ethernet to IB and a FW reset happens,
the MAX cap for log_max_current_uc_list will become zero, but the
previously stored max_macs value remains and is unconditionally
programmed into the HCA caps in handle_hca_cap(). FW will then return a
syndrome during SET_HCA_CAP:
mlx5_cmd_out_err:839:(pid 3831): SET_HCA_CAP(0x109) op_mod(0x0) failed,
status bad parameter(0x3), syndrome (0x537801), err(-22)
set_hca_cap:907:(pid 3831): handle_hca_cap failed
This results in a failure to register the RDMA device.
This patch skips programming log_max_current_uc_list when the MAX
capability is 0 (in case of IB).
Fixes: 8680a60fc1fc ("net/mlx5: Let user configure max_macs generic param")
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Link: https://patch.msgid.link/20260611135230.534513-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/main.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 80f3493fc544c4..9b86632270936b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -570,7 +570,6 @@ static int handle_hca_cap(struct mlx5_core_dev *dev, void *set_ctx)
{
struct mlx5_profile *prof = &dev->profile;
void *set_hca_cap;
- int max_uc_list;
int err;
err = mlx5_core_get_caps(dev, MLX5_CAP_GENERAL);
@@ -653,10 +652,13 @@ static int handle_hca_cap(struct mlx5_core_dev *dev, void *set_ctx)
MLX5_SET(cmd_hca_cap, set_hca_cap, roce,
mlx5_is_roce_on(dev));
- max_uc_list = max_uc_list_get_devlink_param(dev);
- if (max_uc_list > 0)
- MLX5_SET(cmd_hca_cap, set_hca_cap, log_max_current_uc_list,
- ilog2(max_uc_list));
+ if (MLX5_CAP_GEN_MAX(dev, log_max_current_uc_list)) {
+ int max_uc_list = max_uc_list_get_devlink_param(dev);
+
+ if (max_uc_list > 0)
+ MLX5_SET(cmd_hca_cap, set_hca_cap,
+ log_max_current_uc_list, ilog2(max_uc_list));
+ }
return set_caps(dev, set_ctx, MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0581/1266] net: wwan: t7xx: check skb_clone in control TX
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0580/1266] net/mlx5: Check max_macs devlink param value against max capability Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0582/1266] net: bcmgenet: Use weighted round-robin TX DMA arbitration Greg Kroah-Hartman
` (417 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Loic Poulain,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 05f789fa90d95d5771230e78453cedff2486039d ]
t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
port transmit path. The clone is used immediately to set cloned->len, so
an skb_clone() failure results in a NULL pointer dereference.
Check the clone before using it. If previous fragments were already
queued, preserve the driver's existing partial-write behavior by
returning the number of bytes submitted so far.
Fixes: 36bd28c1cb0d ("wwan: core: Support slicing in port TX flow of WWAN subsystem")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260612035613.1192486-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/t7xx/t7xx_port_wwan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wwan/t7xx/t7xx_port_wwan.c b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
index 17389c8f6600a3..597a06e86f6ec0 100644
--- a/drivers/net/wwan/t7xx/t7xx_port_wwan.c
+++ b/drivers/net/wwan/t7xx/t7xx_port_wwan.c
@@ -74,6 +74,8 @@ static int t7xx_port_ctrl_tx(struct wwan_port *port, struct sk_buff *skb)
while (cur) {
cloned = skb_clone(cur, GFP_KERNEL);
+ if (!cloned)
+ return cnt ? cnt : -ENOMEM;
cloned->len = skb_headlen(cur);
ret = t7xx_port_send_skb(port_private, cloned, 0, 0);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0582/1266] net: bcmgenet: Use weighted round-robin TX DMA arbitration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0581/1266] net: wwan: t7xx: check skb_clone in control TX Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0583/1266] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
` (416 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
[ Upstream commit fd615abd53110f0f815984e99e7cc51ca6b7d979 ]
Under heavy network traffic, we observed sporadic TX queue timeouts on the
Raspberry Pi 4. The timeouts can be reproduced by stress testing the TX
path with multiple concurrent iperf UDP streams:
iperf3 -c <ip> -u -b0 -P16 -t60
NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 2044 ms
NETDEV WATCHDOG: CPU: 3: transmit queue 0 timed out 2004 ms
Investigation showed that the timeouts are caused by the priority-based
arbiter. Under heavy load the highest priority queue starves the lower
priority ones, causing timeouts. The TX strict priority arbiter is not
suitable for the default use case where all the traffic gets spread
across all the TX queues.
Therefore, to fix this, switch the TX DMA arbiter to Weighted Round-Robin,
which services all queues, so they do not stall. The weights were chosen
to follow the existing priority scheme: q0 gets the smallest weight, while
q1-4 get the bulk of the TX bandwidth.
Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
Link: https://patch.msgid.link/20260610085238.56300-1-ovidiu.panait.rb@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/broadcom/genet/bcmgenet.c | 23 +++++++------------
1 file changed, 8 insertions(+), 15 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index d8e4456d111e04..482f56aed980de 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -41,9 +41,8 @@
#include "bcmgenet.h"
-/* Default highest priority queue for multi queue support */
-#define GENET_Q1_PRIORITY 0
-#define GENET_Q0_PRIORITY 1
+#define GENET_Q0_WEIGHT 1
+#define GENET_Q1_WEIGHT 4
#define GENET_Q0_RX_BD_CNT \
(TOTAL_DESC - priv->hw_params->rx_queues * priv->hw_params->rx_bds_per_q)
@@ -2086,13 +2085,6 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
int i;
index = skb_get_queue_mapping(skb);
- /* Mapping strategy:
- * queue_mapping = 0, unclassified, packet xmited through ring 0
- * queue_mapping = 1, goes to ring 1. (highest priority queue)
- * queue_mapping = 2, goes to ring 2.
- * queue_mapping = 3, goes to ring 3.
- * queue_mapping = 4, goes to ring 4.
- */
ring = &priv->tx_rings[index];
txq = netdev_get_tx_queue(dev, index);
@@ -2792,8 +2784,9 @@ static void bcmgenet_fini_tx_napi(struct bcmgenet_priv *priv)
/* Initialize Tx queues
*
- * Queues 1-4 are priority-based, each one has 32 descriptors,
- * with queue 1 being the highest priority queue.
+ * Queues 1-4 are the priority queues, each one has 32 descriptors.
+ * The weighted round-robin arbiter gives them a larger share of TX
+ * bandwidth than the default queue 0.
*
* Queue 0 is the default Tx queue with
* GENET_Q0_TX_BD_CNT = 256 - 4 * 32 = 128 descriptors.
@@ -2821,8 +2814,8 @@ static void bcmgenet_init_tx_queues(struct net_device *dev)
dma_ctrl = 0;
ring_cfg = 0;
- /* Enable strict priority arbiter mode */
- bcmgenet_tdma_writel(priv, DMA_ARBITER_SP, DMA_ARB_CTRL);
+ /* Enable Weighted Round-Robin arbiter mode */
+ bcmgenet_tdma_writel(priv, DMA_ARBITER_WRR, DMA_ARB_CTRL);
/* Initialize Tx priority queues */
for (i = 0; i <= priv->hw_params->tx_queues; i++) {
@@ -2832,7 +2825,7 @@ static void bcmgenet_init_tx_queues(struct net_device *dev)
ring_cfg |= (1 << i);
dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
dma_priority[DMA_PRIO_REG_INDEX(i)] |=
- (i ? GENET_Q1_PRIORITY : GENET_Q0_PRIORITY)
+ (i ? GENET_Q1_WEIGHT : GENET_Q0_WEIGHT)
<< DMA_PRIO_REG_SHIFT(i);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0583/1266] kcm: use WRITE_ONCE() when changing lower socket callbacks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 6.6 0582/1266] net: bcmgenet: Use weighted round-robin TX DMA arbitration Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0584/1266] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
` (415 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 47186409c092cd7dd70350999186c700233e854d ]
kcm_attach() replaces a live lower TCP socket's sk_data_ready and
sk_write_space callbacks with KCM handlers, and kcm_unattach() restores
them later. Those callback-pointer updates are still plain stores even
though the same fields can be read and invoked concurrently on other
CPUs.
If another CPU observes an older callback snapshot after the live field
has already been restored, callback execution can run with a mismatched
target and sk_user_data state, leading to stale or misdirected wakeups.
Use WRITE_ONCE() for the callback replacement and restore operations so
these shared callback fields follow the same visibility contract already
established by the earlier 4022 fixes.
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260611053543.2429462-1-runyu.xiao@seu.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 829eb67240a998..a47afaaea2a13c 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1281,8 +1281,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
psock->save_write_space = csk->sk_write_space;
psock->save_state_change = csk->sk_state_change;
csk->sk_user_data = psock;
- csk->sk_data_ready = psock_data_ready;
- csk->sk_write_space = psock_write_space;
+ WRITE_ONCE(csk->sk_data_ready, psock_data_ready);
+ WRITE_ONCE(csk->sk_write_space, psock_write_space);
csk->sk_state_change = psock_state_change;
write_unlock_bh(&csk->sk_callback_lock);
@@ -1358,8 +1358,8 @@ static void kcm_unattach(struct kcm_psock *psock)
*/
write_lock_bh(&csk->sk_callback_lock);
csk->sk_user_data = NULL;
- csk->sk_data_ready = psock->save_data_ready;
- csk->sk_write_space = psock->save_write_space;
+ WRITE_ONCE(csk->sk_data_ready, psock->save_data_ready);
+ WRITE_ONCE(csk->sk_write_space, psock->save_write_space);
csk->sk_state_change = psock->save_state_change;
strp_stop(&psock->strp);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0584/1266] netfilter: nf_conncount: callers must hold rcu read lock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0583/1266] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0585/1266] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() Greg Kroah-Hartman
` (414 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 64d7d5abe2160bba369b4a8f06bdf5630573bab0 ]
rcu_derefence_raw() should not have been used here, it concealed this bug.
Its used because struct rb_node lacks __rcu annotated pointers, so plain
rcu_derefence causes sparse warnings.
The major tradeoff is that rcu_derefence_raw() doesn't warn when the caller
isn't in a rcu read section.
Extend the rcu read lock scope accordingly and cause sparse warnings,
those warnings are the lesser evil.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Closes: https://sashiko.dev/#/patchset/20260603230610.7900-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conncount.c | 6 +++---
net/openvswitch/conntrack.c | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index ae9ad439449fa5..b9265a8cdb2bc4 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -499,7 +499,7 @@ count_tree(struct net *net,
hash = jhash2(key, data->keylen, conncount_rnd) % CONNCOUNT_SLOTS;
root = &data->root[hash];
- parent = rcu_dereference_raw(root->rb_node);
+ parent = rcu_dereference(root->rb_node);
while (parent) {
int diff;
@@ -507,9 +507,9 @@ count_tree(struct net *net,
diff = key_diff(key, rbconn->key, data->keylen);
if (diff < 0) {
- parent = rcu_dereference_raw(parent->rb_left);
+ parent = rcu_dereference(parent->rb_left);
} else if (diff > 0) {
- parent = rcu_dereference_raw(parent->rb_right);
+ parent = rcu_dereference(parent->rb_right);
} else {
int ret;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 32485b36773755..82ffb1ac86b0cb 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1774,10 +1774,10 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
} else {
rcu_read_lock();
limit = ct_limit_get(info, zone);
- rcu_read_unlock();
err = __ovs_ct_limit_get_zone_limit(
net, info->data, zone, limit, reply);
+ rcu_read_unlock();
if (err)
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0585/1266] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0584/1266] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0586/1266] cifs: remove all cifs files before kill super Greg Kroah-Hartman
` (413 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Takashi Iwai,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit b113a891252c3fa4fab11ec8c2894a22ecaf278c ]
snd_power_ref_and_wait() takes the power refcount and doesn't leave it
no matter whether it returns an error or not. However, the majority
of callers don't expect but just returns without unreferencing in the
caller side upon errors.
For addressing the potential refcount unbalance, rather correct the
behavior of snd_power_ref_wait() to unreference upon returning an
error.
Note that the problem above is likely negligible; the function returns
an error only when the sound card is being shutdown, hence it doesn't
matter about the power refcount any longer at such a state.
Fixes: e94fdbd7b25d ("ALSA: control: Track in-flight control read/write/tlv accesses")
Reported-by: WenTao Liang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/20260612022121.14329-1-vulab@iscas.ac.cn
Link: https://patch.msgid.link/20260614090507.772540-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/init.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/sound/core/init.c b/sound/core/init.c
index 81186af3ac625c..0dc1d25be18404 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1154,7 +1154,7 @@ EXPORT_SYMBOL(snd_card_file_remove);
* typically around calling control ops.
*
* The caller needs to pull down the refcount via snd_power_unref() later
- * no matter whether the error is returned from this function or not.
+ * when this function returns 0.
*
* Return: Zero if successful, or a negative error code.
*/
@@ -1167,7 +1167,11 @@ int snd_power_ref_and_wait(struct snd_card *card)
card->shutdown ||
snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
snd_power_unref(card), snd_power_ref(card));
- return card->shutdown ? -ENODEV : 0;
+ if (card->shutdown) {
+ snd_power_unref(card);
+ return -ENODEV;
+ }
+ return 0;
}
EXPORT_SYMBOL_GPL(snd_power_ref_and_wait);
@@ -1184,7 +1188,8 @@ int snd_power_wait(struct snd_card *card)
int ret;
ret = snd_power_ref_and_wait(card);
- snd_power_unref(card);
+ if (!ret)
+ snd_power_unref(card);
return ret;
}
EXPORT_SYMBOL(snd_power_wait);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0586/1266] cifs: remove all cifs files before kill super
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0585/1266] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0587/1266] smb/client: always return a value for FS_IOC_GETFLAGS Greg Kroah-Hartman
` (412 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jian Zhang, Steve French,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <zhangjian496@huawei.com>
[ Upstream commit 6d9a4aaaa8b2612b5ef9d581e2f286a458b71ee1 ]
Cifs files may be put into fileinfo_put_wq during umounting cifs.
After umount done, cifsFileInfo_put_final is called, which cause
following BUG:
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
[ 134.222152] list_lru_add+0x64/0x1a0
[ 134.222399] ? cifs_put_tcon+0x171/0x340 [cifs]
[ 134.222772] d_lru_add+0x44/0x60
[ 134.222997] dput+0x1fc/0x210
[ 134.223213] cifsFileInfo_put_final+0x11a/0x140 [cifs]
[ 134.223576] process_one_work+0x17c/0x320
[ 134.223843] worker_thread+0x188/0x280
[ 134.224084] ? __pfx_worker_thread+0x10/0x10
[ 134.224366] kthread+0xcc/0x100
[ 134.224576] ? __pfx_kthread+0x10/0x10
[ 134.224827] ret_from_fork+0x30/0x50
[ 134.225063] ? __pfx_kthread+0x10/0x10
[ 134.225328] ret_from_fork_asm+0x1b/0x30
This can be reproduce by following:
unshare -n bash -c "
mkdir -p ${CIFS_MNT}
ip netns attach root 1
ip link add eth0 type veth peer veth0 netns root
ip link set eth0 up
ip -n root link set veth0 up
ip addr add 192.168.0.2/24 dev eth0
ip -n root addr add 192.168.0.1/24 dev veth0
ip route add default via 192.168.0.1 dev eth0
ip netns exec root sysctl net.ipv4.ip_forward=1
ip netns exec root iptables -t nat -A POSTROUTING -s 192.168.0.2 -o
${DEV} -j MASQUERADE
mount -t cifs ${CIFS_PATH} ${CIFS_MNT} -o
vers=3.0,sec=ntlmssp,credentials=${CIFS_CRED},rsize=65536,wsize=65536,cache=none,echo_interval=1
touch ${CIFS_MNT}/a.txt
ip netns exec root iptables -t nat -D POSTROUTING -s 192.168.0.2 -o
${DEV} -j MASQUERADE
"
umount ${CIFS_MNT}
Fixes: 340cea84f691 ("cifs: open files should not hold ref on superblock")
Signed-off-by: Jian Zhang <zhangjian496@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/connect.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 78feea9c262ef0..fe5d21f174c47e 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -3968,6 +3968,9 @@ cifs_umount(struct cifs_sb_info *cifs_sb)
}
spin_unlock(&cifs_sb->tlink_tree_lock);
+ flush_workqueue(serverclose_wq);
+ flush_workqueue(fileinfo_put_wq);
+
kfree(cifs_sb->prepath);
call_rcu(&cifs_sb->rcu, delayed_free);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0587/1266] smb/client: always return a value for FS_IOC_GETFLAGS
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0586/1266] cifs: remove all cifs files before kill super Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0588/1266] selftests/bpf: Initialize operation name before use Greg Kroah-Hartman
` (411 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huiwen He, ChenXiaoSong,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 7acbaa16b99edaf8ef432229d4b7a6f3b666767d ]
Currently, repeated lsattr calls on a regular CIFS file without the
compressed attribute may show random flags:
$ touch test.bin
$ lsattr test.bin
s-S-ia-A-EjI---------m test.bin
$ lsattr test.bin
------d-cEjI---------m test.bin
The lsattr reproducer depends on the previous contents of its userspace
buffer, so it may not reproduce on every setup. A deterministic
reproducer is to initialize the ioctl argument before FS_IOC_GETFLAGS
on a file without the compressed attribute:
int flags = 0x7fffffff;
ioctl(fd, FS_IOC_GETFLAGS, &flags);
On an affected kernel, flags remains 0x7fffffff. With the fix, it is
set to 0.
This happens because when the cached inode does not have the compressed
bit set, the CIFS fallback path in FS_IOC_GETFLAGS returns success
without calling put_user() to write the zero flags value into the user
buffer. As a result, the caller observes stale contents from its own
buffer.
Fix this by always writing the visible flags value back to the user
buffer before returning success, even when the value is zero.
Fixes: 64a5cfa6db94 ("Allow setting per-file compression via SMB2/3")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/ioctl.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/fs/smb/client/ioctl.c b/fs/smb/client/ioctl.c
index 8ea532cdc4302b..8a668b827570a4 100644
--- a/fs/smb/client/ioctl.c
+++ b/fs/smb/client/ioctl.c
@@ -376,13 +376,11 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
}
#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
#endif /* CONFIG_CIFS_POSIX */
- rc = 0;
- if (CIFS_I(inode)->cifsAttrs & ATTR_COMPRESSED) {
- /* add in the compressed bit */
- ExtAttrBits = FS_COMPR_FL;
- rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE,
- (int __user *)arg);
- }
+ if (CIFS_I(inode)->cifsAttrs & FILE_ATTRIBUTE_COMPRESSED)
+ ExtAttrBits |= FS_COMPR_FL;
+
+ rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE,
+ (int __user *)arg);
break;
case FS_IOC_SETFLAGS:
if (pSMBFile == NULL)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0588/1266] selftests/bpf: Initialize operation name before use
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0587/1266] smb/client: always return a value for FS_IOC_GETFLAGS Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0589/1266] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket Greg Kroah-Hartman
` (410 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, Ihor Solodrai,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 55ffbe8a15b1254f44d56952fb425a10e3f15c31 ]
ASAN reports stack-buffer-overflow due to the uninitialized op_name.
Initialize it to fix the issue.
Fixes: 054b6c7866c7 ("selftests/bpf: Add verifier log tests for BPF_BTF_LOAD command")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260602-tools_build_fix_zero_init_bpf_only-v2-6-c76e5250ea1c@arm.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/verifier_log.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier_log.c b/tools/testing/selftests/bpf/prog_tests/verifier_log.c
index 8337c6bc5b95b6..abc473c3741f53 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier_log.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier_log.c
@@ -317,6 +317,7 @@ static void verif_btf_log_subtest(bool bad_btf)
res = load_btf(&opts, true);
ASSERT_EQ(res, -ENOSPC, "half_log_fd");
ASSERT_EQ(strlen(logs.buf), 24, "log_fixed_25");
+ strscpy(op_name, "log_fixed", sizeof(op_name));
ASSERT_STRNEQ(logs.buf, logs.reference, 24, op_name);
/* validate rolling verifier log logic: try all variations of log buf
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0589/1266] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0588/1266] selftests/bpf: Initialize operation name before use Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0590/1266] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
` (409 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Zhou, Leon Hwang,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit ca0f587c029afa66227f7b932450b1c417403394 ]
When TCP over IPv4 via INET6 API, bpf_get/setsockopt with ipv4 will
fail, because sk->sk_family is AF_INET6. With ipv6 will success, not
take effect, because inet_csk(sk)->icsk_af_ops is ipv6_mapped and
use ip_queue_xmit, inet_sk(sk)->tos.
To relax this restriction, allow getting/setting tos for those possible
ipv4-mapped ipv6 sockets.
Fixes: ee7f1e1302f5 ("bpf: Change bpf_setsockopt(SOL_IP) to reuse do_ip_setsockopt()")
Signed-off-by: Feng Zhou <zhoufeng.zf@bytedance.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260613162443.60515-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 4a9c1367ea4d5e..5f99b2144c257f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5455,11 +5455,24 @@ static int sol_tcp_sockopt(struct sock *sk, int optname,
KERNEL_SOCKPTR(optval), *optlen);
}
+static bool sk_allows_sol_ip_sockopt(struct sock *sk)
+{
+ switch (sk->sk_family) {
+ case AF_INET:
+ return true;
+ case AF_INET6:
+ /* Allow getting/setting sockopt for possible ipv4-mapped ipv6 socket. */
+ return sk->sk_type != SOCK_RAW && !ipv6_only_sock(sk);
+ default:
+ return false;
+ }
+}
+
static int sol_ip_sockopt(struct sock *sk, int optname,
char *optval, int *optlen,
bool getopt)
{
- if (sk->sk_family != AF_INET)
+ if (!sk_allows_sol_ip_sockopt(sk))
return -EINVAL;
switch (optname) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0590/1266] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0589/1266] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0591/1266] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
` (408 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Xinyu Ma, Jiayuan Chen,
Emil Tsalapatis, Kuniyuki Iwashima, Weiming Shi,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 0c0a8ed85349dae298712d79cb276acfeb794d82 ]
When the scatterlist ring is full or nearly full, bpf_msg_push_data()
enters a copy fallback path and computes copy + len for the page
allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING
and both are u32, a crafted len can wrap the sum to a small value,
causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace:
__asan_memcpy (mm/kasan/shadow.c:105)
bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)
bpf_prog_9ed8b5711920a7d7+0x2e/0x36
sk_psock_msg_verdict (net/core/skmsg.c:934)
tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)
__sys_sendto (net/socket.c:2206)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
Link: https://lore.kernel.org/all/20260424155913.A19FDC19425@smtp.kernel.org
Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data")
Tested-by: Xiang Mei <xmei5@asu.edu>
Tested-by: Xinyu Ma <mmmxny@gmail.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20260615021959.140010-2-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 5f99b2144c257f..be51e8281109ac 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2822,6 +2822,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
if (!space || (space == 1 && start != offset))
copy = msg->sg.data[i].length;
+ if (unlikely(copy + len < copy))
+ return -EINVAL;
+
page = alloc_pages(__GFP_NOWARN | GFP_ATOMIC | __GFP_COMP,
get_order(copy + len));
if (unlikely(!page))
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0591/1266] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0590/1266] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0592/1266] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
` (407 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Emil Tsalapatis,
Kuniyuki Iwashima, Sechang Lim, Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sechang Lim <rhkrqnwk98@gmail.com>
[ Upstream commit a48802fb2cd2d1e23651989f8ff4d15e9d5dad54 ]
start and len are u32, so
u64 last = start + len;
evaluates start + len in 32-bit and wraps before storing it in last.
The bounds check
if (start >= offset + l || last > msg->sg.size)
return -EINVAL;
can then be passed with an out-of-range start/len, after which the pop
loop runs off the end of the scatterlist and sk_msg_shift_left() calls
put_page() on the empty msg->sg.end slot:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]
RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]
RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984
Call Trace:
<TASK>
bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8
bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746
sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934
tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]
tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583
__sock_sendmsg+0x153/0x1c0 net/socket.c:802
__sys_sendto+0x326/0x430 net/socket.c:2265
__x64_sys_sendto+0xe3/0x100 net/socket.c:2268
do_syscall_64+0x14c/0x480
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Widen the addition with a (u64) cast so the bound is evaluated in
64-bit and a len near U32_MAX no longer wraps below msg->sg.size.
While here, change pop from int to u32. It counts bytes against the
unsigned scatterlist lengths and can never be negative, so the signed
type only invites sign-confusion in the pop loop.
Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages")
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20260615021959.140010-6-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index be51e8281109ac..3e01ce9f01dfd0 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2988,8 +2988,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
u32, len, u64, flags)
{
u32 i = 0, l = 0, space, offset = 0;
- u64 last = start + len;
- int pop;
+ u64 last = (u64)start + len;
+ u32 pop;
if (unlikely(flags))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0592/1266] MIPS: mm: Fix out-of-bounds write in maar_res_walk()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0591/1266] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0593/1266] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
` (406 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yadan Fan, Thomas Bogendoerfer,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yadan Fan <ydfan@suse.com>
[ Upstream commit 1b001b16bc88f3f7817e228acfd91ee01bdcfcce ]
maar_res_walk() uses wi->num_cfg as the index into the fixed-size
wi->cfg array, but checks whether the array is full only after it has
filled the selected entry. If walk_system_ram_range() reports more than
16 memory ranges, the overflow call writes one struct maar_config past
the end of the array before WARN_ON() prevents num_cfg from advancing.
Move the full-array check before taking the array slot and return non-zero
when the scratch array is full, so walk_system_ram_range() terminates the
walk instead of invoking the callback for further ranges.
Fixes: a5718fe8f70f ("MIPS: mm: Drop boot_mem_map")
Signed-off-by: Yadan Fan <ydfan@suse.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/init.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 6e368a4658b544..de3713b42cbc2d 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -281,9 +281,15 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
void *data)
{
struct maar_walk_info *wi = data;
- struct maar_config *cfg = &wi->cfg[wi->num_cfg];
+ struct maar_config *cfg;
unsigned int maar_align;
+ /* Ensure we don't overflow the cfg array */
+ if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
+ return -1;
+
+ cfg = &wi->cfg[wi->num_cfg];
+
/* MAAR registers hold physical addresses right shifted by 4 bits */
maar_align = BIT(MIPS_MAAR_ADDR_SHIFT + 4);
@@ -292,9 +298,7 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
cfg->upper = ALIGN_DOWN(PFN_PHYS(start_pfn + nr_pages), maar_align) - 1;
cfg->attrs = MIPS_MAAR_S;
- /* Ensure we don't overflow the cfg array */
- if (!WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
- wi->num_cfg++;
+ wi->num_cfg++;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0593/1266] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0592/1266] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0594/1266] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
` (405 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shrikanth Hegde, Aboorva Devarajan,
Madhavan Srinivasan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 81e3a86030462824a67d697739cf3f387f4ba350 ]
fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at
the 'out:' label, but only calls the matching get_cpu_var() after the
'i < 0' early-return check. When event->hw.idx is negative the
function jumps to 'out:' without having taken get_cpu_var(), and the
trailing put_cpu_var() then issues an unmatched preempt_enable(),
underflowing preempt_count.
On a CONFIG_PREEMPT=y kernel preempt_count would underflow and
eventually present as a 'scheduling while atomic' BUG.
Move put_cpu_var() to pair with get_cpu_var() so the percpu access is
correctly bracketed and the 'out:' label only handles perf_pmu_enable.
Fixes: a11106544f33 ("powerpc/perf: e500 support")
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-2-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/core-fsl-emb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c
index 1a53ab08447cbe..31037df4178ca2 100644
--- a/arch/powerpc/perf/core-fsl-emb.c
+++ b/arch/powerpc/perf/core-fsl-emb.c
@@ -366,9 +366,10 @@ static void fsl_emb_pmu_del(struct perf_event *event, int flags)
cpuhw->n_events--;
+ put_cpu_var(cpu_hw_events);
+
out:
perf_pmu_enable(event->pmu);
- put_cpu_var(cpu_hw_events);
}
static void fsl_emb_pmu_start(struct perf_event *event, int ef_flags)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0594/1266] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0593/1266] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0595/1266] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
` (404 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan,
Madhavan Srinivasan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 0ecd26e93e698c8327521910fc6296f5b84a4b92 ]
pnv_kexec_wait_secondaries_down() calls get_cpu() to obtain the current
CPU id but never calls the matching put_cpu(), leaking one
preempt_disable() nesting level on every invocation.
In practice the imbalance does not trigger a visible splat because the
kexec teardown path is a one-way trip: IRQs are already disabled, no
schedule() occurs after the leak, and default_machine_kexec() overwrites
preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence()
which never returns. However the bookkeeping is still wrong.
The function only needs the current CPU id, and this path runs with
interrupts disabled and the CPU pinned, so the preempt_disable()
side-effect of get_cpu() is unnecessary. Replace it with
raw_smp_processor_id().
Fixes: 298b34d7d578 ("powerpc/powernv: Fix kexec races going back to OPAL")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-3-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/setup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 4dbb47ddbdcc4b..06ed5e2aa26584 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -396,7 +396,8 @@ static void pnv_kexec_wait_secondaries_down(void)
{
int my_cpu, i, notified = -1;
- my_cpu = get_cpu();
+ /* Called with interrupts disabled, so the CPU is pinned. */
+ my_cpu = raw_smp_processor_id();
for_each_online_cpu(i) {
uint8_t status;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0595/1266] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0594/1266] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0596/1266] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
` (403 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan, Shrikanth Hegde,
Madhavan Srinivasan, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 5c86f1c1f972761a04bf22f4c0618d1aa714185b ]
kexec_prepare_cpus_wait() calls get_cpu() internally to obtain the
current CPU id. kexec_prepare_cpus() calls kexec_prepare_cpus_wait()
twice -- once for KEXEC_STATE_IRQS_OFF and once for
KEXEC_STATE_REAL_MODE -- but only issues a single put_cpu() at the end,
leaving preempt_count elevated by one extra nesting level.
In practice the imbalance does not trigger a 'scheduling while atomic'
splat because the kexec path is a one-way trip: IRQs are already
disabled, no schedule() occurs after the leak, and
default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET
before jumping into kexec_sequence() which never returns. However the
bookkeeping is still wrong.
kexec_prepare_cpus() calls local_irq_disable()/hard_irq_disable()
before invoking kexec_prepare_cpus_wait(), so the CPU is already pinned
and the get_cpu()/put_cpu() preempt_disable() bracketing is unnecessary.
Only the current CPU id is needed, so replace get_cpu() with
raw_smp_processor_id() and drop the now-unneeded put_cpu().
Fixes: 1fc711f7ffb0 ("powerpc/kexec: Fix race in kexec shutdown")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-4-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kexec/core_64.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c
index ec7e909d7dcb7e..f8ae6c035aa103 100644
--- a/arch/powerpc/kexec/core_64.c
+++ b/arch/powerpc/kexec/core_64.c
@@ -167,7 +167,7 @@ static void kexec_prepare_cpus_wait(int wait_state)
int my_cpu, i, notified=-1;
hw_breakpoint_disable();
- my_cpu = get_cpu();
+ my_cpu = raw_smp_processor_id();
/* Make sure each CPU has at least made it to the state we need.
*
* FIXME: There is a (slim) chance of a problem if not all of the CPUs
@@ -265,8 +265,6 @@ static void kexec_prepare_cpus(void)
/* after we tell the others to go down */
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(0, 0);
-
- put_cpu();
}
#else /* ! SMP */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0596/1266] KEYS: Use acquire when reading state in keyring search
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0595/1266] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0597/1266] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
` (402 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Jarkko Sakkinen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit c1201b37f666f6466ab1fd3a381c2b7a4b7e9fee ]
The negative-key race fix added release/acquire ordering for key use.
Publish payload before state; read state before payload.
keyring_search_iterator() still uses READ_ONCE() before match callbacks.
An asymmetric match callback calls asymmetric_key_ids(), which reads
key->payload.data[asym_key_ids].
Use key_read_state() there to complete that ordering.
Fixes: 363b02dab09b ("KEYS: Fix race between updating and finding a negative key")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260529033406.20673-1-hanguidong02@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/keys/keyring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index df2580072cfe16..e105349794f23e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -576,7 +576,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
struct keyring_search_context *ctx = iterator_data;
const struct key *key = keyring_ptr_to_key(object);
unsigned long kflags = READ_ONCE(key->flags);
- short state = READ_ONCE(key->state);
+ short state = key_read_state(key);
kenter("{%d}", key->serial);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0597/1266] tipc: fix UAF in tipc_l2_send_msg()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0596/1266] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0598/1266] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
` (401 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+64ec81389cbad56a8c35,
Eric Dumazet, Jon Maloy, Tung Nguyen, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6 ]
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().
The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.
Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().
This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().
Fixes: 282b3a056225 ("tipc: send out RESET immediately when link goes down")
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
Reported-by: syzbot+64ec81389cbad56a8c35@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jon Maloy <jmaloy@redhat.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260612135949.4010482-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/bearer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index fec638e494c9dd..ae57ac1174f812 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -482,6 +482,7 @@ void tipc_disable_l2_media(struct tipc_bearer *b)
dev = (struct net_device *)rtnl_dereference(b->media_ptr);
dev_remove_pack(&b->pt);
RCU_INIT_POINTER(dev->tipc_ptr, NULL);
+ RCU_INIT_POINTER(b->media_ptr, NULL);
synchronize_net();
dev_put(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0598/1266] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0597/1266] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0599/1266] ionic: Fix check in ionic_get_link_ext_stats Greg Kroah-Hartman
` (400 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ebdb22d461c904fc3cb2,
Eric Dumazet, Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 ]
When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.
Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.
Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".
Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
Reported-by: syzbot+ebdb22d461c904fc3cb2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2c3193.8812e0fc.3c3fa4.0001.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612162517.83394-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6d80e17c04c0d8..c3257e8d575485 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3251,11 +3251,11 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
/*
* Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
* corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
- * IPV6_MAXPLEN is also valid and means: "any MSS,
- * rely only on pmtu discovery"
+ * Limit the default MSS to GSO_BY_FRAGS - 1 to avoid
+ * collision with the GSO_BY_FRAGS magic value (0xFFFF).
*/
if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
- mtu = IPV6_MAXPLEN;
+ mtu = min_t(unsigned int, IPV6_MAXPLEN, GSO_BY_FRAGS - 1);
return mtu;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0599/1266] ionic: Fix check in ionic_get_link_ext_stats
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0598/1266] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0600/1266] ksmbd: fix use-after-free in same_client_has_lease() Greg Kroah-Hartman
` (399 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brett Creeley, Eric Joyner,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brett Creeley <brett.creeley@amd.com>
[ Upstream commit 7678e69079c10b2fb10977f28f44ddb22971ea5b ]
The current check will fail if SR-IOV is not initialized for the
physical function; this is because is_physfn is 0 if sriov_init() isn't
run or fails. Change the check that prevents getting the link down count
to use is_virtfn instead so that VFs don't get this functionality, which
was the original intent.
Fixes: 132b4ebfa090 ("ionic: add support for ethtool extended stat link_down_count")
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-2-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
index b07dd56b0c76d2..38c2695bc529ef 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
@@ -114,8 +114,15 @@ static void ionic_get_link_ext_stats(struct net_device *netdev,
{
struct ionic_lif *lif = netdev_priv(netdev);
- if (lif->ionic->pdev->is_physfn)
- stats->link_down_events = lif->link_down_count;
+ if (lif->ionic->pdev->is_virtfn)
+ return;
+
+ if (!lif->ionic->idev.port_info) {
+ netdev_err_once(netdev, "port_info not initialized\n");
+ return;
+ }
+
+ stats->link_down_events = lif->link_down_count;
}
static int ionic_get_link_ksettings(struct net_device *netdev,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0600/1266] ksmbd: fix use-after-free in same_client_has_lease()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0599/1266] ionic: Fix check in ionic_get_link_ext_stats Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0601/1266] mfd: cs42l43: Sanity check firmware size Greg Kroah-Hartman
` (398 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Namjae Jeon,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 65b655f65c3ca1ab5d598d3832bb0ff531725858 ]
same_client_has_lease() returns an opinfo pointer from ci->m_op_list
after dropping ci->m_lock without taking a reference.
smb_grant_oplock() then dereferences that pointer in copy_lease() and
when checking breaking_cnt. A concurrent close can remove the old lease
from ci->m_op_list and drop the last reference before the caller uses
the returned pointer, leading to a use-after-free.
Take a reference when same_client_has_lease() selects an existing lease,
drop any previous match while scanning, and release the returned
reference in smb_grant_oplock() after copying the lease state.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/oplock.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index bba17ea84023e2..1d2e06e34a9a35 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -531,7 +531,12 @@ static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci,
ret = compare_guid_key(opinfo, client_guid, lctx->lease_key);
if (ret) {
+ if (!atomic_inc_not_zero(&opinfo->refcount))
+ continue;
+ if (m_opinfo)
+ opinfo_put(m_opinfo);
m_opinfo = opinfo;
+
/* skip upgrading lease about breaking lease */
if (atomic_read(&opinfo->breaking_cnt))
continue;
@@ -1249,6 +1254,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
if (atomic_read(&m_opinfo->breaking_cnt))
opinfo->o_lease->flags =
SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE;
+ opinfo_put(m_opinfo);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0601/1266] mfd: cs42l43: Sanity check firmware size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0600/1266] ksmbd: fix use-after-free in same_client_has_lease() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0602/1266] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
` (397 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Charles Keepax, Lee Jones,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit b6ef1a74b3ec254f87a6a3c554fe8f8083ebd37c ]
Currently the code checks if a firmware was received, however it does
not verify that the firmware size is larger than the firmware header. As
the firmware pointer is dereferenced as a pointer to the header
structure this could lead to an out of bounds memory access. Add the
missing check.
Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260508134804.1787461-1-ckeepax@opensource.cirrus.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/cs42l43.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
index 1cea3f8f467d43..c1f7b2cdb45b67 100644
--- a/drivers/mfd/cs42l43.c
+++ b/drivers/mfd/cs42l43.c
@@ -666,7 +666,7 @@ static void cs42l43_mcu_load_firmware(const struct firmware *firmware, void *con
unsigned int loadaddr, val;
int ret;
- if (!firmware) {
+ if (!firmware || firmware->size < sizeof(*hdr)) {
dev_err(cs42l43->dev, "Failed to load firmware\n");
cs42l43->firmware_error = -ENODEV;
goto err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0602/1266] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0601/1266] mfd: cs42l43: Sanity check firmware size Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0603/1266] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
` (396 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b225d4dfce6219600c42,
Aleksandr Nogikh, Heming Zhao, Mark Fasheh, Joel Becker,
Junxiao Bi, Joseph Qi, Changwei Ge, Jun Piao, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
[ Upstream commit ff6f26c58421614b02694ac9d219ac61d924bc68 ]
A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE,
EXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE.
1. ocfs2_mknod() acquires INODE_ALLOC then EXTENT_ALLOC.
2. ocfs2_dio_end_io_write() acquires EXTENT_ALLOC for unwritten
extents, then ORPHAN_DIR via ocfs2_del_inode_from_orphan() while still
holding EXTENT_ALLOC.
3. ocfs2_wipe_inode() acquires ORPHAN_DIR then INODE_ALLOC via
ocfs2_remove_inode.
Break the cycle in ocfs2_dio_end_io_write() by freeing the allocation
contexts (releasing EXTENT_ALLOC) before acquiring ORPHAN_DIR.
WARNING: possible circular locking dependency detected
------------------------------------------------------
is trying to acquire lock:
ffff8881e78b33a0
(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at:
ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
but task is already holding lock:
ffff8881e78b4fa0
(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}, at:
ocfs2_evict_inode+0xe97/0x43b0 fs/ocfs2/inode.c:1299
the existing dependency chain (in reverse order) is:
-> #2 (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}:
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_del_inode_from_orphan+0x12e/0x7a0 fs/ocfs2/namei.c:2728
ocfs2_dio_end_io+0xf9c/0x1370 fs/ocfs2/aops.c:2418
dio_complete+0x25b/0x790 fs/direct-io.c:281
-> #1 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_reserve_suballoc_bits+0x16d/0x4840 fs/ocfs2/suballoc.c:882
ocfs2_reserve_new_metadata_blocks+0x415/0x9a0
fs/ocfs2/suballoc.c:1078
ocfs2_mknod+0x10f3/0x2260 fs/ocfs2/namei.c:351
-> #0 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x96/0x200 kernel/locking/rwsem.c:1625
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_remove_inode fs/ocfs2/inode.c:733 [inline]
ocfs2_wipe_inode fs/ocfs2/inode.c:896 [inline]
ocfs2_delete_inode fs/ocfs2/inode.c:1157 [inline]
ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
Chain exists of:
&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE] -->
&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] -->
&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]);
*** DEADLOCK ***
Link: https://lore.kernel.org/97c902a6-3bcf-43ea-9b70-f1f136a6c3f2@mail.kernel.org
Fixes: d647c5b2fbf8 ("ocfs2: split transactions in dio completion to avoid credit exhaustion")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+b225d4dfce6219600c42@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b225d4dfce6219600c42
Link: https://syzkaller.appspot.com/ai_job?id=0b53ce1e-2972-4192-aa85-8097a702762c
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/aops.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 5365fc7675de46..680d7fa7e1482e 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -2400,6 +2400,15 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
unlock:
up_write(&oi->ip_alloc_sem);
+ if (data_ac) {
+ ocfs2_free_alloc_context(data_ac);
+ data_ac = NULL;
+ }
+ if (meta_ac) {
+ ocfs2_free_alloc_context(meta_ac);
+ meta_ac = NULL;
+ }
+
/* everything looks good, let's start the cleanup */
if (!ret && dwc->dw_orphaned) {
BUG_ON(dwc->dw_writer_pid != task_pid_nr(current));
@@ -2411,10 +2420,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
ocfs2_inode_unlock(inode, 1);
brelse(di_bh);
out:
- if (data_ac)
- ocfs2_free_alloc_context(data_ac);
- if (meta_ac)
- ocfs2_free_alloc_context(meta_ac);
ocfs2_run_deallocs(osb, &dealloc);
ocfs2_dio_free_write_ctx(inode, dwc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0603/1266] net/9p: fix race condition on rdma->state in trans_rdma.c
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0602/1266] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0604/1266] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
` (395 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Dominique Martinet, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 7d54894a1ee265a72d70f7cae1da6cc774cccc71 ]
The rdma->state field is modified without holding req_lock in both
recv_done() and p9_cm_event_handler(), while rdma_request() accesses
the same field under the req_lock spinlock. This inconsistent locking
creates a race condition:
- recv_done() running in softirq completion context sets
rdma->state = P9_RDMA_FLUSHING without acquiring req_lock
- p9_cm_event_handler() modifies rdma->state at multiple points
(ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without
req_lock
- rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to
protect the read-modify-write of rdma->state
The race can cause lost state transitions: recv_done() or the CM
event handler could set state to FLUSHING/CLOSED while rdma_request()
is concurrently checking or modifying state under the lock, leading to
the FLUSHING transition being silently overwritten by CLOSING. This
corrupts the connection state machine and can cause use-after-free on
RDMA request objects during teardown.
Fix by adding req_lock protection to all rdma->state modifications in
recv_done() and p9_cm_event_handler(), matching the pattern already
used in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore
in the CM event handler since it can race with recv_done() which runs
in softirq context.
Tested with a kernel module that races two threads (simulating
rdma_request and recv_done/CM handler) on rdma->state with proper
locking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost
transitions.
Fixes: 473c7dd1d7b5 ("9p/rdma: remove useless check in cm_event_handler")
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: GLM:GLM-5.1
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Message-ID: <20260529073933.77315-1-zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/9p/trans_rdma.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index b84748baf9cbe3..d9f53f1da2c21a 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -240,25 +240,36 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
{
struct p9_client *c = id->context;
struct p9_trans_rdma *rdma = c->trans;
+ unsigned long flags;
+
switch (event->event) {
case RDMA_CM_EVENT_ADDR_RESOLVED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_INIT);
rdma->state = P9_RDMA_ADDR_RESOLVED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_ROUTE_RESOLVED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_ADDR_RESOLVED);
rdma->state = P9_RDMA_ROUTE_RESOLVED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_ESTABLISHED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_ROUTE_RESOLVED);
rdma->state = P9_RDMA_CONNECTED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_DISCONNECTED:
- if (rdma)
+ if (rdma) {
+ spin_lock_irqsave(&rdma->req_lock, flags);
rdma->state = P9_RDMA_CLOSED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
+ }
c->status = Disconnected;
break;
@@ -296,6 +307,7 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
struct p9_req_t *req;
int err = 0;
int16_t tag;
+ unsigned long flags;
req = NULL;
ib_dma_unmap_single(rdma->cm_id->device, c->busa, client->msize,
@@ -332,7 +344,10 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
err_out:
p9_debug(P9_DEBUG_ERROR, "req %p err %d status %d\n",
req, err, wc->status);
- rdma->state = P9_RDMA_FLUSHING;
+ spin_lock_irqsave(&rdma->req_lock, flags);
+ if (rdma->state < P9_RDMA_FLUSHING)
+ rdma->state = P9_RDMA_FLUSHING;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
client->status = Disconnected;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0604/1266] staging: nvec: fix use-after-free in nvec_rx_completed()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0603/1266] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0605/1266] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
` (394 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alexandru Hossu,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
[ Upstream commit 26813881181deb3a32fbb59eadb2599cbe8423f6 ]
In nvec_rx_completed(), when an incomplete RX transfer is detected,
nvec_msg_free() is called to return the message back to the pool by
clearing its 'used' atomic flag. Immediately after this, the code
accesses nvec->rx->data[0] to check the message type.
Since nvec_msg_free() marks the pool slot as available via atomic_set(),
any concurrent or subsequent call to nvec_msg_alloc() could claim that
same slot and overwrite its data[] array. Reading nvec->rx->data[0] after
freeing the message is therefore a use-after-free.
Fix this by saving the message type byte before calling nvec_msg_free(),
then using the saved value for the battery quirk check.
Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses")
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/nvec/nvec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 2823cacde13093..0ed7266b033eb5 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -489,6 +489,8 @@ static void nvec_tx_completed(struct nvec_chip *nvec)
static void nvec_rx_completed(struct nvec_chip *nvec)
{
if (nvec->rx->pos != nvec_msg_size(nvec->rx)) {
+ unsigned char msg_type = nvec->rx->data[0];
+
dev_err(nvec->dev, "RX incomplete: Expected %u bytes, got %u\n",
(uint)nvec_msg_size(nvec->rx),
(uint)nvec->rx->pos);
@@ -497,7 +499,7 @@ static void nvec_rx_completed(struct nvec_chip *nvec)
nvec->state = 0;
/* Battery quirk - Often incomplete, and likes to crash */
- if (nvec->rx->data[0] == NVEC_BAT)
+ if (msg_type == NVEC_BAT)
complete(&nvec->ec_transfer);
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0605/1266] coresight: cti: Fix DT filter signals silently ignored
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0604/1266] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0606/1266] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore Greg Kroah-Hartman
` (393 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingchao Deng, Leo Yan,
Suzuki K Poulose, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingchao Deng <yingchao.deng@oss.qualcomm.com>
[ Upstream commit 551bb2fd5e4ed63d33aa11f07102cce5179b7595 ]
In cti_plat_process_filter_sigs(), after allocating a temporary
cti_trig_grp struct via kzalloc_obj(), the code never assigns tg->nr_sigs
= nr_filter_sigs. Since kzalloc zero-initialises the struct, tg->nr_sigs
remains 0. cti_plat_read_trig_group() guards with:
if (!tgrp->nr_sigs)
return 0;
so it returns immediately without reading any signal indices from DT.
Fix by assigning tg->nr_sigs before calling cti_plat_read_trig_group().
Fixes: a5614770ab97 ("coresight: cti: Add device tree support for custom CTI")
Signed-off-by: Yingchao Deng <yingchao.deng@oss.qualcomm.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260426-nr_sigs-v1-1-3b9df99dab97@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-cti-platform.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwtracing/coresight/coresight-cti-platform.c b/drivers/hwtracing/coresight/coresight-cti-platform.c
index ccef04f27f12fa..438f9c7ddccdc3 100644
--- a/drivers/hwtracing/coresight/coresight-cti-platform.c
+++ b/drivers/hwtracing/coresight/coresight-cti-platform.c
@@ -329,6 +329,7 @@ static int cti_plat_process_filter_sigs(struct cti_drvdata *drvdata,
if (!tg)
return -ENOMEM;
+ tg->nr_sigs = nr_filter_sigs;
err = cti_plat_read_trig_group(tg, fwnode, CTI_DT_FILTER_OUT_SIGS);
if (!err)
drvdata->config.trig_out_filter |= tg->used_mask;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0606/1266] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0605/1266] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0607/1266] PCI/ASPM: Dont reconfigure ASPM entering low-power state Greg Kroah-Hartman
` (392 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, James Clark,
Suzuki K Poulose, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 0ec0a8785d21f63db520bd9d2a67c55e855d36a8 ]
It is a typo to use trcvmidcctlr0 to save and restore TRCVMIDCCTLR1.
Use trcvmidcctlr1 instead.
Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260408-arm_cs_fix_trcvmidcctlr1_typo-v1-1-6a5695363b46@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index c5928f63475a06..331df260d07451 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -1837,7 +1837,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
state->trcvmidcctlr0 = etm4x_read32(csa, TRCVMIDCCTLR0);
if (drvdata->numvmidc > 4)
- state->trcvmidcctlr0 = etm4x_read32(csa, TRCVMIDCCTLR1);
+ state->trcvmidcctlr1 = etm4x_read32(csa, TRCVMIDCCTLR1);
state->trcclaimset = etm4x_read32(csa, TRCCLAIMCLR);
@@ -1963,7 +1963,7 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, state->trcvmidcctlr0, TRCVMIDCCTLR0);
if (drvdata->numvmidc > 4)
- etm4x_relaxed_write32(csa, state->trcvmidcctlr0, TRCVMIDCCTLR1);
+ etm4x_relaxed_write32(csa, state->trcvmidcctlr1, TRCVMIDCCTLR1);
etm4x_relaxed_write32(csa, state->trcclaimset, TRCCLAIMSET);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0607/1266] PCI/ASPM: Dont reconfigure ASPM entering low-power state
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0606/1266] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0608/1266] PCI: Introduce named defines for PCI ROM Greg Kroah-Hartman
` (391 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carlos Bilbao (Lambda),
Bjorn Helgaas, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Bilbao <carlos.bilbao@kernel.org>
[ Upstream commit c855c9921da72e535c24737c748f603a52d03f7e ]
Reconfiguring ASPM when a device transitions to low-power state can enable
L1.1/L1.2 substates on the PCIe link at a time when the device is sleeping
and may be unable to exit them. ASPM should be reconfigured on D0 entry
(resume), not on the way down.
pci_set_low_power_state() calls pcie_aspm_pm_state_change() after writing
D3hot to PCI_PM_CTRL. pcie_aspm_pm_state_change() resets link->aspm_capable
to link->aspm_support and then calls pcie_config_aspm_path(), which can
enable ASPM L1.1/L1.2 substates on the PCIe link. If the device cannot
recover the link from L1.2 while in D3hot, subsequent config space reads
return 0xFFFF ("device inaccessible") and pci_power_up() fails with
messages like:
vfio-pci 0000:5d:00.0: Unable to change power state from D3hot to D0, device inaccessible
This was observed on NVIDIA H100 SXM5 GPUs bound to vfio-pci when Linux
runtime PM suspends them to D3hot: the GPU becomes permanently inaccessible
and disappears from the PCIe bus.
The call to pcie_aspm_pm_state_change() in pci_set_low_power_state() was
restored by f93e71aea6c6 ("Revert "PCI/ASPM: Remove
pcie_aspm_pm_state_change()""), which reverted 08d0cc5f3426 ("PCI/ASPM:
Remove pcie_aspm_pm_state_change()"). The revert was necessary because the
removal broke suspend/resume on certain platforms that required ASPM to be
reconfigured on D0 entry. However, the revert restored the call in both
pci_set_full_power_state() (D0 entry) and pci_set_low_power_state()
(low-power entry).
Only the D0-entry call is needed to fix the suspend/resume regression. The
low-power-entry call is harmful: reconfiguring ASPM immediately after
putting a device into D3hot can enable link substates that the device or
platform cannot exit while the device is sleeping.
Remove the pcie_aspm_pm_state_change() call from pci_set_low_power_state().
ASPM will still be reconfigured correctly when the device returns to D0 via
pci_set_full_power_state().
Fixes: f93e71aea6c6 ("Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"")
Signed-off-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260428040104.78524-1-carlos.bilbao@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e7648a1abfdbf3..c0cfc3f44f4bf9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1518,9 +1518,6 @@ static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state, bool
pci_power_name(dev->current_state),
pci_power_name(state));
- if (dev->bus->self)
- pcie_aspm_pm_state_change(dev->bus->self, locked);
-
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0608/1266] PCI: Introduce named defines for PCI ROM
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0607/1266] PCI/ASPM: Dont reconfigure ASPM entering low-power state Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0609/1266] PCI: Check ROM header and data structure addr before accessing Greg Kroah-Hartman
` (390 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guixin Liu, Bjorn Helgaas,
Andy Shevchenko, Krzysztof Wilczyński, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 113e86bc58a918f85d250723436a4d541a873358 ]
Convert the magic numbers associated with PCI ROM into named
definitions. Some of these definitions will be used in the second
fix patch.
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260508082128.3344255-2-kanie@linux.alibaba.com
Stable-dep-of: 538796b807fc ("PCI: Check ROM header and data structure addr before accessing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/rom.c | 40 ++++++++++++++++++++++++++++------------
1 file changed, 28 insertions(+), 12 deletions(-)
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index e18d3a4383ba6b..d4a141bd148b4b 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -5,13 +5,28 @@
* (C) Copyright 2004 Jon Smirl <jonsmirl@yahoo.com>
* (C) Copyright 2004 Silicon Graphics, Inc. Jesse Barnes <jbarnes@sgi.com>
*/
+
+#include <linux/bits.h>
#include <linux/kernel.h>
#include <linux/export.h>
#include <linux/pci.h>
+#include <linux/sizes.h>
#include <linux/slab.h>
#include "pci.h"
+#define PCI_ROM_HEADER_SIZE 0x1A
+#define PCI_ROM_POINTER_TO_DATA_STRUCT 0x18
+#define PCI_ROM_LAST_IMAGE_INDICATOR 0x15
+#define PCI_ROM_LAST_IMAGE_INDICATOR_BIT BIT(7)
+#define PCI_ROM_IMAGE_LEN 0x10
+#define PCI_ROM_IMAGE_SECTOR_SIZE SZ_512
+#define PCI_ROM_IMAGE_SIGNATURE 0xAA55
+
+/* Data structure signature is "PCIR" in ASCII representation */
+#define PCI_ROM_DATA_STRUCT_SIGNATURE 0x52494350
+#define PCI_ROM_DATA_STRUCT_LEN 0x0A
+
/**
* pci_enable_rom - enable ROM decoding for a PCI device
* @pdev: PCI device to enable
@@ -91,26 +106,27 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom,
do {
void __iomem *pds;
/* Standard PCI ROMs start out with these bytes 55 AA */
- if (readw(image) != 0xAA55) {
- pci_info(pdev, "Invalid PCI ROM header signature: expecting 0xaa55, got %#06x\n",
- readw(image));
+ if (readw(image) != PCI_ROM_IMAGE_SIGNATURE) {
+ pci_info(pdev, "Invalid PCI ROM header signature: expecting %#06x, got %#06x\n",
+ PCI_ROM_IMAGE_SIGNATURE, readw(image));
break;
}
- /* get the PCI data structure and check its "PCIR" signature */
- pds = image + readw(image + 24);
- if (readl(pds) != 0x52494350) {
- pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n",
- readl(pds));
+ /* Get the PCI data structure and check its "PCIR" signature */
+ pds = image + readw(image + PCI_ROM_POINTER_TO_DATA_STRUCT);
+ if (readl(pds) != PCI_ROM_DATA_STRUCT_SIGNATURE) {
+ pci_info(pdev, "Invalid PCI ROM data signature: expecting %#010x, got %#010x\n",
+ PCI_ROM_DATA_STRUCT_SIGNATURE, readl(pds));
break;
}
- last_image = readb(pds + 21) & 0x80;
- length = readw(pds + 16);
- image += length * 512;
+ last_image = readb(pds + PCI_ROM_LAST_IMAGE_INDICATOR) &
+ PCI_ROM_LAST_IMAGE_INDICATOR_BIT;
+ length = readw(pds + PCI_ROM_IMAGE_LEN);
+ image += length * PCI_ROM_IMAGE_SECTOR_SIZE;
/* Avoid iterating through memory outside the resource window */
if (image >= rom + size)
break;
if (!last_image) {
- if (readw(image) != 0xAA55) {
+ if (readw(image) != PCI_ROM_IMAGE_SIGNATURE) {
pci_info(pdev, "No more image in the PCI ROM\n");
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0609/1266] PCI: Check ROM header and data structure addr before accessing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0608/1266] PCI: Introduce named defines for PCI ROM Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0610/1266] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
` (389 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guanghui Feng, Guixin Liu,
Bjorn Helgaas, Andy Shevchenko, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <kanie@linux.alibaba.com>
[ Upstream commit 538796b807fcfb81b2ce40cc97a614fd8588feb5 ]
We meet a crash when running stress-ng on x86_64 machine:
BUG: unable to handle page fault for address: ffa0000007f40000
RIP: 0010:pci_get_rom_size+0x52/0x220
Call Trace:
<TASK>
pci_map_rom+0x80/0x130
pci_read_rom+0x4b/0xe0
kernfs_file_read_iter+0x96/0x180
vfs_read+0x1b1/0x300
Our analysis reveals that the ROM space's start address is
0xffa0000007f30000, and size is 0x10000. Because of broken ROM space,
before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is
already pointed to the ROM space end, invoking readl() would read 4 bytes
therefore cause an out-of-bounds access and trigger a crash. Fix this by
adding image header and data structure checking.
We also found another crash on arm64 machine:
Unable to handle kernel paging request at virtual address ffff8000dd1393ff
Mem abort info:
ESR = 0x0000000096000021
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x21: alignment fault
The call trace is the same with x86_64, but the crash reason is that the
data structure addr is not aligned with 4, and arm64 machine report
"alignment fault". Fix this by adding alignment checking.
Fixes: 47b975d234ea ("PCI: Avoid iterating through memory outside the resource window")
Suggested-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
[bhelgaas: shorten function names, wrap comments]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260508082128.3344255-3-kanie@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/rom.c | 123 +++++++++++++++++++++++++++++++++++++++-------
1 file changed, 105 insertions(+), 18 deletions(-)
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index d4a141bd148b4b..f2105c6ceef524 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -6,9 +6,12 @@
* (C) Copyright 2004 Silicon Graphics, Inc. Jesse Barnes <jbarnes@sgi.com>
*/
+#include <linux/align.h>
#include <linux/bits.h>
#include <linux/kernel.h>
#include <linux/export.h>
+#include <linux/io.h>
+#include <linux/overflow.h>
#include <linux/pci.h>
#include <linux/sizes.h>
#include <linux/slab.h>
@@ -27,6 +30,15 @@
#define PCI_ROM_DATA_STRUCT_SIGNATURE 0x52494350
#define PCI_ROM_DATA_STRUCT_LEN 0x0A
+/*
+ * Per PCI Firmware r3.3, sec 5.1.3, a conformant PCI Data Structure is at
+ * least 24 bytes (0x18), large enough to cover every fixed field this
+ * driver reads (up to the Indicator byte at offset 0x15). Reject smaller
+ * device-claimed lengths so the follow-up readers in pci_get_rom_size()
+ * cannot escape the mapped ROM window.
+ */
+#define PCI_ROM_DATA_STRUCT_MIN_LEN 0x18
+
/**
* pci_enable_rom - enable ROM decoding for a PCI device
* @pdev: PCI device to enable
@@ -84,6 +96,91 @@ void pci_disable_rom(struct pci_dev *pdev)
}
EXPORT_SYMBOL_GPL(pci_disable_rom);
+static bool pci_rom_header_valid(struct pci_dev *pdev, void __iomem *image,
+ void __iomem *rom, size_t size,
+ bool expect_valid)
+{
+ unsigned long rom_end = (unsigned long)rom + size - 1;
+ unsigned long header_end;
+ u16 signature;
+
+ /*
+ * Per PCI Firmware r3.3, sec 5.1, each image must start on a
+ * 512-byte boundary and must contain the PCI Expansion ROM header.
+ * Because @rom is page-aligned (returned by ioremap()), checking
+ * 512-byte alignment of @image is equivalent to enforcing the
+ * spec's sector-aligned layout within the ROM. This also
+ * satisfies the natural-alignment requirement of readw() on archs
+ * such as arm64 that disallow unaligned IOMEM access.
+ */
+ if (!IS_ALIGNED((unsigned long)image, PCI_ROM_IMAGE_SECTOR_SIZE))
+ return false;
+
+ if (check_add_overflow((unsigned long)image, PCI_ROM_HEADER_SIZE - 1,
+ &header_end))
+ return false;
+
+ if (image < rom || header_end > rom_end)
+ return false;
+
+ /* Standard PCI ROMs start out with these bytes 55 AA */
+ signature = readw(image);
+ if (signature != PCI_ROM_IMAGE_SIGNATURE) {
+ if (expect_valid) {
+ pci_info(pdev, "Invalid PCI ROM header signature: expecting %#06x, got %#06x\n",
+ PCI_ROM_IMAGE_SIGNATURE, signature);
+ } else {
+ pci_info(pdev, "No more images in PCI ROM\n");
+ }
+ return false;
+ }
+
+ return true;
+}
+
+static bool pci_rom_data_struct_valid(struct pci_dev *pdev, void __iomem *pds,
+ void __iomem *rom, size_t size)
+{
+ unsigned long rom_end = (unsigned long)rom + size - 1;
+ unsigned long end;
+ u32 signature;
+ u16 data_len;
+
+ /*
+ * Some CPU architectures require IOMEM access addresses to be
+ * aligned, for example arm64, so since we're about to call
+ * readl(), check here for 4-byte alignment.
+ */
+ if (!IS_ALIGNED((unsigned long)pds, 4))
+ return false;
+
+ if (check_add_overflow((unsigned long)pds, PCI_ROM_DATA_STRUCT_LEN + 1,
+ &end))
+ return false;
+
+ if (pds < rom || end > rom_end)
+ return false;
+
+ signature = readl(pds);
+ if (signature != PCI_ROM_DATA_STRUCT_SIGNATURE) {
+ pci_info(pdev, "Invalid PCI ROM data signature: expecting %#010x, got %#010x\n",
+ PCI_ROM_DATA_STRUCT_SIGNATURE, signature);
+ return false;
+ }
+
+ data_len = readw(pds + PCI_ROM_DATA_STRUCT_LEN);
+ if (data_len < PCI_ROM_DATA_STRUCT_MIN_LEN || data_len == U16_MAX)
+ return false;
+
+ if (check_add_overflow((unsigned long)pds, data_len - 1, &end))
+ return false;
+
+ if (end > rom_end)
+ return false;
+
+ return true;
+}
+
/**
* pci_get_rom_size - obtain the actual size of the ROM image
* @pdev: target PCI device
@@ -99,38 +196,28 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom,
size_t size)
{
void __iomem *image;
- int last_image;
unsigned int length;
+ bool last_image;
image = rom;
do {
void __iomem *pds;
- /* Standard PCI ROMs start out with these bytes 55 AA */
- if (readw(image) != PCI_ROM_IMAGE_SIGNATURE) {
- pci_info(pdev, "Invalid PCI ROM header signature: expecting %#06x, got %#06x\n",
- PCI_ROM_IMAGE_SIGNATURE, readw(image));
+ if (!pci_rom_header_valid(pdev, image, rom, size, true))
break;
- }
+
/* Get the PCI data structure and check its "PCIR" signature */
pds = image + readw(image + PCI_ROM_POINTER_TO_DATA_STRUCT);
- if (readl(pds) != PCI_ROM_DATA_STRUCT_SIGNATURE) {
- pci_info(pdev, "Invalid PCI ROM data signature: expecting %#010x, got %#010x\n",
- PCI_ROM_DATA_STRUCT_SIGNATURE, readl(pds));
+ if (!pci_rom_data_struct_valid(pdev, pds, rom, size))
break;
- }
+
last_image = readb(pds + PCI_ROM_LAST_IMAGE_INDICATOR) &
PCI_ROM_LAST_IMAGE_INDICATOR_BIT;
length = readw(pds + PCI_ROM_IMAGE_LEN);
image += length * PCI_ROM_IMAGE_SECTOR_SIZE;
- /* Avoid iterating through memory outside the resource window */
- if (image >= rom + size)
+
+ if (!last_image &&
+ !pci_rom_header_valid(pdev, image, rom, size, false))
break;
- if (!last_image) {
- if (readw(image) != PCI_ROM_IMAGE_SIGNATURE) {
- pci_info(pdev, "No more image in the PCI ROM\n");
- break;
- }
- }
} while (length && !last_image);
/* never return a size larger than the PCI resource window */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0610/1266] x86/platform/olpc: xo15: Drop wakeup source on driver removal
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0609/1266] PCI: Check ROM header and data structure addr before accessing Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0611/1266] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
` (388 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit cc966553e6ff0849978b5754531b768b0ff54985 ]
Prevent leaking a wakeup source object after removing the driver by
adding appropriate cleanup code to its remove callback function.
Fixes: a0f30f592d2d ("x86, olpc: Add XO-1.5 SCI driver")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2069931.usQuhbGJ8B@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/platform/olpc/olpc-xo15-sci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c
index 68244a3422d1d6..683935da493d27 100644
--- a/arch/x86/platform/olpc/olpc-xo15-sci.c
+++ b/arch/x86/platform/olpc/olpc-xo15-sci.c
@@ -185,6 +185,7 @@ static int xo15_sci_add(struct acpi_device *device)
static void xo15_sci_remove(struct acpi_device *device)
{
+ device_init_wakeup(&device->dev, false);
acpi_disable_gpe(NULL, xo15_sci_gpe);
acpi_remove_gpe_handler(NULL, xo15_sci_gpe, xo15_sci_gpe_handler);
cancel_work_sync(&sci_work);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0611/1266] platform/x86: xo15-ebook: Fix wakeup source and GPE handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0610/1266] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0612/1266] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
` (387 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit b2fc2c6ebbd2d49935c8960755d8170faead2159 ]
The device_set_wakeup_enable() call in ebook_switch_add() doesn't
actually do anything because power.can_wakeup is not set for ACPI
device objects. Moreover, had it done anything, it would have
registered a wakeup source object that wouldn't have been used
going forward and that wakeup source would have been leaked after
driver removal because ebook_switch_remove() doesn't clean it up.
Accordingly, remove that call from ebook_switch_add().
Also prevent leaking an enabled ACPI GPE after removing the driver by
adding appropriate cleanup code to ebook_switch_remove().
Fixes: 89ca11771a4b ("OLPC XO-1.5 ebook switch driver")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1966125.tdWV9SEqCh@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/xo15-ebook.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/xo15-ebook.c b/drivers/platform/x86/xo15-ebook.c
index 391f7ea4431e08..d62c74e9d346b6 100644
--- a/drivers/platform/x86/xo15-ebook.c
+++ b/drivers/platform/x86/xo15-ebook.c
@@ -38,6 +38,7 @@ MODULE_DEVICE_TABLE(acpi, ebook_device_ids);
struct ebook_switch {
struct input_dev *input;
char phys[32]; /* for input device */
+ bool gpe_enabled;
};
static int ebook_send_state(struct acpi_device *device)
@@ -131,7 +132,7 @@ static int ebook_switch_add(struct acpi_device *device)
/* Button's GPE is run-wake GPE */
acpi_enable_gpe(device->wakeup.gpe_device,
device->wakeup.gpe_number);
- device_set_wakeup_enable(&device->dev, true);
+ button->gpe_enabled = true;
}
return 0;
@@ -147,6 +148,10 @@ static void ebook_switch_remove(struct acpi_device *device)
{
struct ebook_switch *button = acpi_driver_data(device);
+ if (button->gpe_enabled)
+ acpi_disable_gpe(device->wakeup.gpe_device,
+ device->wakeup.gpe_number);
+
input_unregister_device(button->input);
kfree(button);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0612/1266] perf sched: Add missing mmap2 handler in timehist
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0611/1266] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0613/1266] PCI: loongson: Do not ignore downstream devices on external bridges Greg Kroah-Hartman
` (386 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Adrian Hunter,
David Ahern, Gabriel Marin, Ingo Molnar, James Clark, Jiri Olsa,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 91182741369b261c441e63e6678893032a6d7e4c ]
perf_sched__timehist() registers event handlers for options using the
sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc.
but completely omits registering a handler for MMAP2 events.
Failing to register both MMAP and MMAP2 handlers causes modern systems
(which primarily output MMAP2 records) to silently drop VMA map mappings.
This results in uninitialized machine/thread mapping structures, making it
impossible to resolve shared library instruction pointers (IPs) to dynamic
symbols/DSOs during timehist callchain analysis.
Fix this by correctly registering perf_event__process_mmap2 in
sched->tool inside perf_sched__timehist().
Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command")
Assisted-by: Gemini-CLI:Google Gemini 3
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Gabriel Marin <gmx@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 16cb7278fabaf7..1a22314094e6ad 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -3067,6 +3067,7 @@ static int perf_sched__timehist(struct perf_sched *sched)
*/
sched->tool.sample = perf_timehist__process_sample;
sched->tool.mmap = perf_event__process_mmap;
+ sched->tool.mmap2 = perf_event__process_mmap2;
sched->tool.comm = perf_event__process_comm;
sched->tool.exit = perf_event__process_exit;
sched->tool.fork = perf_event__process_fork;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0613/1266] PCI: loongson: Do not ignore downstream devices on external bridges
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0612/1266] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0614/1266] bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() Greg Kroah-Hartman
` (385 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiaxun Yang, Lain Fearyncess Yang,
Rong Zhang, Manivannan Sadhasivam, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Zhang <i@rong.moe>
[ Upstream commit 1389ab9bf9f627d4daed86f492091b00f110aa86 ]
Loongson PCI host controllers have a hardware quirk that requires
software to ignore downstream devices with device number > 0 on the
internal bridges. The current implementation applies the workaround to
all non-root buses, which breaks external bridges (e.g., PCIe switches)
with multiple downstream devices.
Fix it by only applying the workaround to internal bridges.
Tested on Loongson-LS3A4000-7A1000-NUC-SE, using AMD Promontory 21
chipset add-in card [1].
$ lspci -tnnnvvv
-[0000:00]-+-00.0 Loongson Technology LLC 7A1000 Chipset Hyper Transport Bridge Controller [0014:7a00]
+-00.1 Loongson Technology LLC 7A2000 Chipset Hyper Transport Bridge Controller [0014:7a10]
+-03.0 Loongson Technology LLC 2K1000/2000 / 7A1000 Chipset Gigabit Ethernet Controller [0014:7a03]
+-04.0 Loongson Technology LLC 2K1000 / 7A1000/2000 Chipset USB OHCI Controller [0014:7a24]
+-04.1 Loongson Technology LLC 2K1000 / 7A1000/2000 Chipset USB EHCI Controller [0014:7a14]
+-05.0 Loongson Technology LLC 2K1000 / 7A1000/2000 Chipset USB OHCI Controller [0014:7a24]
+-05.1 Loongson Technology LLC 2K1000 / 7A1000/2000 Chipset USB EHCI Controller [0014:7a14]
+-06.0 Loongson Technology LLC 7A1000 Chipset Vivante GC1000 GPU [0014:7a15]
+-06.1 Loongson Technology LLC 2K1000 / 7A1000 Chipset Display Controller [0014:7a06]
+-07.0 Loongson Technology LLC 2K1000/2000/3000 / 3B6000M / 7A1000/2000 Chipset HD Audio Controller [0014:7a07]
+-08.0 Loongson Technology LLC 2K1000 / 7A1000 Chipset 3Gb/s SATA AHCI Controller [0014:7a08]
+-08.1 Loongson Technology LLC 2K1000 / 7A1000 Chipset 3Gb/s SATA AHCI Controller [0014:7a08]
+-08.2 Loongson Technology LLC 2K1000 / 7A1000 Chipset 3Gb/s SATA AHCI Controller [0014:7a08]
+-09.0-[01]----00.0 Qualcomm Technologies, Inc QCNFA765 Wireless Network Adapter [17cb:1103]
+-0a.0-[02]----00.0 Etron Technology, Inc. EJ188/EJ198 USB 3.0 Host Controller [1b6f:7052]
+-0f.0-[03-08]----00.0-[04-08]--+-00.0-[05]----00.0 Shenzhen Longsys Electronics Co., Ltd. FORESEE XP1000 / Lexar Professional CFexpress Type B Gold series, NM620 PCIe NVME SSD (DRAM-less) [1d97:5216]
| +-08.0-[06]----00.0 MAXIO Technology (Hangzhou) Ltd. NVMe SSD Controller MAP1202 (DRAM-less) [1e4b:1202]
| +-0c.0-[07]----00.0 Advanced Micro Devices, Inc. [AMD] 600 Series Chipset USB 3.2 Controller [1022:43f7]
| \-0d.0-[08]----00.0 Advanced Micro Devices, Inc. [AMD] 600 Series Chipset SATA Controller [1022:43f6]
\-16.0 Loongson Technology LLC 7A1000 Chipset SPI Controller [0014:7a0b]
Fixes: 2410e3301fcc ("PCI: loongson: Don't access non-existent devices")
Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Co-developed-by: Lain "Fearyncess" Yang <i@lain.vg>
Signed-off-by: Lain "Fearyncess" Yang <i@lain.vg>
Signed-off-by: Rong Zhang <i@rong.moe>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://oshwhub.com/wesd/b650 [1]
Link: https://patch.msgid.link/20260501-ls7a-bridge-fixes-v2-1-69fa93683805@rong.moe
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-loongson.c | 31 ++++++++++++++-------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/drivers/pci/controller/pci-loongson.c b/drivers/pci/controller/pci-loongson.c
index bc630ab8a28316..de5e809a537d2c 100644
--- a/drivers/pci/controller/pci-loongson.c
+++ b/drivers/pci/controller/pci-loongson.c
@@ -80,6 +80,18 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
DEV_LS7A_LPC, system_bus_quirk);
+static const struct pci_device_id loongson_internal_bridge_devids[] = {
+ { PCI_VDEVICE(LOONGSON, DEV_LS2K_PCIE_PORT0) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT0) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT1) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT2) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT3) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT4) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT5) },
+ { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT6) },
+ { 0, },
+};
+
/*
* Some Loongson PCIe ports have hardware limitations on their Maximum Read
* Request Size. They can't handle anything larger than this. Sane
@@ -92,24 +104,13 @@ static void loongson_set_min_mrrs_quirk(struct pci_dev *pdev)
{
struct pci_bus *bus = pdev->bus;
struct pci_dev *bridge;
- static const struct pci_device_id bridge_devids[] = {
- { PCI_VDEVICE(LOONGSON, DEV_LS2K_PCIE_PORT0) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT0) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT1) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT2) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT3) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT4) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT5) },
- { PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT6) },
- { 0, },
- };
/* look for the matching bridge */
while (!pci_is_root_bus(bus)) {
bridge = bus->self;
bus = bus->parent;
- if (pci_match_id(bridge_devids, bridge)) {
+ if (pci_match_id(loongson_internal_bridge_devids, bridge)) {
if (pcie_get_readrq(pdev) > 256) {
pci_info(pdev, "limiting MRRS to 256\n");
pcie_set_readrq(pdev, 256);
@@ -230,11 +231,11 @@ static void __iomem *pci_loongson_map_bus(struct pci_bus *bus,
struct loongson_pci *priv = pci_bus_to_loongson_pci(bus);
/*
- * Do not read more than one device on the bus other than
- * the host bus.
+ * Do not read more than one device on the internal bridges.
*/
if ((priv->data->flags & FLAG_DEV_FIX) && bus->self) {
- if (!pci_is_root_bus(bus) && (device > 0))
+ if (!pci_is_root_bus(bus) && (device > 0) &&
+ pci_match_id(loongson_internal_bridge_devids, bus->self))
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0614/1266] bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0613/1266] PCI: loongson: Do not ignore downstream devices on external bridges Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0615/1266] phy: phy-can-transceiver: Check driver match and driver data against NULL Greg Kroah-Hartman
` (384 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Kumar, Manivannan Sadhasivam,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
[ Upstream commit 9dece4435d396e9877e27483552b910ba8654169 ]
There is a potential deadlock scenario in mhi_ep_reset_worker() where
the state_lock mutex is acquired twice in the same call chain:
mhi_ep_reset_worker()
mutex_lock(&mhi_cntrl->state_lock)
mhi_ep_power_up()
mhi_ep_set_ready_state()
mutex_lock(&mhi_cntrl->state_lock) <- Deadlock
Fix this by releasing the state_lock before calling mhi_ep_power_up().
The lock is only needed to protect current MHI state read operation. The
lock can be safely released before proceeding with the power up sequence.
Fixes: 7a97b6b47353 ("bus: mhi: ep: Add support for handling MHI_RESET")
Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260414-reset_worker_deadlock-v2-1-42fd682b45db@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mhi/ep/main.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index 558cfb3a06c5ea..821c8101ec64da 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -1071,11 +1071,12 @@ static void mhi_ep_reset_worker(struct work_struct *work)
mhi_ep_power_down(mhi_cntrl);
- mutex_lock(&mhi_cntrl->state_lock);
-
/* Reset MMIO to signal host that the MHI_RESET is completed in endpoint */
mhi_ep_mmio_reset(mhi_cntrl);
+
+ mutex_lock(&mhi_cntrl->state_lock);
cur_state = mhi_cntrl->mhi_state;
+ mutex_unlock(&mhi_cntrl->state_lock);
/*
* Only proceed further if the reset is due to SYS_ERR. The host will
@@ -1084,8 +1085,6 @@ static void mhi_ep_reset_worker(struct work_struct *work)
*/
if (cur_state == MHI_STATE_SYS_ERR)
mhi_ep_power_up(mhi_cntrl);
-
- mutex_unlock(&mhi_cntrl->state_lock);
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0615/1266] phy: phy-can-transceiver: Check driver match and driver data against NULL
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0614/1266] bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0616/1266] perf pmu: Skip test on Arm64 when #slots is zero Greg Kroah-Hartman
` (383 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Vinod Koul,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit ebee9004cc0200b2b708ebf7ac625d35c71c049f ]
Every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override()
so platform drivers that rely on the existence of a device's driver
data need to verify its presence.
Accordingly, add requisite match and driver data checks against NULL
to the driver where they are missing.
Fixes: a4a86d273ff1 ("phy: phy-can-transceiver: Add support for generic CAN transceiver driver")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260513220336.369628-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/phy-can-transceiver.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/phy/phy-can-transceiver.c b/drivers/phy/phy-can-transceiver.c
index 840b7f8a31c5fd..72dc65c7246784 100644
--- a/drivers/phy/phy-can-transceiver.c
+++ b/drivers/phy/phy-can-transceiver.c
@@ -111,6 +111,9 @@ static int can_transceiver_phy_probe(struct platform_device *pdev)
return -ENOMEM;
match = of_match_node(can_transceiver_phy_ids, pdev->dev.of_node);
+ if (!match || !match->data)
+ return -ENODEV;
+
drvdata = match->data;
if (of_property_read_bool(dev->of_node, "mux-states")) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0616/1266] perf pmu: Skip test on Arm64 when #slots is zero
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0615/1266] phy: phy-can-transceiver: Check driver match and driver data against NULL Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0617/1266] mailbox: mtk-adsp: fix UAF during device teardown Greg Kroah-Hartman
` (382 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, James Clark, Leo Yan,
Adrian Hunter, Alexander Shishkin, Jiri Olsa, Mark Rutland,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 2e2ba7d1ea554ee6e9e751a53eebf3e9270b0670 ]
Some Arm64 PMUs expose 'caps/slots' as 0 when the slot count is not
implemented, tool_pmu__read_event() currently returns false for this,
so metrics that reference #slots are reported as syntax error.
Since the commit 3a61fd866ef9 ("perf expr: Return -EINVAL for syntax
error in expr__find_ids()"), these syntax errors are populated as
failures and make the PMU metric test fail:
9.3: Parsing of PMU event table metrics:
--- start ---
...
Found metric 'backend_bound'
metric expr 100 * (stall_slot_backend / (#slots * cpu_cycles)) for backend_bound
parsing metric: 100 * (stall_slot_backend / (#slots * cpu_cycles))
Failure to read '#slots'
literal: #slots = nan
syntax error
Fail to parse metric or group `backend_bound'
...
---- end(-1) ----
9.3: Parsing of PMU event table metrics : FAILED!
This commit introduces a new function is_expected_broken_metric() to
identify broken metrics, and treats metrics containing "#slots" as
expected broken when #slots == 0 on Arm64 platforms.
Fixes: 3a61fd866ef9aaa1 ("perf expr: Return -EINVAL for syntax error in expr__find_ids()")
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/pmu-events.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/pmu-events.c b/tools/perf/tests/pmu-events.c
index f5321fbdee79d1..2ed9d2ad792e2b 100644
--- a/tools/perf/tests/pmu-events.c
+++ b/tools/perf/tests/pmu-events.c
@@ -15,6 +15,7 @@
#include "util/expr.h"
#include "util/hashmap.h"
#include "util/parse-events.h"
+#include "util/tool_pmu.h"
#include "metricgroup.h"
#include "stat.h"
@@ -804,6 +805,26 @@ struct metric {
struct metric_ref metric_ref;
};
+static bool is_expected_broken_metric(const struct pmu_metric *pm)
+{
+ if (!strcmp(pm->metric_name, "M1") || !strcmp(pm->metric_name, "M2") ||
+ !strcmp(pm->metric_name, "M3"))
+ return true;
+
+#if defined(__aarch64__)
+ /*
+ * Arm64 platforms may return "#slots == 0", which is treated as a
+ * syntax error by the parser. Don't test these metrics when running
+ * on such platforms.
+ */
+ if (strstr(pm->metric_expr, "#slots") &&
+ !tool_pmu__cpu_slots_per_cycle())
+ return true;
+#endif
+
+ return false;
+}
+
static int test__parsing_callback(const struct pmu_metric *pm,
const struct pmu_metrics_table *table,
void *data)
@@ -842,8 +863,7 @@ static int test__parsing_callback(const struct pmu_metric *pm,
err = metricgroup__parse_groups_test(evlist, table, pm->metric_name, &metric_events);
if (err) {
- if (!strcmp(pm->metric_name, "M1") || !strcmp(pm->metric_name, "M2") ||
- !strcmp(pm->metric_name, "M3")) {
+ if (is_expected_broken_metric(pm)) {
(*failures)--;
pr_debug("Expected broken metric %s skipping\n", pm->metric_name);
err = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0617/1266] mailbox: mtk-adsp: fix UAF during device teardown
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0616/1266] perf pmu: Skip test on Arm64 when #slots is zero Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0618/1266] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
` (381 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Tzung-Bi Shih,
Jassi Brar, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
[ Upstream commit b57d1a40bc43258372fa1f4d39305e093947a262 ]
When the SOF audio driver fails to initialize (e.g. firmware boot
timeout), its devres unwind frees the snd_sof_dev object that the
mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.
The mtk-adsp-mailbox shutdown clears the mailbox command registers
but leaves the IRQ line unmasked, so a late interrupt can still
queue a threaded handler after mbox_free_channel() had cleared
chan->cl, and mbox_chan_received_data() would then trigger UAF:
BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version
sof_ipc3_validate_fw_version
sof_ipc3_do_rx_work
sof_ipc3_rx_msg
mt8196_dsp_handle_request
mtk_adsp_ipc_recv
mbox_chan_received_data
mtk_adsp_mbox_isr
irq_thread_fn
Freed by task ...:
kfree
devres_release_all
really_probe
... (sof-audio-of-mt8196 probe failure)
The crash was observed roughly three seconds after the failed probe.
disable_irq() in shutdown and enable_irq() in startup. disable_irq()
also waits for any in-flight interrupts, so by the time
mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.
In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked
between probe and the first client bind — otherwise an early interrupt
can crash on chan->cl == NULL in mbox_chan_received_data().
Fixes: af2dfa96c52d ("mailbox: mediatek: add support for adsp mailbox controller")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mtk-adsp-mailbox.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/mailbox/mtk-adsp-mailbox.c b/drivers/mailbox/mtk-adsp-mailbox.c
index 91487aa4d7da08..8bcecddee0eb5c 100644
--- a/drivers/mailbox/mtk-adsp-mailbox.c
+++ b/drivers/mailbox/mtk-adsp-mailbox.c
@@ -19,6 +19,7 @@ struct mtk_adsp_mbox_priv {
struct mbox_controller mbox;
void __iomem *va_mboxreg;
const struct mtk_adsp_mbox_cfg *cfg;
+ int irq;
};
struct mtk_adsp_mbox_cfg {
@@ -67,6 +68,8 @@ static int mtk_adsp_mbox_startup(struct mbox_chan *chan)
writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
+ enable_irq(priv->irq);
+
return 0;
}
@@ -74,6 +77,8 @@ static void mtk_adsp_mbox_shutdown(struct mbox_chan *chan)
{
struct mtk_adsp_mbox_priv *priv = get_mtk_adsp_mbox_priv(chan->mbox);
+ disable_irq(priv->irq);
+
/* Clear ADSP mbox command */
writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_in);
writel(0xFFFFFFFF, priv->va_mboxreg + priv->cfg->clr_out);
@@ -139,8 +144,10 @@ static int mtk_adsp_mbox_probe(struct platform_device *pdev)
if (irq < 0)
return irq;
+ priv->irq = irq;
ret = devm_request_threaded_irq(dev, irq, mtk_adsp_mbox_irq,
- mtk_adsp_mbox_isr, IRQF_TRIGGER_NONE,
+ mtk_adsp_mbox_isr,
+ IRQF_TRIGGER_NONE | IRQF_NO_AUTOEN,
dev_name(dev), mbox->chans);
if (ret < 0)
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0618/1266] staging: most: video: avoid double free on video register failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0617/1266] mailbox: mtk-adsp: fix UAF during device teardown Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0619/1266] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
` (380 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 7cb1c5b32a2bfde961fff8d5204526b609bcb30a ]
comp_register_videodev() allocates a video_device with
video_device_alloc() and releases it if video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
comp_register_videodev()
-> video_device_release(mdev->vdev)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free mdev->vdev through vdev->release().
comp_register_videodev() then releases mdev->vdev exactly once on failure.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: eab231c0398a ("staging: most: v4l2-aim: remove unnecessary label err_vbi_dev")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260517111218.945796-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/video/video.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
index 6254a5df2502fa..a2fd7681c2610b 100644
--- a/drivers/staging/most/video/video.c
+++ b/drivers/staging/most/video/video.c
@@ -415,6 +415,7 @@ static int comp_register_videodev(struct most_video_dev *mdev)
/* Fill the video capture device struct */
*mdev->vdev = comp_videodev_template;
+ mdev->vdev->release = video_device_release_empty;
mdev->vdev->v4l2_dev = &mdev->v4l2_dev;
mdev->vdev->lock = &mdev->lock;
snprintf(mdev->vdev->name, sizeof(mdev->vdev->name), "MOST: %s",
@@ -427,9 +428,13 @@ static int comp_register_videodev(struct most_video_dev *mdev)
v4l2_err(&mdev->v4l2_dev, "video_register_device failed (%d)\n",
ret);
video_device_release(mdev->vdev);
+ return ret;
}
- return ret;
+ mdev->vdev->release = video_device_release;
+
+ return 0;
+
}
static void comp_unregister_videodev(struct most_video_dev *mdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0619/1266] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0618/1266] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0620/1266] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
` (379 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit cff06b03b530ae1fe8a13e93a7848f2130e00fb4 ]
The `max3421_hub_control()` function handles USB hub class requests
to the virtual root hub. In the `default` branches of both the
`ClearPortFeature` and `SetPortFeature` switch statements, it modifies
`max3421_hcd->port_status` by left shifting 1 by the request's `value`
parameter. However, it does not validate whether this shift will exceed
the width of `port_status`.
So if a malicious userspace task with access to the root hub via
/dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue`
greater than or equal to 32, the left shift operation invokes
shift-out-of-bounds undefined behavior. This results in arbitrary
bit corruption of `port_status`, including the normally-immutable
change bits, which can bypass internal state checks and confuse the
hub status.
Fix this by rejecting requests whose `value` exceeds the shift width
before performing the shift.
This issue was found using a KLEE-based symbolic execution tool for
kernel drivers that I'm currently developing.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://patch.msgid.link/20260518224901.1887013-1-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 2d792ab271e2ae..af82e88e148ecd 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1694,6 +1694,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
!pdata->vbus_active_level);
fallthrough;
default:
+ if (value >= 32)
+ goto error;
max3421_hcd->port_status &= ~(1 << value);
}
break;
@@ -1747,6 +1749,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
max3421_reset_port(hcd);
fallthrough;
default:
+ if (value >= 32)
+ goto error;
if ((max3421_hcd->port_status & USB_PORT_STAT_POWER)
!= 0)
max3421_hcd->port_status |= (1 << value);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0620/1266] usb: host: max3421: Reject hub port requests for non-existent ports
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0619/1266] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0621/1266] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
` (378 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Seungjin Bae,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 11b5c101e2fd206104b05bc92554d356989423a8 ]
The `max3421_hub_control()` function handles USB hub class requests
to the virtual root hub. The `GetPortStatus` case correctly rejects
requests with `index != 1`, since the virtual root hub has only a
single port. However, the `ClearPortFeature` and `SetPortFeature`
cases lack the same check.
Fix this by extending the `index != 1` rejection to both cases,
matching the existing behavior of `GetPortStatus`.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://patch.msgid.link/20260518224901.1887013-3-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index af82e88e148ecd..d410e3206e2df0 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1685,6 +1685,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
case ClearHubFeature:
break;
case ClearPortFeature:
+ if (index != 1)
+ goto error;
switch (value) {
case USB_PORT_FEAT_SUSPEND:
break;
@@ -1728,6 +1730,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
break;
case SetPortFeature:
+ if (index != 1)
+ goto error;
switch (value) {
case USB_PORT_FEAT_LINK_STATE:
case USB_PORT_FEAT_U1_TIMEOUT:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0621/1266] char: tlclk: fix use-after-free in tlclk_cleanup()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0620/1266] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0622/1266] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Greg Kroah-Hartman
` (377 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James Kim, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
[ Upstream commit bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1 ]
This patch improves the module cleanup process in the tlclk driver to
prevent potential use-after-free and race conditions.
Currently, the file_operations structure does not specify the .owner
field, which could allow the module to be unloaded while user-space
processes are still interacting with the device. Additionally, the
tlclk_cleanup() function frees the alarm_events memory before ensuring
that blocked processes in the waitqueue are fully awakened and that the
switchover_timer has completed.
To address these cases, this patch:
- Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module
unloading while the device is in use.
- Updates tlclk_cleanup() to explicitly wake up all blocked readers
(wake_up_all), properly release hardware I/O regions, and safely
delete the timer (timer_delete_sync) prior to freeing memory.
Fixes: 1a80ba882730 ("[PATCH] Telecom Clock Driver for MPCBL0010 ATCA computer blade")
Signed-off-by: James Kim <james010kim@gmail.com>
Link: https://patch.msgid.link/20260503101131.64219-1-james010kim@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tlclk.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 896a3550fba9f3..6b993744f2d781 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -263,6 +263,7 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
}
static const struct file_operations tlclk_fops = {
+ .owner = THIS_MODULE,
.read = tlclk_read,
.open = tlclk_open,
.release = tlclk_release,
@@ -852,6 +853,9 @@ static void __exit tlclk_cleanup(void)
misc_deregister(&tlclk_miscdev);
unregister_chrdev(tlclk_major, "telco_clock");
+ got_event = 1;
+ wake_up_all(&wq);
+
release_region(TLCLK_BASE, 8);
del_timer_sync(&switchover_timer);
kfree(alarm_events);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0622/1266] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0621/1266] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0623/1266] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
` (376 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Jiri Olsa, Namhyung Kim,
Wang Nan, Arnaldo Carvalho de Melo, Sasha Levin, sashiko-bot
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 944f65c8b8231d26d4db6be67bcb641142603cb4 ]
read_event_desc() reads nre (event count), sz (attr size), and nr
(IDs per event) from the file and uses them to control allocations
and loops without validating them against the section size.
A crafted perf.data could trigger large allocations or many loop
iterations before __do_read() eventually rejects the reads.
Add bounds checks in read_event_desc():
- Reject sz smaller than PERF_ATTR_SIZE_VER0.
- Require at least one event (nre > 0).
- Check that nre events fit in the remaining section, using the
minimum per-event footprint of sz + sizeof(u32).
- Pre-swap attr->size to native byte order, then reject values
below PERF_ATTR_SIZE_VER0 or above sz before calling
perf_event__attr_swap() to prevent heap out-of-bounds access.
- Handle ABI0 (attr.size == 0): substitute PERF_ATTR_SIZE_VER0,
and on native-endian files write the value back so
free_event_desc() does not treat the zero as its end-of-array
sentinel (it iterates while attr.size != 0). The swap path
skips the write-back — perf_event__attr_swap() has its own
ABI0 fallback that sets VER0 after swapping.
- Check that nr IDs fit in the remaining section before allocating.
Fixes: b30b61729246 ("perf tools: Fix a problem when opening old perf.data with different byte order")
Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Assisted-by: Claude:claude-opus-4.6-1m
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 54 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 54 insertions(+)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 0b44176826bfd9..50b0c98f44b87a 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1940,9 +1940,28 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
if (do_read_u32(ff, &nre))
goto error;
+ /* Size of each of the nre attributes. */
if (do_read_u32(ff, &sz))
goto error;
+ /*
+ * Require at least one event with an attr no smaller than the
+ * first published struct, and reject sz values where
+ * sz + sizeof(u32) would overflow size_t (possible on 32-bit)
+ * or nre == UINT32_MAX where nre + 1 wraps to 0 in the calloc.
+ *
+ * The minimum section footprint per event is sz bytes for the
+ * attr plus a u32 for the id count, check that nre events fit.
+ */
+ if (!nre || sz < PERF_ATTR_SIZE_VER0 ||
+ sz > ff->size || (size_t)sz > SIZE_MAX - sizeof(u32) ||
+ nre == UINT32_MAX ||
+ nre > (ff->size - ff->offset) / (sz + sizeof(u32))) {
+ pr_err("Invalid HEADER_EVENT_DESC: nre=%u sz=%u (min %d)\n",
+ nre, sz, PERF_ATTR_SIZE_VER0);
+ goto error;
+ }
+
/* buffer to hold on file attr struct */
buf = malloc(sz);
if (!buf)
@@ -1958,6 +1977,9 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
msz = sz;
for (i = 0, evsel = events; i < nre; evsel++, i++) {
+ struct perf_event_attr *attr = buf;
+ u32 attr_size;
+
evsel->core.idx = i;
/*
@@ -1967,6 +1989,32 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
if (__do_read(ff, buf, sz))
goto error;
+ /* Reject before attr_swap to prevent OOB via bswap_safe() */
+ attr_size = ff->ph->needs_swap ? bswap_32(attr->size) : attr->size;
+ /* ABI0: size == 0 means the producer didn't set it */
+ if (!attr_size) {
+ attr_size = PERF_ATTR_SIZE_VER0;
+ /*
+ * Write back so free_event_desc() doesn't
+ * treat this event as the end-of-array sentinel
+ * (it iterates while attr.size != 0).
+ *
+ * Only for native — the swap path must NOT
+ * write native-endian VER0 here because
+ * perf_event__attr_swap() would re-swap it
+ * to 0x40000000, defeating bswap_safe() bounds.
+ * perf_event__attr_swap() has its own ABI0
+ * fallback that sets VER0 after swapping.
+ */
+ if (!ff->ph->needs_swap)
+ attr->size = attr_size;
+ }
+ if (attr_size < PERF_ATTR_SIZE_VER0 || attr_size > sz) {
+ pr_err("Event %d attr.size (%u) invalid (min: %d, max: %u)\n",
+ i, attr_size, PERF_ATTR_SIZE_VER0, sz);
+ goto error;
+ }
+
if (ff->ph->needs_swap)
perf_event__attr_swap(buf);
@@ -1988,6 +2036,12 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
if (!nr)
continue;
+ /* Prevent oversized allocation from crafted nr */
+ if (nr > (ff->size - ff->offset) / sizeof(*id)) {
+ pr_err("Event %d: id count %u exceeds remaining section\n", i, nr);
+ goto error;
+ }
+
id = calloc(nr, sizeof(*id));
if (!id)
goto error;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0623/1266] iio: light: si1133: reset counter to prevent race condition
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0622/1266] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0624/1266] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
` (375 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit 0a5f45ed2342aabae1e32c72558d15be28940a95 ]
Sashiko reported a potential race condition happening when the driver
returns an errno after a timeout in the si1133_command() function. The
premature exit causes the hardware and software counters to become out
of sync by not updating data->rsp_seq, therefore the internal hardware
counter keeps incrementing.
Fix this by adding a call to si1133_cmd_reset_counter() before returning
from timeout.
Fixes: e01e7eaf37d8 ("iio: light: introduce si1133")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260428-si1133-checkup-v2-5-70ad14bfefe2%40gmail.com
Assisted-by: gemini:gemini-3.1-pro-preview
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/si1133.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/iio/light/si1133.c b/drivers/iio/light/si1133.c
index ea2c437199c0fb..ce5afd74e6e2a5 100644
--- a/drivers/iio/light/si1133.c
+++ b/drivers/iio/light/si1133.c
@@ -427,6 +427,11 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
dev_warn(dev,
"Failed to read command 0x%02x, ret=%d\n",
cmd, err);
+ /*
+ * Reset counter on err to prevent software and hardware
+ * counters being out of sync.
+ */
+ si1133_cmd_reset_counter(data);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0624/1266] iio: light: si1133: prevent race condition on timeout
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0623/1266] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0625/1266] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
` (374 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit 8c50a95ceb230d17801758a9e41ffbbbe46f8b4d ]
Sashiko reported a bug where the si1133_command exits on timeout
without halting the sensor or masking the interrupt. If the sensor
completes the command later, any subsequent command to the sensor
will cause the IRQ handler to complete immediately, returning stale
data to the driver all while the command hasn't finished yet, shifting
all potential reads in the future.
Fix this by masking the IRQ if wait_for_completion_timeout() fails.
When initiating a new command, do a dummy read of the IRQ_STATUS
register and turn the IRQ back on.
Fixes: e01e7eaf37d8 ("iio: light: introduce si1133")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260428-si1133-checkup-v2-5-70ad14bfefe2%40gmail.com
Assisted-by: gemini:gemini-3.1-pro-preview
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/si1133.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/light/si1133.c b/drivers/iio/light/si1133.c
index ce5afd74e6e2a5..598d9d90750669 100644
--- a/drivers/iio/light/si1133.c
+++ b/drivers/iio/light/si1133.c
@@ -395,8 +395,14 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
expected_seq = (data->rsp_seq + 1) & SI1133_MAX_CMD_CTR;
- if (cmd == SI1133_CMD_FORCE)
+ if (cmd == SI1133_CMD_FORCE) {
+ /* Flush pending IRQs from a previous timeout. */
+ regmap_read(data->regmap, SI1133_REG_IRQ_STATUS, &resp);
+ regmap_write(data->regmap, SI1133_REG_IRQ_ENABLE,
+ SI1133_IRQ_CHANNEL_ENABLE);
+
reinit_completion(&data->completion);
+ }
err = regmap_write(data->regmap, SI1133_REG_COMMAND, cmd);
if (err) {
@@ -409,6 +415,7 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
/* wait for irq */
if (!wait_for_completion_timeout(&data->completion,
msecs_to_jiffies(SI1133_COMPLETION_TIMEOUT_MS))) {
+ regmap_write(data->regmap, SI1133_REG_IRQ_ENABLE, 0);
err = -ETIMEDOUT;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0625/1266] iio: magnetometer: ak8975: fix potential kernel stack memory leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0624/1266] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0626/1266] iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling Greg Kroah-Hartman
` (373 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Joshua Crofts,
Jonathan Cameron, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit a9a00d727b7bbc5e913a919530a9dd468935bf95 ]
Currently in the AK8975 driver there are four instances where potential
uninitialized kernel stack memory leaks can occur. If
i2c_smbus_read_i2c_block_data_or_emulated() returns a value less than
the size of the buffer, uninitialized bytes are retained in the buffer
and later the buffer is passed on to IIO buffers, potentially leaking
memory to userspace.
Fix this by adding checks whether the return value of the function is
equal to the size of the buffer and subsequently if the value is
lesser than zero to distinguish from a returned error code.
Fixes: bc11ca4a0b84 ("iio:magnetometer:ak8975: triggered buffer support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-ak8975-fix-v1-1-104ea605dd54%40gmail.com
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/magnetometer/ak8975.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index e8c52179b3315d..547a4738cf1dd0 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -464,6 +464,10 @@ static int ak8975_who_i_am(struct i2c_client *client,
dev_err(&client->dev, "Error reading WIA\n");
return ret;
}
+ if (ret != sizeof(wia_val)) {
+ dev_err(&client->dev, "Error reading WIA\n");
+ return -EIO;
+ }
if (wia_val[0] != AK8975_DEVICE_ID)
return -ENODEV;
@@ -580,6 +584,10 @@ static int ak8975_setup(struct i2c_client *client)
dev_err(&client->dev, "Not able to read asa data\n");
return ret;
}
+ if (ret != sizeof(data->asa)) {
+ dev_err(&client->dev, "Error reading asa data\n");
+ return -EIO;
+ }
/* After reading fuse ROM data set power-down mode */
ret = ak8975_set_mode(data, POWER_DOWN);
@@ -719,6 +727,10 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
sizeof(rval), (u8*)&rval);
if (ret < 0)
goto exit;
+ if (ret != sizeof(rval)) {
+ ret = -EIO;
+ goto exit;
+ }
/* Read out ST2 for release lock on measurment data. */
ret = i2c_smbus_read_byte_data(client, data->def->ctrl_regs[ST2]);
@@ -848,6 +860,8 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
(u8 *)fval);
if (ret < 0)
goto unlock;
+ if (ret != sizeof(fval))
+ goto unlock;
mutex_unlock(&data->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0626/1266] iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0625/1266] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0627/1266] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
` (372 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guilherme Ivo Bozi, Salih Erim,
Jonathan Cameron, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guilherme Ivo Bozi <guilherme.bozi@usp.br>
[ Upstream commit 947eb6f0a274f8b15a0248051a65b069effd5057 ]
ams_event_to_channel() may return a pointer past the end of
dev->channels when no matching scan_index is found. This can lead
to invalid memory access in ams_handle_event().
Add a bounds check in ams_event_to_channel() and return NULL when
no channel is found. Also guard the caller to safely handle this
case.
Fixes: d5c70627a794 ("iio: adc: Add Xilinx AMS driver")
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br>
Reviewed-by: Salih Erim <salih.erim@amd.com>
Tested-by: Salih Erim <salih.erim@amd.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/xilinx-ams.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/iio/adc/xilinx-ams.c b/drivers/iio/adc/xilinx-ams.c
index 5de86a953d4182..b704f76592eab6 100644
--- a/drivers/iio/adc/xilinx-ams.c
+++ b/drivers/iio/adc/xilinx-ams.c
@@ -861,6 +861,9 @@ static const struct iio_chan_spec *ams_event_to_channel(struct iio_dev *dev,
if (dev->channels[i].scan_index == scan_index)
break;
+ if (i == dev->num_channels)
+ return NULL;
+
return &dev->channels[i];
}
@@ -1002,6 +1005,8 @@ static void ams_handle_event(struct iio_dev *indio_dev, u32 event)
const struct iio_chan_spec *chan;
chan = ams_event_to_channel(indio_dev, event);
+ if (!chan)
+ return;
if (chan->type == IIO_TEMP) {
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0627/1266] iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0626/1266] iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0628/1266] iio: tcs3472: power down chip on probe failure Greg Kroah-Hartman
` (371 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanjay Chitroda, Jonathan Cameron,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
[ Upstream commit 5bdff291d20c31b365d9ddfe9c426fbfb41da5bb ]
Currently, If i2c_smbus_read_i2c_block_data() fails but
mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0.
As a result, the caller mma8452_read_raw() assumes the read was
successful and proceeds to use a buffer containing uninitialized
stack memory.
Add proper checking of the I2C read return value and propagate errors
to the caller.
Fixes: 96c0cb2bbfe0 ("iio: mma8452: add support for runtime power management")
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma8452.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 16a0de6002be05..b7ffdbfe2f0942 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -254,6 +254,8 @@ static int mma8452_read(struct mma8452_data *data, __be16 buf[3])
ret = i2c_smbus_read_i2c_block_data(data->client, MMA8452_OUT_X,
3 * sizeof(__be16), (u8 *)buf);
+ if (ret < 0)
+ return ret;
ret = mma8452_set_runtime_pm_state(data->client, false);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0628/1266] iio: tcs3472: power down chip on probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0627/1266] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0629/1266] clk: at91: keep securam node alive while mapping it Greg Kroah-Hartman
` (370 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aldo Conte, Jonathan Cameron,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aldo Conte <aldocontelk@gmail.com>
[ Upstream commit b39f3bb9f5580d19bc0c10dea9224d75fed45f1d ]
If tcs3472_probe() fails after enabling the chip (by writing PON | AEN
to the ENABLE register), the error paths return without powering down
the device.
Add an 'error_powerdown' label at the end of the cleanup chain that
calls tcs3472_powerdown() to power down the chip. The existing label
cascade is rerouted to fall through to the new label.
Move tcs3472_powerdown() above tcs3472_probe() so the probe can call
it without a forward declaration.
Found by code inspection while reviewing the probe error paths in
preparation for the devm_ conversion.
Fixes: eb869ade30a6 ("iio: Add tcs3472 color light sensor driver")
Signed-off-by: Aldo Conte <aldocontelk@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/tcs3472.c | 38 +++++++++++++++++++------------------
1 file changed, 20 insertions(+), 18 deletions(-)
diff --git a/drivers/iio/light/tcs3472.c b/drivers/iio/light/tcs3472.c
index 75fcf2c93717b6..ab8478c9b04549 100644
--- a/drivers/iio/light/tcs3472.c
+++ b/drivers/iio/light/tcs3472.c
@@ -442,6 +442,23 @@ static const struct iio_info tcs3472_info = {
.attrs = &tcs3472_attribute_group,
};
+static int tcs3472_powerdown(struct tcs3472_data *data)
+{
+ int ret;
+ u8 enable_mask = TCS3472_ENABLE_AEN | TCS3472_ENABLE_PON;
+
+ mutex_lock(&data->lock);
+
+ ret = i2c_smbus_write_byte_data(data->client, TCS3472_ENABLE,
+ data->enable & ~enable_mask);
+ if (!ret)
+ data->enable &= ~enable_mask;
+
+ mutex_unlock(&data->lock);
+
+ return ret;
+}
+
static int tcs3472_probe(struct i2c_client *client)
{
struct tcs3472_data *data;
@@ -515,7 +532,7 @@ static int tcs3472_probe(struct i2c_client *client)
ret = iio_triggered_buffer_setup(indio_dev, NULL,
tcs3472_trigger_handler, NULL);
if (ret < 0)
- return ret;
+ goto error_powerdown;
if (client->irq) {
ret = request_threaded_irq(client->irq, NULL,
@@ -538,23 +555,8 @@ static int tcs3472_probe(struct i2c_client *client)
free_irq(client->irq, indio_dev);
buffer_cleanup:
iio_triggered_buffer_cleanup(indio_dev);
- return ret;
-}
-
-static int tcs3472_powerdown(struct tcs3472_data *data)
-{
- int ret;
- u8 enable_mask = TCS3472_ENABLE_AEN | TCS3472_ENABLE_PON;
-
- mutex_lock(&data->lock);
-
- ret = i2c_smbus_write_byte_data(data->client, TCS3472_ENABLE,
- data->enable & ~enable_mask);
- if (!ret)
- data->enable &= ~enable_mask;
-
- mutex_unlock(&data->lock);
-
+error_powerdown:
+ tcs3472_powerdown(data);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0629/1266] clk: at91: keep securam node alive while mapping it
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0628/1266] iio: tcs3472: power down chip on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0630/1266] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
` (369 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Alexandre Belloni,
Claudiu Beznea, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 22fa1c39ba6fe726b547c877c924379b7fee260a ]
pmc_register_ops() gets an owned reference to the
"atmel,sama5d2-securam" node with of_find_compatible_node(). The
success path dropped that reference before passing the node to
of_iomap(), leaving of_iomap() to consume a node pointer after the caller
had released its reference.
Move of_node_put() after of_iomap() so the node remains referenced for
the mapping operation. The unavailable-node error path already releases
the reference.
Fixes: 4d21be864092 ("clk: at91: pmc: execute suspend/resume only for backup mode")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://patch.msgid.link/20260529042051.1626978-1-dbgh9129@gmail.com
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/at91/pmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c
index 5aa9c1f1c8866d..40bdc1c80ab086 100644
--- a/drivers/clk/at91/pmc.c
+++ b/drivers/clk/at91/pmc.c
@@ -176,9 +176,9 @@ static int __init pmc_register_ops(void)
of_node_put(np);
return -ENODEV;
}
- of_node_put(np);
at91_pmc_backup_suspend = of_iomap(np, 0);
+ of_node_put(np);
if (!at91_pmc_backup_suspend) {
pr_warn("%s(): unable to map securam\n", __func__);
return -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0630/1266] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0629/1266] clk: at91: keep securam node alive while mapping it Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0631/1266] fs/ntfs3: add bounds check to run_get_highest_vcn() Greg Kroah-Hartman
` (368 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev, Benjamin Tissoires,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit f22a5db8a7d38152556f230d6d68e59dbc27971b ]
The @dev member described in the kernel-doc does not exist in the
struct. Remove the stale entry.
Fixes: 0610430e3dea ("HID: logitech-hidpp: add input_device ptr to struct hidpp_device")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 113307157a27bd..eba52b95ad1bde 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -163,7 +163,6 @@ struct hidpp_battery {
/**
* struct hidpp_scroll_counter - Utility class for processing high-resolution
* scroll events.
- * @dev: the input device for which events should be reported.
* @wheel_multiplier: the scalar multiplier to be applied to each wheel event
* @remainder: counts the number of high-resolution units moved since the last
* low-resolution event (REL_WHEEL or REL_HWHEEL) was sent. Should
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0631/1266] fs/ntfs3: add bounds check to run_get_highest_vcn()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0630/1266] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0632/1266] fs/ntfs3: fix mount failure on 64K page-size kernels Greg Kroah-Hartman
` (367 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jaeyeong Lee, Konstantin Komarov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit bb11485a87fbb2254b62cfed630b699d50e57da8 ]
run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without
any length bound, relying solely on a 0x00 terminator to stop. A
crafted $LogFile UpdateMappingPairs record whose embedded attribute
contains mapping-pairs runs without a terminator causes the function to
read past the slab allocation, triggering a KASAN slab-out-of-bounds
read on mount.
The sibling function run_unpack() received an analogous bounds-check in
commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"),
but run_get_highest_vcn() was missed.
Take a run_buf_size parameter and reject any run header whose payload
would extend past the buffer end, mirroring the pattern used by
run_unpack(). The caller in fslog.c passes the remaining attribute
bytes after the mapping-pairs offset.
KASAN report (on mainline v7.1 merge window HEAD):
BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410
Read of size 1 at addr ffff88800e2d5400 by task mount/72
Call Trace:
run_get_highest_vcn+0x3c0/0x410
do_action.isra.0+0x3ba8/0x7b50
log_replay+0x9ddd/0x10200
ntfs_loadlog_and_replay+0x4ad/0x610
ntfs_fill_super+0x214a/0x4540
Fixes: b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()")
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 5 ++++-
fs/ntfs3/ntfs_fs.h | 3 ++-
fs/ntfs3/run.c | 9 +++++++--
3 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 72ed04809ec86e..5d652d5775ba37 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3364,7 +3364,10 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
memmove(Add2Ptr(attr, aoff), data, dlen);
if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
- attr_run(attr), &t64)) {
+ attr_run(attr),
+ le32_to_cpu(attr->size) -
+ le16_to_cpu(attr->nres.run_off),
+ &t64)) {
goto dirty_vol;
}
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index e534095078e89f..68c4fe1bf8a5fb 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -816,7 +816,8 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
#else
#define run_unpack_ex run_unpack
#endif
-int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn);
+int run_get_highest_vcn(CLST vcn, const u8 *run_buf, size_t run_buf_size,
+ u64 *highest_vcn);
int run_clone(const struct runs_tree *run, struct runs_tree *new_run);
/* Globals from super.c */
diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index f2451eaf928af8..535a094e822ee3 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -1155,18 +1155,23 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
* Return the highest vcn from a mapping pairs array
* it used while replaying log file.
*/
-int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+int run_get_highest_vcn(CLST vcn, const u8 *run_buf, size_t run_buf_size,
+ u64 *highest_vcn)
{
+ const u8 *run_last = run_buf + run_buf_size;
u64 vcn64 = vcn;
u8 size_size;
- while ((size_size = *run_buf & 0xF)) {
+ while (run_buf < run_last && (size_size = *run_buf & 0xF)) {
u8 offset_size = *run_buf++ >> 4;
u64 len;
if (size_size > 8 || offset_size > 8)
return -EINVAL;
+ if (run_buf + size_size + offset_size > run_last)
+ return -EINVAL;
+
len = run_unpack_s64(run_buf, size_size, 0);
if (!len)
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0632/1266] fs/ntfs3: fix mount failure on 64K page-size kernels
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0631/1266] fs/ntfs3: add bounds check to run_get_highest_vcn() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0633/1266] drm/amd/display: Add missing kdoc for ALLM parameters Greg Kroah-Hartman
` (366 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew R. Ochs, Jamie Nguyen,
Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Nguyen <jamien@nvidia.com>
[ Upstream commit b7a9125cac8645245d2473c6c0a50e338280ad23 ]
On 64K page-size kernels, mounting NTFS volumes smaller than ~650 MB
fails with EINVAL. The issue is in log_replay(): the initial log page
size probe uses PAGE_SIZE (65536) instead of DefaultLogPageSize (4096)
when PAGE_SIZE exceeds DefaultLogPageSize * 2.
This makes norm_file_page() require the $LogFile to be at least
50 * 65536 = 3.2 MB, but mkfs.ntfs creates a $LogFile of only ~1.5 MB
for a typical 300 MB volume. norm_file_page() returns 0 and the mount
is rejected with EINVAL.
On 4K kernels the #if guard evaluates to true, so use_default=true is
passed and DefaultLogPageSize (4096) is used, requiring only ~200 KB.
This path works fine.
Fix this by always passing use_default=true, which forces the initial
probe to use DefaultLogPageSize regardless of the kernel's PAGE_SIZE.
This is safe because, after reading the on-disk restart area, log_replay()
already re-adjusts log->page_size to match the volume's actual
sys_page_size.
Also fix read_log_page() to pass log->page_size instead of PAGE_SIZE to
ntfs_fix_post_read(), matching the actual buffer size.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Tested-by: Matthew R. Ochs <mochs@nvidia.com>
Signed-off-by: Jamie Nguyen <jamien@nvidia.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 5d652d5775ba37..9175f53cb938cc 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -1170,7 +1170,7 @@ static int read_log_page(struct ntfs_log *log, u32 vbo,
goto out;
if (page_buf->rhdr.sign != NTFS_FFFF_SIGNATURE)
- ntfs_fix_post_read(&page_buf->rhdr, PAGE_SIZE, false);
+ ntfs_fix_post_read(&page_buf->rhdr, log->page_size, false);
if (page_buf != *buffer)
memcpy(*buffer, Add2Ptr(page_buf, page_off), bytes);
@@ -3800,11 +3800,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
log->l_size = log->orig_file_size = ni->vfs_inode.i_size;
/* Get the size of page. NOTE: To replay we can use default page. */
-#if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2
log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true);
-#else
- log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false);
-#endif
if (!log->page_size) {
err = -EINVAL;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0633/1266] drm/amd/display: Add missing kdoc for ALLM parameters
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0632/1266] fs/ntfs3: fix mount failure on 64K page-size kernels Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0634/1266] dmaengine: imx-sdma: Refine spba bus searching in probe Greg Kroah-Hartman
` (365 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roman Li, Alex Hung, Tom Chung,
Aurabindo Pillai, Wayne Lin, Nicholas Kazlauskas,
Bhawanpreet Lakha, Srinivasan Shanmugam, Alex Deucher,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit d4c6ec729fb7a8bf8a27b19bd70a1b945ad93dac ]
Add descriptions for the missing parameters for ALLMEnabled and
ALLMValue to keep the function documentation synchronized with the
function prototype mod_build_hf_vsif_infopacket().
Fixes the below with gcc W=1:
../display/modules/info_packet/info_packet.c:507 function parameter 'ALLMEnabled' not described in 'mod_build_hf_vsif_infopacket'
../display/modules/info_packet/info_packet.c:507 function parameter 'ALLMValue' not described in 'mod_build_hf_vsif_infopacket'
Fixes: 3c2381b92cba ("drm/amd/display: add support for VSIP info packet")
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Wayne Lin <Wayne.Lin@amd.com>
Cc: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Cc: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
index 84f9b412a4f117..dbb62b911c75c1 100644
--- a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
+++ b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
@@ -447,6 +447,8 @@ void mod_build_vsc_infopacket(const struct dc_stream_state *stream,
*
* @stream: contains data we may need to construct VSIF (i.e. timing_3d_format, etc.)
* @info_packet: output structure where to store VSIF
+ * @ALLMEnabled: indicates whether ALLM HF-VSIF should be generated
+ * @ALLMValue: ALLM bit value to advertise in HF-VSIF
*/
void mod_build_hf_vsif_infopacket(const struct dc_stream_state *stream,
struct dc_info_packet *info_packet)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0634/1266] dmaengine: imx-sdma: Refine spba bus searching in probe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0633/1266] drm/amd/display: Add missing kdoc for ALLM parameters Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0635/1266] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
` (364 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Frank Li, Vinod Koul,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit d52d42e2e5d9f13166e81ac837ebb023d1306e61 ]
There are multi spba-busses for i.MX8M* platforms, if only search for
the first spba-bus in DT, the found spba-bus may not the real bus of
audio devices, which cause issue for sdma p2p case, as the sdma p2p
script presently does not deal with the transactions involving two devices
connected to the AIPS bus.
Search the SDMA parent node first, which should be the AIPS bus, then
search the child node whose compatible string is spba-bus under that AIPS
bus for the above multi spba-busses case.
Fixes: 8391ecf465ec ("dmaengine: imx-sdma: Add device to device support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260407032755.2758049-1-shengjiu.wang@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/imx-sdma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 51012bd399002d..2d1600b797f8ff 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -2321,7 +2321,9 @@ static int sdma_probe(struct platform_device *pdev)
goto err_register;
}
- spba_bus = of_find_compatible_node(NULL, NULL, "fsl,spba-bus");
+ struct device_node *sdma_parent_np __free(device_node) = of_get_parent(np);
+
+ spba_bus = of_get_compatible_child(sdma_parent_np, "fsl,spba-bus");
ret = of_address_to_resource(spba_bus, 0, &spba_res);
if (!ret) {
sdma->spba_start_addr = spba_res.start;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0635/1266] perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0634/1266] dmaengine: imx-sdma: Refine spba bus searching in probe Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0636/1266] perf tools: Guard test_bit from out-of-bounds sample CPU Greg Kroah-Hartman
` (363 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rui Qi, Namhyung Kim, Adrian Hunter,
Alexander Shishkin, Ian Rogers, Ingo Molnar, James Clark,
Jiri Olsa, Mark Rutland, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Qi <qirui.001@bytedance.com>
[ Upstream commit 68018df3f55eba96a20dd703f5f276a6518f4963 ]
In kallsyms__parse(), the loop reading symbol names iterates with i <
sizeof(symbol_name), which allows i to reach sizeof(symbol_name) upon
loop exit. The subsequent symbol_name[i] = '\0' then writes one byte
past the end of the stack-allocated symbol_name[] array.
Fix this by changing the loop bound to KSYM_NAME_LEN, so the null
terminator always lands within the array. The overflow is triggerable by
a kallsyms entry with a symbol name of KSYM_NAME_LEN+1 or more
characters (e.g., long Rust mangled names or a malicious
/proc/kallsyms).
Fixes: 53df2b9344128984 ("libsymbols kallsyms: Parse using io api")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/symbol/kallsyms.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c
index e335ac2b9e1972..d64bd9cc82a90e 100644
--- a/tools/lib/symbol/kallsyms.c
+++ b/tools/lib/symbol/kallsyms.c
@@ -60,7 +60,7 @@ int kallsyms__parse(const char *filename, void *arg,
read_to_eol(&io);
continue;
}
- for (i = 0; i < sizeof(symbol_name); i++) {
+ for (i = 0; i < KSYM_NAME_LEN; i++) {
ch = io__get_char(&io);
if (ch < 0 || ch == '\n')
break;
@@ -68,6 +68,9 @@ int kallsyms__parse(const char *filename, void *arg,
}
symbol_name[i] = '\0';
+ if (i == KSYM_NAME_LEN)
+ read_to_eol(&io);
+
err = process_symbol(arg, symbol_name, symbol_type, start);
if (err)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0636/1266] perf tools: Guard test_bit from out-of-bounds sample CPU
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0635/1266] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0637/1266] perf sched: Replace BUG_ON on invalid CPU with graceful skip Greg Kroah-Hartman
` (362 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anton Blanchard, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit a5498ccf8079fc91c938f122ff9697b0c526b2fd ]
When PERF_SAMPLE_CPU is absent from a perf.data file, sample->cpu is
initialized to (u32)-1 by evsel__parse_sample(). Five call sites pass
this value directly to test_bit(sample->cpu, cpu_bitmap), reading
massively out of bounds past the DECLARE_BITMAP(..., MAX_NR_CPUS)
allocation of 4096 bits.
Add a sample->cpu >= MAX_NR_CPUS guard before each test_bit() call,
matching the existing safe pattern in builtin-kwork.c. This catches
both the (u32)-1 sentinel and any corrupted CPU value exceeding the
bitmap size.
Fixes: 5d67be97f890 ("perf report/annotate/script: Add option to specify a CPU range")
Cc: Anton Blanchard <anton@samba.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-annotate.c | 3 ++-
tools/perf/builtin-diff.c | 3 ++-
tools/perf/builtin-report.c | 3 ++-
tools/perf/builtin-sched.c | 6 ++++--
4 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 0f1e5787b4edac..e572043be2dbb8 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -287,7 +287,8 @@ static int process_sample_event(struct perf_tool *tool,
goto out_put;
}
- if (ann->cpu_list && !test_bit(sample->cpu, ann->cpu_bitmap))
+ if (ann->cpu_list && (sample->cpu >= MAX_NR_CPUS ||
+ !test_bit(sample->cpu, ann->cpu_bitmap)))
goto out_put;
if (!al.filtered &&
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 57d300d8e5700c..41f557fcc5567f 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -417,7 +417,8 @@ static int diff__process_sample_event(struct perf_tool *tool,
goto out;
}
- if (cpu_list && !test_bit(sample->cpu, cpu_bitmap)) {
+ if (cpu_list && (sample->cpu >= MAX_NR_CPUS ||
+ !test_bit(sample->cpu, cpu_bitmap))) {
ret = 0;
goto out;
}
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 54b06db597862f..eed8a2621d01f7 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -298,7 +298,8 @@ static int process_sample_event(struct perf_tool *tool,
if (symbol_conf.hide_unresolved && al.sym == NULL)
goto out_put;
- if (rep->cpu_list && !test_bit(sample->cpu, rep->cpu_bitmap))
+ if (rep->cpu_list && (sample->cpu >= MAX_NR_CPUS ||
+ !test_bit(sample->cpu, rep->cpu_bitmap)))
goto out_put;
if (sort__mode == SORT_MODE__BRANCH) {
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 1a22314094e6ad..942fde8a1d52e3 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -2085,7 +2085,8 @@ static void timehist_print_sample(struct perf_sched *sched,
char nstr[30];
u64 wait_time;
- if (cpu_list && !test_bit(sample->cpu, cpu_bitmap))
+ if (cpu_list && (sample->cpu >= MAX_NR_CPUS ||
+ !test_bit(sample->cpu, cpu_bitmap)))
return;
timestamp__scnprintf_usec(t, tstr, sizeof(tstr));
@@ -2671,7 +2672,8 @@ static int timehist_sched_change_event(struct perf_tool *tool,
}
if (!sched->idle_hist || thread__tid(thread) == 0) {
- if (!cpu_list || test_bit(sample->cpu, cpu_bitmap))
+ if (!cpu_list || (sample->cpu < MAX_NR_CPUS &&
+ test_bit(sample->cpu, cpu_bitmap)))
timehist_update_runtime_stats(tr, t, tprev);
if (sched->idle_hist) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0637/1266] perf sched: Replace BUG_ON on invalid CPU with graceful skip
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0636/1266] perf tools: Guard test_bit from out-of-bounds sample CPU Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0638/1266] perf sched: Fix NULL dereference in latency_runtime_event Greg Kroah-Hartman
` (361 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Arnaldo Carvalho de Melo,
Sasha Levin, sashiko-bot
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 1e2c83f732deb329ebce23e26cbc482f4c4bf194 ]
latency_switch_event(), latency_runtime_event(), and map_switch_event()
use BUG_ON(cpu >= MAX_CPUS || cpu < 0) to validate the sample CPU.
When PERF_SAMPLE_CPU is absent from the sample type,
evsel__parse_sample() initializes sample->cpu to (u32)-1. Casting
this to int yields -1, which triggers the BUG_ON and aborts perf sched.
The central CPU validation in perf_session__deliver_event() intentionally
preserves the (u32)-1 sentinel for downstream tools like perf script
and perf inject, so leaf callbacks must handle it themselves.
Replace the three BUG_ON calls with graceful skips using pr_warning(),
matching the existing pattern in process_sched_switch_event() and
process_sched_runtime_event() earlier in the same file. Include the
file offset for cross-referencing with perf report -D.
Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 8cbca8a480e1 ("perf sched: Fix NULL dereference in latency_runtime_event")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 942fde8a1d52e3..9e9bb19f0bc98b 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -1154,7 +1154,12 @@ static int latency_switch_event(struct perf_sched *sched,
int cpu = sample->cpu, err = -1;
s64 delta;
- BUG_ON(cpu >= MAX_CPUS || cpu < 0);
+ /* perf.data is untrusted input — CPU may be absent or corrupted */
+ if (cpu >= MAX_CPUS || cpu < 0) {
+ pr_warning("WARNING: at offset %#" PRIx64 ": out-of-bound sample CPU %d, skipping sample\n",
+ sample->file_offset, cpu);
+ return 0;
+ }
timestamp0 = sched->cpu_last_switched[cpu];
sched->cpu_last_switched[cpu] = timestamp;
@@ -1225,7 +1230,13 @@ static int latency_runtime_event(struct perf_sched *sched,
if (thread == NULL)
return -1;
- BUG_ON(cpu >= MAX_CPUS || cpu < 0);
+ /* perf.data is untrusted input — CPU may be absent or corrupted */
+ if (cpu >= MAX_CPUS || cpu < 0) {
+ pr_warning("WARNING: at offset %#" PRIx64 ": out-of-bound sample CPU %d, skipping sample\n",
+ sample->file_offset, cpu);
+ err = 0;
+ goto out_put;
+ }
if (!atoms) {
if (thread_atoms_insert(sched, thread))
goto out_put;
@@ -1596,7 +1607,12 @@ static int map_switch_event(struct perf_sched *sched, struct evsel *evsel,
const char *color = PERF_COLOR_NORMAL;
char stimestamp[32];
- BUG_ON(this_cpu.cpu >= MAX_CPUS || this_cpu.cpu < 0);
+ /* perf.data is untrusted input — CPU may be absent or corrupted */
+ if (this_cpu.cpu >= MAX_CPUS || this_cpu.cpu < 0) {
+ pr_warning("WARNING: at offset %#" PRIx64 ": out-of-bound sample CPU %d, skipping sample\n",
+ sample->file_offset, this_cpu.cpu);
+ return 0;
+ }
if (this_cpu.cpu > sched->max_cpu.cpu)
sched->max_cpu = this_cpu;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0638/1266] perf sched: Fix NULL dereference in latency_runtime_event
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0637/1266] perf sched: Replace BUG_ON on invalid CPU with graceful skip Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0639/1266] perf tools: Add bounds check to cpu__get_node() Greg Kroah-Hartman
` (360 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 8cbca8a480e15f6326ce94287570993f27a4b2d5 ]
latency_runtime_event() passes the return value of
machine__findnew_thread() directly to thread_atoms_search() at line
1216, before checking for NULL at line 1220. thread_atoms_search()
calls pid_cmp() which dereferences the thread pointer via
thread__tid(), causing a NULL pointer dereference if the allocation
fails.
All other callers of thread_atoms_search() in this file
(latency_switch_event, latency_wakeup_event,
latency_migrate_task_event) correctly check for NULL first.
Move the atoms assignment after the NULL check to match the pattern
used by the other callers.
Fixes: b91fc39f4ad7 ("perf machine: Protect the machine->threads with a rwlock")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 9e9bb19f0bc98b..6df0d1252f197f 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -1223,13 +1223,15 @@ static int latency_runtime_event(struct perf_sched *sched,
const u32 pid = evsel__intval(evsel, sample, "pid");
const u64 runtime = evsel__intval(evsel, sample, "runtime");
struct thread *thread = machine__findnew_thread(machine, -1, pid);
- struct work_atoms *atoms = thread_atoms_search(&sched->atom_root, thread, &sched->cmp_pid);
+ struct work_atoms *atoms;
u64 timestamp = sample->time;
int cpu = sample->cpu, err = -1;
if (thread == NULL)
return -1;
+ atoms = thread_atoms_search(&sched->atom_root, thread, &sched->cmp_pid);
+
/* perf.data is untrusted input — CPU may be absent or corrupted */
if (cpu >= MAX_CPUS || cpu < 0) {
pr_warning("WARNING: at offset %#" PRIx64 ": out-of-bound sample CPU %d, skipping sample\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0639/1266] perf tools: Add bounds check to cpu__get_node()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0638/1266] perf sched: Fix NULL dereference in latency_runtime_event Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0640/1266] perf mmap: Guard cpu__get_node() return in aio_bind() Greg Kroah-Hartman
` (359 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 1e7921d7227de5da0dfc167943092c823ec7e49b ]
cpu__get_node() accesses cpunode_map[cpu.cpu] without checking against
max_cpu_num, the allocation size of cpunode_map. Callers such as
builtin-kmem.c:evsel__process_alloc_event() pass sample->cpu from
perf.data events, which may exceed the host's CPU count when analyzing
cross-machine recordings.
Add a bounds check against max_cpu_num before indexing, returning -1
for out-of-range values. This is a central fix that protects all
callers.
Fixes: 86895b480a2f ("perf stat: Add --per-node agregation support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cpumap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 0e090e8bc33491..75d9f5d6d185d1 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -498,6 +498,10 @@ int cpu__get_node(struct perf_cpu cpu)
return -1;
}
+ /* cpunode_map allocated for max_cpu_num entries; input may be untrusted */
+ if (cpu.cpu < 0 || cpu.cpu >= max_cpu_num.cpu)
+ return -1;
+
return cpunode_map[cpu.cpu];
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0640/1266] perf mmap: Guard cpu__get_node() return in aio_bind()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0639/1266] perf tools: Add bounds check to cpu__get_node() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0641/1266] perf c2c: Bounds-check CPU and node IDs before bitmap and array access Greg Kroah-Hartman
` (358 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Alexey Budankov,
Jiri Olsa, Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit f32dc302a090f48893477ef297a888db109ec0bd ]
perf_mmap__aio_bind() passes the cpu__get_node() return value directly
to an unsigned long variable (node_index). When cpu__get_node() returns
-1 for an unknown CPU, the implicit int-to-unsigned-long conversion
sign-extends it to ULONG_MAX.
This causes bitmap_zalloc(ULONG_MAX + 1) which wraps to
bitmap_zalloc(0), returning a zero-sized allocation. The subsequent
__set_bit(ULONG_MAX, node_mask) then writes massively out of bounds.
Check the return value in a signed temporary before assigning to
node_index, and skip the NUMA binding when the node is unknown.
Fixes: c44a8b44ca9f ("perf record: Bind the AIO user space buffers to nodes")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/mmap.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 49093b21ee2da0..99f6235dd16afd 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -103,9 +103,15 @@ static int perf_mmap__aio_bind(struct mmap *map, int idx, struct perf_cpu cpu, i
int err = 0;
if (affinity != PERF_AFFINITY_SYS && cpu__max_node() > 1) {
+ int node;
+
data = map->aio.data[idx];
mmap_len = mmap__mmap_len(map);
- node_index = cpu__get_node(cpu);
+ node = cpu__get_node(cpu);
+ /* -1 sign-extends to ULONG_MAX, wrapping bitmap_zalloc(0) and OOB __set_bit */
+ if (node < 0)
+ return 0;
+ node_index = node;
node_mask = bitmap_zalloc(node_index + 1);
if (!node_mask) {
pr_err("Failed to allocate node mask for mbind: error %m\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0641/1266] perf c2c: Bounds-check CPU and node IDs before bitmap and array access
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0640/1266] perf mmap: Guard cpu__get_node() return in aio_bind() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0642/1266] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
` (357 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 65117c3da50f749f4c22eb7a7effc53453dff57f ]
c2c_he__set_cpu() passes sample->cpu directly to __set_bit(cpu, cpuset)
after only checking for the (u32)-1 sentinel. The cpuset bitmap is
allocated with c2c.cpus_cnt bits (from env->nr_cpus_avail), so a crafted
perf.data with CPU IDs exceeding that count causes out-of-bounds heap
writes.
c2c_he__set_node() similarly passes the node ID from mem2node__node()
to __set_bit(node, nodeset) after only checking for negative values.
The nodeset bitmap is sized to c2c.nodes_cnt (from env->nr_numa_nodes),
so a node ID exceeding that causes OOB writes.
process_sample_event() indexes c2c.cpu2node[cpu] and
c2c_he->node_stats[node] without bounds checking. Both arrays are
sized to c2c.cpus_cnt and c2c.nodes_cnt respectively.
Add bounds checks in all three paths:
- c2c_he__set_cpu(): return if sample->cpu >= c2c.cpus_cnt
- c2c_he__set_node(): return if node >= c2c.nodes_cnt
- process_sample_event(): clamp cpu to 0 if >= cpus_cnt,
guard node_stats access with bounds check
Fixes: 1e181b92a2da ("perf c2c report: Add 'node' sort key")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-c2c.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index a4cf9de7a7b5a9..207b9c863aeea5 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -229,6 +229,10 @@ static void c2c_he__set_cpu(struct c2c_hist_entry *c2c_he,
"WARNING: no sample cpu value"))
return;
+ /* cpuset bitmap has c2c.cpus_cnt bits from env->nr_cpus_avail */
+ if (sample->cpu >= (unsigned int)c2c.cpus_cnt)
+ return;
+
__set_bit(sample->cpu, c2c_he->cpuset);
}
@@ -246,6 +250,10 @@ static void c2c_he__set_node(struct c2c_hist_entry *c2c_he,
if (WARN_ONCE(node < 0, "WARNING: failed to find node\n"))
return;
+ /* nodeset bitmap has c2c.nodes_cnt bits from env->nr_numa_nodes */
+ if (node >= c2c.nodes_cnt)
+ return;
+
__set_bit(node, c2c_he->nodeset);
if (c2c_he->paddr != sample->phys_addr) {
@@ -345,7 +353,12 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
* Doing node stats only for single callchain data.
*/
int cpu = sample->cpu == (unsigned int) -1 ? 0 : sample->cpu;
- int node = c2c.cpu2node[cpu];
+ int node;
+
+ /* cpu2node[] has c2c.cpus_cnt entries; large u32 wraps signed negative */
+ if (cpu < 0 || cpu >= c2c.cpus_cnt)
+ cpu = 0;
+ node = c2c.cpu2node[cpu];
mi = mi_dup;
@@ -362,7 +375,9 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
c2c_he = container_of(he, struct c2c_hist_entry, he);
c2c_add_stats(&c2c_he->stats, &stats);
c2c_add_stats(&c2c_hists->stats, &stats);
- c2c_add_stats(&c2c_he->node_stats[node], &stats);
+ /* node_stats[] has c2c.nodes_cnt entries */
+ if (node >= 0 && node < c2c.nodes_cnt)
+ c2c_add_stats(&c2c_he->node_stats[node], &stats);
compute_stats(c2c_he, &stats, sample->weight);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0642/1266] perf sched: Clean up idle_threads entry on init failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0641/1266] perf c2c: Bounds-check CPU and node IDs before bitmap and array access Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0643/1266] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
` (356 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, David Ahern,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit cda5a94ad9181cd60cbf04be11d524201bf489a2 ]
get_idle_thread() allocates a thread via thread__new() and stores it in
idle_threads[cpu], then calls init_idle_thread() to set up the private
data. If init_idle_thread() fails (e.g. OOM for the idle_thread_runtime
struct), the function returns NULL but leaves the partially initialized
thread in idle_threads[cpu].
On subsequent calls for the same CPU, get_idle_thread() finds a non-NULL
idle_threads[cpu], skips allocation, and returns thread__get() on a
thread that has no priv data. Callers then get a thread whose
thread__priv() returns NULL, leading to unexpected behavior.
Release the thread and reset the slot to NULL on init failure so the
entry doesn't persist in a corrupted state.
Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 6df0d1252f197f..0a1a58f33ae651 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -2372,8 +2372,11 @@ static struct thread *get_idle_thread(int cpu)
idle_threads[cpu] = thread__new(0, 0);
if (idle_threads[cpu]) {
- if (init_idle_thread(idle_threads[cpu]) < 0)
+ if (init_idle_thread(idle_threads[cpu]) < 0) {
+ /* clean up so next call doesn't find a half-initialized thread */
+ thread__zput(idle_threads[cpu]);
return NULL;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0643/1266] perf sched: Replace BUG_ON and add NULL checks in replay event helpers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 6.6 0642/1266] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0644/1266] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
` (355 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ingo Molnar,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 75eafe4a3a93a0143a20c0cc286bfb9008ac1478 ]
get_new_event() has three issues:
1. The zalloc() result is dereferenced without a NULL check, crashing
on allocation failure.
2. BUG_ON(!task->atoms) kills the process when realloc() fails.
Since perf.data is untrusted input, this should be a graceful error.
3. The realloc pattern assigns directly to task->atoms, losing the old
pointer on failure. task->nr_events is also incremented before the
realloc, leaving corrupted state on failure.
Fix get_new_event() to:
- Check the zalloc() result before dereferencing
- Use a temporary for realloc() to avoid losing the old pointer
- Increment nr_events only after successful realloc
- Return NULL instead of calling BUG_ON on failure
Also fix add_sched_event_wakeup() where zalloc() for wait_sem is
passed to sem_init() without a NULL check.
Update all callers (add_sched_event_run, add_sched_event_wakeup,
add_sched_event_sleep) to handle NULL returns by returning early.
The replay may produce incomplete output on OOM but will not crash.
Fixes: ec156764d424 ("perf sched: Import schedbench.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 0a1a58f33ae651..8b1573515c5781 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -363,14 +363,25 @@ get_new_event(struct task_desc *task, u64 timestamp)
struct sched_atom *event = zalloc(sizeof(*event));
unsigned long idx = task->nr_events;
size_t size;
+ struct sched_atom **atoms_p;
+
+ if (event == NULL) {
+ pr_err("ERROR: sched: failed to allocate event\n");
+ return NULL;
+ }
event->timestamp = timestamp;
event->nr = idx;
+ size = sizeof(struct sched_atom *) * (task->nr_events + 1);
+ atoms_p = realloc(task->atoms, size);
+ if (!atoms_p) {
+ pr_err("ERROR: sched: failed to grow atoms array\n");
+ free(event);
+ return NULL;
+ }
+ task->atoms = atoms_p;
task->nr_events++;
- size = sizeof(struct sched_atom *) * task->nr_events;
- task->atoms = realloc(task->atoms, size);
- BUG_ON(!task->atoms);
task->atoms[idx] = event;
@@ -401,6 +412,8 @@ static void add_sched_event_run(struct perf_sched *sched, struct task_desc *task
}
event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
event->type = SCHED_EVENT_RUN;
event->duration = duration;
@@ -414,6 +427,8 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t
struct sched_atom *event, *wakee_event;
event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
event->type = SCHED_EVENT_WAKEUP;
event->wakee = wakee;
@@ -428,6 +443,10 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t
}
wakee_event->wait_sem = zalloc(sizeof(*wakee_event->wait_sem));
+ if (!wakee_event->wait_sem) {
+ pr_err("ERROR: sched: failed to allocate semaphore\n");
+ return;
+ }
sem_init(wakee_event->wait_sem, 0, 0);
wakee_event->specific_wait = 1;
event->wait_sem = wakee_event->wait_sem;
@@ -440,6 +459,9 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta
{
struct sched_atom *event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
+
event->type = SCHED_EVENT_SLEEP;
sched->nr_sleep_events++;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0644/1266] perf mmap: Fix NULL deref in aio cleanup on alloc failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0643/1266] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0645/1266] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
` (354 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Alexey Budankov,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 25627346b10e6a564610ea2c49dc6dd54812226d ]
perf_mmap__aio_mmap() sets map->aio.nr_cblocks before allocating the
data array. If calloc() for aiocb or cblocks fails before the data
array is allocated, the return -1 path leads to perf_mmap__aio_munmap()
which loops nr_cblocks times calling perf_mmap__aio_free(). Both
versions of perf_mmap__aio_free() (NUMA and non-NUMA) dereference
map->aio.data[idx] without checking if data is NULL, causing a NULL
pointer dereference.
Add NULL checks for map->aio.data at the top of both
perf_mmap__aio_free() variants so the cleanup path is safe when
allocation fails partway through perf_mmap__aio_mmap().
Fixes: d3d1af6f011a553a ("perf record: Enable asynchronous trace writing")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/mmap.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 99f6235dd16afd..79178528af10e4 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -88,10 +88,10 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx)
static void perf_mmap__aio_free(struct mmap *map, int idx)
{
- if (map->aio.data[idx]) {
- munmap(map->aio.data[idx], mmap__mmap_len(map));
- map->aio.data[idx] = NULL;
- }
+ if (!map->aio.data || !map->aio.data[idx])
+ return;
+ munmap(map->aio.data[idx], mmap__mmap_len(map));
+ map->aio.data[idx] = NULL;
}
static int perf_mmap__aio_bind(struct mmap *map, int idx, struct perf_cpu cpu, int affinity)
@@ -140,6 +140,8 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx)
static void perf_mmap__aio_free(struct mmap *map, int idx)
{
+ if (!map->aio.data)
+ return;
zfree(&(map->aio.data[idx]));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0645/1266] perf c2c: Fix use-after-free in he__get_c2c_hists() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0644/1266] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0646/1266] dmaengine: qcom: gpi: set DMA_PRIVATE capability Greg Kroah-Hartman
` (353 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 5e5e6196d737c5be03d20647428316b36621608d ]
he__get_c2c_hists() assigns c2c_he->hists before calling
c2c_hists__init(). If init fails, the error path calls free(hists)
but leaves c2c_he->hists pointing to freed memory. On teardown,
c2c_he_free() finds the non-NULL pointer and calls
hists__delete_entries() on it, causing a use-after-free.
Set c2c_he->hists to NULL before freeing so teardown skips the
already-freed allocation.
Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-c2c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index 207b9c863aeea5..96ca35c4f3062c 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -215,6 +215,7 @@ he__get_c2c_hists(struct hist_entry *he,
ret = c2c_hists__init(hists, sort, nr_header_lines);
if (ret) {
+ c2c_he->hists = NULL;
free(hists);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0646/1266] dmaengine: qcom: gpi: set DMA_PRIVATE capability
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0645/1266] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0647/1266] dmaengine: Fix possible use after free Greg Kroah-Hartman
` (352 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Icenowy Zheng, Dmitry Baryshkov,
Vinod Koul, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <zhengxingda@iscas.ac.cn>
[ Upstream commit 4e351f408743354d54ee1af5193fc78234f2044e ]
The GPI DMA controller is only responsible for QUP peripherals, and
cannot work as a general-purpose DMA accelerator.
Set DMA_PRIVATE capability for it.
This fixes error messages about GPI being shown when an async-tx
consumer is loaded.
Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20260602070344.3707256-1-zhengxingda@iscas.ac.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/qcom/gpi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
index 36830efd13f741..a6fc151f8cc120 100644
--- a/drivers/dma/qcom/gpi.c
+++ b/drivers/dma/qcom/gpi.c
@@ -2252,6 +2252,7 @@ static int gpi_probe(struct platform_device *pdev)
/* clear and Set capabilities */
dma_cap_zero(gpi_dev->dma_device.cap_mask);
dma_cap_set(DMA_SLAVE, gpi_dev->dma_device.cap_mask);
+ dma_cap_set(DMA_PRIVATE, gpi_dev->dma_device.cap_mask);
/* configure dmaengine apis */
gpi_dev->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0647/1266] dmaengine: Fix possible use after free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0646/1266] dmaengine: qcom: gpi: set DMA_PRIVATE capability Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0648/1266] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
` (351 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sá, Frank Li, Vinod Koul,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sá <nuno.sa@analog.com>
[ Upstream commit 92f853f0645aebf1d05d333e97ab7c342ace1892 ]
In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.
Fixes it by moving dma_chan_put() after the check.
Fixes: 0f571515c332 ("dmaengine: Add privatecnt to revert DMA_PRIVATE property")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260424-dma-dmac-handle-vunmap-v4-1-90f43412fdc0@analog.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dmaengine.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 491b222402216a..b1c9187602d532 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -905,11 +905,12 @@ void dma_release_channel(struct dma_chan *chan)
mutex_lock(&dma_list_mutex);
WARN_ONCE(chan->client_count != 1,
"chan reference count %d != 1\n", chan->client_count);
- dma_chan_put(chan);
/* drop PRIVATE cap enabled by __dma_request_channel() */
if (--chan->device->privatecnt == 0)
dma_cap_clear(DMA_PRIVATE, chan->device->cap_mask);
+ dma_chan_put(chan);
+
if (chan->slave) {
sysfs_remove_link(&chan->dev->device.kobj, DMA_SLAVE_NAME);
sysfs_remove_link(&chan->slave->kobj, chan->name);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0648/1266] clk: qcom: a53: Corrected frequency multiplier for 1152MHz
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0647/1266] dmaengine: Fix possible use after free Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0649/1266] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
` (350 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phillip Varney, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Varney <pbvarney@protonmail.com>
[ Upstream commit bb56147ea9fce98ebde1d367335ba006cba61fbd ]
The 1152MHz frequency entry for the a53 currently selects a multiplier of 62, giving 1190MHz. This changes the mulitiplier to 60 giving the intended 1152MHz.
Signed-off-by: Phillip Varney <pbvarney@protonmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260605005502.313928-1-pbvarney@protonmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/a53-pll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c
index f9c5e296dba2a0..c878d4001da52d 100644
--- a/drivers/clk/qcom/a53-pll.c
+++ b/drivers/clk/qcom/a53-pll.c
@@ -20,7 +20,7 @@
static const struct pll_freq_tbl a53pll_freq[] = {
{ 998400000, 52, 0x0, 0x1, 0 },
{ 1094400000, 57, 0x0, 0x1, 0 },
- { 1152000000, 62, 0x0, 0x1, 0 },
+ { 1152000000, 60, 0x0, 0x1, 0 },
{ 1209600000, 63, 0x0, 0x1, 0 },
{ 1248000000, 65, 0x0, 0x1, 0 },
{ 1363200000, 71, 0x0, 0x1, 0 },
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0649/1266] pNFS/filelayout: fix cheking if a layout is striped
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0648/1266] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0650/1266] xprtrdma: Remove temp allocation of rpcrdma_rep objects Greg Kroah-Hartman
` (349 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 91668417d4e925c98cae4a55b1b9860380ddbf16 ]
A layout can still be striped with num_fh = 1 as it is perfectly possible
that both MDS and DSs can handle the same filehandle. Hence check according
to stripe_count > 1, which is the correct check to begin with.
We should not be called with flseg->dsaddr = NULL, but if for some reason
we do, return our best guess with is flseg->num_fh > 1.
Fixes: a6b9d2fa0024 ("pNFS/filelayout: Fix coalescing test for single DS")
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/filelayout/filelayout.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 569ae4ec608455..4b4dcd6fe78250 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -786,6 +786,8 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
static bool
filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg)
{
+ if (flseg->dsaddr)
+ return flseg->dsaddr->stripe_count > 1;
return flseg->num_fh > 1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0650/1266] xprtrdma: Remove temp allocation of rpcrdma_rep objects
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0649/1266] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0651/1266] xprtrdma: Avoid 250 ms delay on backlog wakeup Greg Kroah-Hartman
` (348 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Sagi Grimberg,
Anna Schumaker, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 0e13dd9ea8be46f980a46c3ffd8cb786f3e2fb5b ]
The original code was designed so that most calls to
rpcrdma_rep_create() would occur on the NUMA node that the device
preferred. There are a few cases where that's not possible, so
those reps are marked as temporary.
However, we have the device (and its preferred node) already in
rpcrdma_rep_create(), so let's use that to guarantee the memory
is allocated from the correct node.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Stable-dep-of: e786233d2e0b ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 3 +-
net/sunrpc/xprtrdma/verbs.c | 57 ++++++++++++++-------------------
net/sunrpc/xprtrdma/xprt_rdma.h | 3 +-
3 files changed, 26 insertions(+), 37 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 190a4de239c85a..1478c41c7e9da7 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1471,8 +1471,7 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
credits = 1; /* don't deadlock */
else if (credits > r_xprt->rx_ep->re_max_requests)
credits = r_xprt->rx_ep->re_max_requests;
- rpcrdma_post_recvs(r_xprt, credits + (buf->rb_bc_srv_max_requests << 1),
- false);
+ rpcrdma_post_recvs(r_xprt, credits + (buf->rb_bc_srv_max_requests << 1));
if (buf->rb_credits != credits)
rpcrdma_update_cwnd(r_xprt, credits);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 4132a505d742ad..d468ebf6de8062 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -69,13 +69,15 @@ static void rpcrdma_sendctx_put_locked(struct rpcrdma_xprt *r_xprt,
struct rpcrdma_sendctx *sc);
static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt);
static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt);
-static void rpcrdma_rep_destroy(struct rpcrdma_rep *rep);
static void rpcrdma_reps_unmap(struct rpcrdma_xprt *r_xprt);
static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt);
static void rpcrdma_mrs_destroy(struct rpcrdma_xprt *r_xprt);
static void rpcrdma_ep_get(struct rpcrdma_ep *ep);
static int rpcrdma_ep_put(struct rpcrdma_ep *ep);
static struct rpcrdma_regbuf *
+rpcrdma_regbuf_alloc_node(size_t size, enum dma_data_direction direction,
+ int node);
+static struct rpcrdma_regbuf *
rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction);
static void rpcrdma_regbuf_dma_unmap(struct rpcrdma_regbuf *rb);
static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb);
@@ -505,7 +507,7 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
* outstanding Receives.
*/
rpcrdma_ep_get(ep);
- rpcrdma_post_recvs(r_xprt, 1, true);
+ rpcrdma_post_recvs(r_xprt, 1);
rc = rdma_connect(ep->re_id, &ep->re_remote_cma);
if (rc)
@@ -938,18 +940,20 @@ static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt)
}
static noinline
-struct rpcrdma_rep *rpcrdma_rep_create(struct rpcrdma_xprt *r_xprt,
- bool temp)
+struct rpcrdma_rep *rpcrdma_rep_create(struct rpcrdma_xprt *r_xprt)
{
struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+ struct rpcrdma_ep *ep = r_xprt->rx_ep;
+ struct ib_device *device = ep->re_id->device;
struct rpcrdma_rep *rep;
rep = kzalloc(sizeof(*rep), XPRTRDMA_GFP_FLAGS);
if (rep == NULL)
goto out;
- rep->rr_rdmabuf = rpcrdma_regbuf_alloc(r_xprt->rx_ep->re_inline_recv,
- DMA_FROM_DEVICE);
+ rep->rr_rdmabuf = rpcrdma_regbuf_alloc_node(ep->re_inline_recv,
+ DMA_FROM_DEVICE,
+ ibdev_to_node(device));
if (!rep->rr_rdmabuf)
goto out_free;
@@ -964,7 +968,6 @@ struct rpcrdma_rep *rpcrdma_rep_create(struct rpcrdma_xprt *r_xprt,
rep->rr_recv_wr.wr_cqe = &rep->rr_cqe;
rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov;
rep->rr_recv_wr.num_sge = 1;
- rep->rr_temp = temp;
spin_lock(&buf->rb_lock);
list_add(&rep->rr_all, &buf->rb_all_reps);
@@ -983,17 +986,6 @@ static void rpcrdma_rep_free(struct rpcrdma_rep *rep)
kfree(rep);
}
-static void rpcrdma_rep_destroy(struct rpcrdma_rep *rep)
-{
- struct rpcrdma_buffer *buf = &rep->rr_rxprt->rx_buf;
-
- spin_lock(&buf->rb_lock);
- list_del(&rep->rr_all);
- spin_unlock(&buf->rb_lock);
-
- rpcrdma_rep_free(rep);
-}
-
static struct rpcrdma_rep *rpcrdma_rep_get_locked(struct rpcrdma_buffer *buf)
{
struct llist_node *node;
@@ -1025,10 +1017,8 @@ static void rpcrdma_reps_unmap(struct rpcrdma_xprt *r_xprt)
struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
struct rpcrdma_rep *rep;
- list_for_each_entry(rep, &buf->rb_all_reps, rr_all) {
+ list_for_each_entry(rep, &buf->rb_all_reps, rr_all)
rpcrdma_regbuf_dma_unmap(rep->rr_rdmabuf);
- rep->rr_temp = true; /* Mark this rep for destruction */
- }
}
static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf)
@@ -1245,14 +1235,15 @@ void rpcrdma_buffer_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req)
* or Replies they may be registered externally via frwr_map.
*/
static struct rpcrdma_regbuf *
-rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction)
+rpcrdma_regbuf_alloc_node(size_t size, enum dma_data_direction direction,
+ int node)
{
struct rpcrdma_regbuf *rb;
- rb = kmalloc(sizeof(*rb), XPRTRDMA_GFP_FLAGS);
+ rb = kmalloc_node(sizeof(*rb), XPRTRDMA_GFP_FLAGS, node);
if (!rb)
return NULL;
- rb->rg_data = kmalloc(size, XPRTRDMA_GFP_FLAGS);
+ rb->rg_data = kmalloc_node(size, XPRTRDMA_GFP_FLAGS, node);
if (!rb->rg_data) {
kfree(rb);
return NULL;
@@ -1264,6 +1255,12 @@ rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction)
return rb;
}
+static struct rpcrdma_regbuf *
+rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction)
+{
+ return rpcrdma_regbuf_alloc_node(size, direction, NUMA_NO_NODE);
+}
+
/**
* rpcrdma_regbuf_realloc - re-allocate a SEND/RECV buffer
* @rb: regbuf to reallocate
@@ -1341,10 +1338,9 @@ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb)
* rpcrdma_post_recvs - Refill the Receive Queue
* @r_xprt: controlling transport instance
* @needed: current credit grant
- * @temp: mark Receive buffers to be deleted after one use
*
*/
-void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp)
+void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed)
{
struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
struct rpcrdma_ep *ep = r_xprt->rx_ep;
@@ -1358,8 +1354,7 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp)
if (likely(ep->re_receive_count > needed))
goto out;
needed -= ep->re_receive_count;
- if (!temp)
- needed += RPCRDMA_MAX_RECV_BATCH;
+ needed += RPCRDMA_MAX_RECV_BATCH;
if (atomic_inc_return(&ep->re_receiving) > 1)
goto out_dec;
@@ -1368,12 +1363,8 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp)
wr = NULL;
while (needed) {
rep = rpcrdma_rep_get_locked(buf);
- if (rep && rep->rr_temp) {
- rpcrdma_rep_destroy(rep);
- continue;
- }
if (!rep)
- rep = rpcrdma_rep_create(r_xprt, temp);
+ rep = rpcrdma_rep_create(r_xprt);
if (!rep)
break;
if (!rpcrdma_regbuf_dma_map(r_xprt, rep->rr_rdmabuf)) {
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index da409450dfc05c..08bda29ed9535a 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -198,7 +198,6 @@ struct rpcrdma_rep {
__be32 rr_proc;
int rr_wc_flags;
u32 rr_inv_rkey;
- bool rr_temp;
struct rpcrdma_regbuf *rr_rdmabuf;
struct rpcrdma_xprt *rr_rxprt;
struct rpc_rqst *rr_rqst;
@@ -466,7 +465,7 @@ void rpcrdma_flush_disconnect(struct rpcrdma_xprt *r_xprt, struct ib_wc *wc);
int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt);
void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt);
-void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed, bool temp);
+void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed);
/*
* Buffer calls - xprtrdma/verbs.c
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0651/1266] xprtrdma: Avoid 250 ms delay on backlog wakeup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0650/1266] xprtrdma: Remove temp allocation of rpcrdma_rep objects Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0652/1266] xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot Greg Kroah-Hartman
` (347 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Trond Myklebust,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 100142093e22b3f7741ac88e94878bb3694e306f ]
Commit a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting
for memory") changed xprt_rdma_alloc_slot() to set tk_status to
-ENOMEM so that call_reserveresult() would sleep HZ/4 before
retrying. That rationale applies to xprt_dynamic_alloc_slot(),
where an immediate retry under memory pressure wastes CPU, but not
to the RDMA backlog path: a task woken from the backlog has a slot
waiting for it, so the 250 ms rpc_delay adds latency without
benefit.
This also aligns the code with the existing kernel-doc for
xprt_rdma_alloc_slot(), which already documented %-EAGAIN.
Fixes: a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting for memory")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: e786233d2e0b ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 29b0562d62e759..b971776b55936c 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -511,7 +511,7 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
return;
out_sleep:
- task->tk_status = -ENOMEM;
+ task->tk_status = -EAGAIN;
xprt_add_backlog(xprt, task);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0652/1266] xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0651/1266] xprtrdma: Avoid 250 ms delay on backlog wakeup Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0653/1266] xprtrdma: Post receive buffers after RPC completion Greg Kroah-Hartman
` (346 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Trond Myklebust,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 765bde47fe7f197dabeb12da76831f40d0b20377 ]
xprt_rdma_alloc_slot() and xprt_rdma_free_slot() lack serialization
between the buffer pool and the backlog queue. A buffer freed
after rpcrdma_buffer_get() finds the pool empty but before
rpc_sleep_on() places the task on the backlog is returned to the
pool with no waiter to wake, leaving the task stuck on the backlog
indefinitely.
After joining the backlog, re-check the pool and route any
recovered buffer through xprt_wake_up_backlog(), whose queue lock
serializes with concurrent wakeups and avoids double-assignment
of slots.
Because xprt_rdma_free_slot() does not hold reserve_lock, the
XPRT_CONGESTED double-check in xprt_throttle_congested() is
ineffective: a task can join the backlog through that path after
free_slot has already found it empty and cleared the bit. Avoid
this by using xprt_add_backlog_noncongested(), which queues the
task without setting XPRT_CONGESTED, so every allocation reaches
xprt_rdma_alloc_slot() and its post-sleep re-check.
Fixes: edb41e61a54e ("xprtrdma: Make rpc_rqst part of rpcrdma_req")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: e786233d2e0b ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sunrpc/xprt.h | 2 ++
net/sunrpc/xprt.c | 16 ++++++++++++++++
net/sunrpc/xprtrdma/transport.c | 15 ++++++++++++++-
3 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 4ecc89301eb74d..840f77ff83bf1a 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -398,6 +398,8 @@ struct rpc_xprt * xprt_alloc(struct net *net, size_t size,
unsigned int max_req);
void xprt_free(struct rpc_xprt *);
void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task);
+void xprt_add_backlog_noncongested(struct rpc_xprt *xprt,
+ struct rpc_task *task);
bool xprt_wake_up_backlog(struct rpc_xprt *xprt, struct rpc_rqst *req);
void xprt_cleanup_ids(void);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index ab453ede54f0cd..562aa8beae0ecb 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1651,6 +1651,22 @@ void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task)
}
EXPORT_SYMBOL_GPL(xprt_add_backlog);
+/**
+ * xprt_add_backlog_noncongested - queue task on backlog
+ * @xprt: transport whose backlog queue receives the task
+ * @task: task to queue
+ *
+ * Like xprt_add_backlog, but does not set XPRT_CONGESTED.
+ * For transports whose free_slot path does not synchronize
+ * with xprt_throttle_congested via reserve_lock.
+ */
+void xprt_add_backlog_noncongested(struct rpc_xprt *xprt,
+ struct rpc_task *task)
+{
+ rpc_sleep_on(&xprt->backlog, task, xprt_complete_request_init);
+}
+EXPORT_SYMBOL_GPL(xprt_add_backlog_noncongested);
+
static bool __xprt_set_rq(struct rpc_task *task, void *data)
{
struct rpc_rqst *req = data;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index b971776b55936c..cda0af267bd8c8 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -512,7 +512,20 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
out_sleep:
task->tk_status = -EAGAIN;
- xprt_add_backlog(xprt, task);
+ xprt_add_backlog_noncongested(xprt, task);
+ /* A buffer freed between buffer_get and rpc_sleep_on
+ * goes back to the pool with no waiter to wake.
+ * Re-check after joining the backlog to close that gap.
+ */
+ req = rpcrdma_buffer_get(&r_xprt->rx_buf);
+ if (req) {
+ struct rpc_rqst *rqst = &req->rl_slot;
+
+ if (!xprt_wake_up_backlog(xprt, rqst)) {
+ memset(rqst, 0, sizeof(*rqst));
+ rpcrdma_buffer_put(&r_xprt->rx_buf, req);
+ }
+ }
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0653/1266] xprtrdma: Post receive buffers after RPC completion
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0652/1266] xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0654/1266] xprtrdma: Use sendctx DMA state for Send signaling Greg Kroah-Hartman
` (345 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Trond Myklebust,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 ]
rpcrdma_post_recvs() runs in CQ poll context and its cost
falls on the latency-critical path between polling a Receive
completion and waking the RPC consumer. Every cycle spent
refilling the Receive Queue delays delivery of the reply to
the NFS layer.
Move the rpcrdma_post_recvs() call in rpcrdma_reply_handler()
to after the RPC has been decoded and completed. The larger
batch size from the preceding patch provides sufficient
Receive Queue headroom to absorb the brief delay before
buffers are replenished.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: e786233d2e0b ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 1478c41c7e9da7..6e7bd1b47d7c7c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1471,7 +1471,6 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
credits = 1; /* don't deadlock */
else if (credits > r_xprt->rx_ep->re_max_requests)
credits = r_xprt->rx_ep->re_max_requests;
- rpcrdma_post_recvs(r_xprt, credits + (buf->rb_bc_srv_max_requests << 1));
if (buf->rb_credits != credits)
rpcrdma_update_cwnd(r_xprt, credits);
@@ -1490,15 +1489,20 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
/* LocalInv completion will complete the RPC */
else
kref_put(&req->rl_kref, rpcrdma_reply_done);
- return;
-out_badversion:
- trace_xprtrdma_reply_vers_err(rep);
- goto out;
+out_post:
+ rpcrdma_post_recvs(r_xprt,
+ credits + (buf->rb_bc_srv_max_requests << 1));
+ return;
out_norqst:
spin_unlock(&xprt->queue_lock);
trace_xprtrdma_reply_rqst_err(rep);
+ rpcrdma_rep_put(buf, rep);
+ goto out_post;
+
+out_badversion:
+ trace_xprtrdma_reply_vers_err(rep);
goto out;
out_shortreply:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0654/1266] xprtrdma: Use sendctx DMA state for Send signaling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0653/1266] xprtrdma: Post receive buffers after RPC completion Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0655/1266] xprtrdma: Decouple req recycling from RPC completion Greg Kroah-Hartman
` (344 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 2797ae7c929610fb2d2303a996a08173fa096730 ]
Send signaling matters only when the prepared Send has page
mappings to unmap. Today that test is expressed indirectly with
rl_kref, because the Send-side reference is taken only for Sends
with mapped SGEs.
Split the SGE DMA unmap loop into its own helper and use
sc_unmap_count directly for the signaling decision. This keeps the
current behavior but removes one dependency on the old rl_kref
semantics before the request lifetime rules are changed.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Stable-dep-of: e786233d2e0b ("xprtrdma: Decouple req recycling from RPC completion")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/frwr_ops.c | 2 +-
net/sunrpc/xprtrdma/rpc_rdma.c | 22 +++++++++++++---------
2 files changed, 14 insertions(+), 10 deletions(-)
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index 47f33bb7bff814..a0d49580dcb871 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -404,7 +404,7 @@ int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
++num_wrs;
}
- if ((kref_read(&req->rl_kref) > 1) || num_wrs > ep->re_send_count) {
+ if (req->rl_sendctx->sc_unmap_count || num_wrs > ep->re_send_count) {
send_wr->send_flags |= IB_SEND_SIGNALED;
ep->re_send_count = min_t(unsigned int, ep->re_send_batch,
num_wrs - ep->re_send_count);
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 6e7bd1b47d7c7c..e6679adbedae51 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -526,19 +526,11 @@ static void rpcrdma_sendctx_done(struct kref *kref)
rep->rr_rxprt->rx_stats.reply_waits_for_send++;
}
-/**
- * rpcrdma_sendctx_unmap - DMA-unmap Send buffer
- * @sc: sendctx containing SGEs to unmap
- *
- */
-void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
+static void rpcrdma_sendctx_dma_unmap(struct rpcrdma_sendctx *sc)
{
struct rpcrdma_regbuf *rb = sc->sc_req->rl_sendbuf;
struct ib_sge *sge;
- if (!sc->sc_unmap_count)
- return;
-
/* The first two SGEs contain the transport header and
* the inline buffer. These are always left mapped so
* they can be cheaply re-used.
@@ -547,7 +539,19 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
++sge, --sc->sc_unmap_count)
ib_dma_unmap_page(rdmab_device(rb), sge->addr, sge->length,
DMA_TO_DEVICE);
+}
+
+/**
+ * rpcrdma_sendctx_unmap - DMA-unmap Send buffer
+ * @sc: sendctx containing SGEs to unmap
+ *
+ */
+void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
+{
+ if (!sc->sc_unmap_count)
+ return;
+ rpcrdma_sendctx_dma_unmap(sc);
kref_put(&sc->sc_req->rl_kref, rpcrdma_sendctx_done);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0655/1266] xprtrdma: Decouple req recycling from RPC completion
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0654/1266] xprtrdma: Use sendctx DMA state for Send signaling Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0656/1266] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
` (343 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit e786233d2e0bbff9a82e43f02ae3a46ab4b08ec3 ]
rl_kref formerly served two distinct lifetimes through a single
refcount: it gated when a Reply could wake its RPC task, and it
gated when an rpcrdma_req could return to its free pool. The
marshal path took the Send-side reference only when SGEs needed
DMA-unmap (sc_unmap_count > 0), which made a Send carrying only
pre-registered buffers an exception: the Reply handler dropped
rl_kref from 1 to 0 and freed the req while the HCA might still
be DMA-reading from its send buffer.
Give rl_kref a narrower job. The RPC layer takes one reference
when slot allocation hands a req out. rpcrdma_prepare_send_sges()
takes a Send-side reference unconditionally after WR preparation
succeeds. xprt_rdma_free_slot() and xprt_rdma_bc_free_rqst() drop
the RPC-layer reference; rpcrdma_sendctx_unmap() drops the
Send-side reference. The req returns to its free pool only after
both owners have signed off.
The existing kref_init(&req->rl_kref) call in
rpcrdma_prepare_send_sges() is removed. Initialization moves to
the slot-allocation paths (xprt_rdma_alloc_slot and
rpcrdma_bc_rqst_get), and the release callback re-arms rl_kref
before the req returns to a free pool. A re-init in the marshal
path would discard the RPC-layer reference that already exists
on entry.
Three invariants follow:
- Any rpcrdma_req held by an rpc_rqst has rl_kref >= 1.
xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the
backlog-wake branch in xprt_rdma_alloc_slot() each kref_init
rl_kref before publishing the req. Without this invariant,
an RPC task that aborts between slot allocation and marshal
(gss_refresh failure or signal during call_connect, for
example) would drive xprt_release() ->
xprt_rdma_free_slot() -> kref_put against a refcount of
zero, saturating refcount_t and stranding the slot.
- The Send-side reference is taken only after WR prep
succeeds. A mapping failure in rpcrdma_prepare_send_sges()
runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx
and clears sc_req without touching rl_kref. The sendctx
ring walks in rpcrdma_sendctx_put_locked() and
rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL,
so a burst of -EIO marshal failures cannot hold reqs off
rb_send_bufs.
- The release callback re-arms rl_kref so the next consumer
enters with the invariant satisfied.
Replies now complete the RPC directly. rpcrdma_reply_handler()
calls rpcrdma_complete_rqst() in place of kref_put on the
non-LocalInv branch. The LocalInv branch already completes the
RPC from frwr_unmap_async() and is unaffected.
Because Send-side references can now outlive RPC completion,
connection teardown drains sendctx entries whose unsignaled
Sends never had a later signaled completion to walk the ring.
rpcrdma_sendctxs_destroy() walks the active range and runs
rpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req
before the request buffers are reset, and is moved ahead of
rpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs
are still in their pre-reset state when the Send-side refs are
released.
The drain creates a teardown-ordering hazard on the backchannel
path. With the new lifetime, releasing a bc_prealloc req from
rpcrdma_req_release() re-adds it to bc_pa_list. The disconnect
in xprt_rdma_destroy() runs after xprt_destroy_backchannel() has
already emptied bc_pa_list, so the drained reqs would otherwise
leak. xprt_rdma_destroy() now runs xprt_rdma_bc_destroy(xprt, 0)
a second time after the disconnect to reclaim them.
Fixes: 0ab115237025 ("xprtrdma: Wake RPCs directly in rpcrdma_wc_send path")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/backchannel.c | 5 ++-
net/sunrpc/xprtrdma/rpc_rdma.c | 47 +++++++++++---------------
net/sunrpc/xprtrdma/transport.c | 55 ++++++++++++++++++++++++++++---
net/sunrpc/xprtrdma/verbs.c | 29 +++++++++++++---
net/sunrpc/xprtrdma/xprt_rdma.h | 2 +-
5 files changed, 97 insertions(+), 41 deletions(-)
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index e4d84a13c566e7..5f304f2c61b13c 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -158,9 +158,7 @@ void xprt_rdma_bc_free_rqst(struct rpc_rqst *rqst)
rpcrdma_rep_put(&r_xprt->rx_buf, rep);
req->rl_reply = NULL;
- spin_lock(&xprt->bc_pa_lock);
- list_add_tail(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
- spin_unlock(&xprt->bc_pa_lock);
+ rpcrdma_req_put(req);
xprt_put(xprt);
}
@@ -202,6 +200,7 @@ static struct rpc_rqst *rpcrdma_bc_rqst_get(struct rpcrdma_xprt *r_xprt)
rqst->rq_xprt = xprt;
__set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state);
xdr_buf_init(&rqst->rq_snd_buf, rdmab_data(req->rl_sendbuf), size);
+ kref_init(&req->rl_kref);
return rqst;
}
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e6679adbedae51..fbb78c61333132 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -516,16 +516,6 @@ static int rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt,
return 0;
}
-static void rpcrdma_sendctx_done(struct kref *kref)
-{
- struct rpcrdma_req *req =
- container_of(kref, struct rpcrdma_req, rl_kref);
- struct rpcrdma_rep *rep = req->rl_reply;
-
- rpcrdma_complete_rqst(rep);
- rep->rr_rxprt->rx_stats.reply_waits_for_send++;
-}
-
static void rpcrdma_sendctx_dma_unmap(struct rpcrdma_sendctx *sc)
{
struct rpcrdma_regbuf *rb = sc->sc_req->rl_sendbuf;
@@ -542,17 +532,26 @@ static void rpcrdma_sendctx_dma_unmap(struct rpcrdma_sendctx *sc)
}
/**
- * rpcrdma_sendctx_unmap - DMA-unmap Send buffer
+ * rpcrdma_sendctx_unmap - DMA-unmap Send buffer and release Send owner
* @sc: sendctx containing SGEs to unmap
*
*/
void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
{
- if (!sc->sc_unmap_count)
- return;
+ struct rpcrdma_req *req = sc->sc_req;
rpcrdma_sendctx_dma_unmap(sc);
- kref_put(&sc->sc_req->rl_kref, rpcrdma_sendctx_done);
+ sc->sc_req = NULL;
+ rpcrdma_req_put(req);
+}
+
+/* No Send was posted. Release DMA mappings prepared for this
+ * sendctx, but leave the request reference count alone.
+ */
+static void rpcrdma_sendctx_cancel(struct rpcrdma_sendctx *sc)
+{
+ rpcrdma_sendctx_dma_unmap(sc);
+ sc->sc_req = NULL;
}
/* Prepare an SGE for the RPC-over-RDMA transport header.
@@ -744,8 +743,6 @@ static bool rpcrdma_prepare_noch_mapped(struct rpcrdma_xprt *r_xprt,
tail->iov_len))
return false;
- if (req->rl_sendctx->sc_unmap_count)
- kref_get(&req->rl_kref);
return true;
}
@@ -775,7 +772,6 @@ static bool rpcrdma_prepare_readch(struct rpcrdma_xprt *r_xprt,
len -= len & 3;
if (!rpcrdma_prepare_tail_iov(req, xdr, page_base, len))
return false;
- kref_get(&req->rl_kref);
}
return true;
@@ -804,7 +800,6 @@ inline int rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
goto out_nosc;
req->rl_sendctx->sc_unmap_count = 0;
req->rl_sendctx->sc_req = req;
- kref_init(&req->rl_kref);
req->rl_wr.wr_cqe = &req->rl_sendctx->sc_cqe;
req->rl_wr.sg_list = req->rl_sendctx->sc_sges;
req->rl_wr.num_sge = 0;
@@ -832,10 +827,14 @@ inline int rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
goto out_unmap;
}
+ /* The Send-side owner releases this reference when the
+ * Send has completed.
+ */
+ kref_get(&req->rl_kref);
return 0;
out_unmap:
- rpcrdma_sendctx_unmap(req->rl_sendctx);
+ rpcrdma_sendctx_cancel(req->rl_sendctx);
out_nosc:
trace_xprtrdma_prepsend_failed(&req->rl_slot, ret);
return ret;
@@ -1413,14 +1412,6 @@ void rpcrdma_complete_rqst(struct rpcrdma_rep *rep)
goto out;
}
-static void rpcrdma_reply_done(struct kref *kref)
-{
- struct rpcrdma_req *req =
- container_of(kref, struct rpcrdma_req, rl_kref);
-
- rpcrdma_complete_rqst(req->rl_reply);
-}
-
/**
* rpcrdma_reply_handler - Process received RPC/RDMA messages
* @rep: Incoming rpcrdma_rep object to process
@@ -1492,7 +1483,7 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
frwr_unmap_async(r_xprt, req);
/* LocalInv completion will complete the RPC */
else
- kref_put(&req->rl_kref, rpcrdma_reply_done);
+ rpcrdma_complete_rqst(rep);
out_post:
rpcrdma_post_recvs(r_xprt,
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index cda0af267bd8c8..9b976246f69a4d 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -280,6 +280,13 @@ xprt_rdma_destroy(struct rpc_xprt *xprt)
cancel_delayed_work_sync(&r_xprt->rx_connect_worker);
rpcrdma_xprt_disconnect(r_xprt);
+
+ /* The disconnect's sendctx drain can return bc_prealloc reqs
+ * to bc_pa_list after xprt_destroy_backchannel() emptied it.
+ */
+#if defined(CONFIG_SUNRPC_BACKCHANNEL)
+ xprt_rdma_bc_destroy(xprt, 0);
+#endif
rpcrdma_buffer_destroy(&r_xprt->rx_buf);
xprt_rdma_free_addresses(xprt);
@@ -488,6 +495,45 @@ xprt_rdma_connect(struct rpc_xprt *xprt, struct rpc_task *task)
queue_delayed_work(system_long_wq, &r_xprt->rx_connect_worker, delay);
}
+/* rl_kref has two owners while a Send is outstanding: the rpc_rqst
+ * owner and the sendctx. Replies complete the RPC but do not drop
+ * either reference. The req returns to its free pool only after
+ * xprt_rdma_free_slot() or xprt_rdma_bc_free_rqst() has dropped the
+ * RPC-layer reference and rpcrdma_sendctx_unmap() has dropped the
+ * Send-side reference.
+ */
+static void rpcrdma_req_release(struct kref *kref)
+{
+ struct rpcrdma_req *req =
+ container_of(kref, struct rpcrdma_req, rl_kref);
+ struct rpc_rqst *rqst = &req->rl_slot;
+ struct rpc_xprt *xprt = rqst->rq_xprt;
+ struct rpcrdma_xprt *r_xprt;
+
+ kref_init(&req->rl_kref);
+
+#if defined(CONFIG_SUNRPC_BACKCHANNEL)
+ if (bc_prealloc(rqst)) {
+ spin_lock(&xprt->bc_pa_lock);
+ list_add_tail(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
+ spin_unlock(&xprt->bc_pa_lock);
+ return;
+ }
+#endif
+
+ if (xprt_wake_up_backlog(xprt, rqst))
+ return;
+
+ r_xprt = rpcx_to_rdmax(xprt);
+ memset(rqst, 0, sizeof(*rqst));
+ rpcrdma_buffer_put(&r_xprt->rx_buf, req);
+}
+
+void rpcrdma_req_put(struct rpcrdma_req *req)
+{
+ kref_put(&req->rl_kref, rpcrdma_req_release);
+}
+
/**
* xprt_rdma_alloc_slot - allocate an rpc_rqst
* @xprt: controlling RPC transport
@@ -506,6 +552,7 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
req = rpcrdma_buffer_get(&r_xprt->rx_buf);
if (!req)
goto out_sleep;
+ kref_init(&req->rl_kref);
task->tk_rqstp = &req->rl_slot;
task->tk_status = 0;
return;
@@ -521,6 +568,7 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
if (req) {
struct rpc_rqst *rqst = &req->rl_slot;
+ kref_init(&req->rl_kref);
if (!xprt_wake_up_backlog(xprt, rqst)) {
memset(rqst, 0, sizeof(*rqst));
rpcrdma_buffer_put(&r_xprt->rx_buf, req);
@@ -541,10 +589,7 @@ xprt_rdma_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *rqst)
container_of(xprt, struct rpcrdma_xprt, rx_xprt);
rpcrdma_reply_put(&r_xprt->rx_buf, rpcr_to_rdmar(rqst));
- if (!xprt_wake_up_backlog(xprt, rqst)) {
- memset(rqst, 0, sizeof(*rqst));
- rpcrdma_buffer_put(&r_xprt->rx_buf, rpcr_to_rdmar(rqst));
- }
+ rpcrdma_req_put(rpcr_to_rdmar(rqst));
}
static bool rpcrdma_check_regbuf(struct rpcrdma_xprt *r_xprt,
@@ -717,7 +762,7 @@ void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
r_xprt->rx_stats.mrs_allocated,
r_xprt->rx_stats.local_inv_needed,
r_xprt->rx_stats.empty_sendctx_q,
- r_xprt->rx_stats.reply_waits_for_send);
+ 0LU); /* was reply_waits_for_send; column preserved */
}
static int
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index d468ebf6de8062..ad463196f8e95d 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -65,6 +65,8 @@
static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt);
static void rpcrdma_sendctxs_destroy(struct rpcrdma_xprt *r_xprt);
+static unsigned long rpcrdma_sendctx_next(struct rpcrdma_buffer *buf,
+ unsigned long item);
static void rpcrdma_sendctx_put_locked(struct rpcrdma_xprt *r_xprt,
struct rpcrdma_sendctx *sc);
static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt);
@@ -566,9 +568,9 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt)
rpcrdma_xprt_drain(r_xprt);
rpcrdma_reps_unmap(r_xprt);
+ rpcrdma_sendctxs_destroy(r_xprt);
rpcrdma_reqs_reset(r_xprt);
rpcrdma_mrs_destroy(r_xprt);
- rpcrdma_sendctxs_destroy(r_xprt);
if (rpcrdma_ep_put(ep))
rdma_destroy_id(id);
@@ -600,6 +602,20 @@ static void rpcrdma_sendctxs_destroy(struct rpcrdma_xprt *r_xprt)
if (!buf->rb_sc_ctxs)
return;
+
+ /* The QP is drained, but the final unsignaled Sends might not
+ * have been walked by a signaled Send completion. Release those
+ * Send owners before request buffers are reset.
+ */
+ for (i = rpcrdma_sendctx_next(buf, buf->rb_sc_tail);
+ i != rpcrdma_sendctx_next(buf, buf->rb_sc_head);
+ i = rpcrdma_sendctx_next(buf, i)) {
+ struct rpcrdma_sendctx *sc = buf->rb_sc_ctxs[i];
+
+ if (sc && sc->sc_req)
+ rpcrdma_sendctx_unmap(sc);
+ }
+
for (i = 0; i <= buf->rb_sc_last; i++)
kfree(buf->rb_sc_ctxs[i]);
kfree(buf->rb_sc_ctxs);
@@ -722,15 +738,20 @@ static void rpcrdma_sendctx_put_locked(struct rpcrdma_xprt *r_xprt,
struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
unsigned long next_tail;
- /* Unmap SGEs of previously completed but unsignaled
- * Sends by walking up the queue until @sc is found.
+ /* Release previously completed but unsignaled Sends by walking
+ * up the queue until @sc is found. Entries left behind by a
+ * failed rpcrdma_prepare_send_sges() have sc_req cleared.
*/
next_tail = buf->rb_sc_tail;
do {
+ struct rpcrdma_sendctx *cur;
+
next_tail = rpcrdma_sendctx_next(buf, next_tail);
/* ORDER: item must be accessed _before_ tail is updated */
- rpcrdma_sendctx_unmap(buf->rb_sc_ctxs[next_tail]);
+ cur = buf->rb_sc_ctxs[next_tail];
+ if (cur->sc_req)
+ rpcrdma_sendctx_unmap(cur);
} while (buf->rb_sc_ctxs[next_tail] != sc);
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 08bda29ed9535a..93ffb190ad50e2 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -408,7 +408,6 @@ struct rpcrdma_stats {
/* accessed when receiving a reply */
unsigned long long total_rdma_reply;
unsigned long long fixup_copy_count;
- unsigned long reply_waits_for_send;
unsigned long local_inv_needed;
unsigned long nomsg_call_count;
unsigned long bcall_count;
@@ -486,6 +485,7 @@ void rpcrdma_buffer_put(struct rpcrdma_buffer *buffers,
struct rpcrdma_req *req);
void rpcrdma_rep_put(struct rpcrdma_buffer *buf, struct rpcrdma_rep *rep);
void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req);
+void rpcrdma_req_put(struct rpcrdma_req *req);
bool rpcrdma_regbuf_realloc(struct rpcrdma_regbuf *rb, size_t size,
gfp_t flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0656/1266] NFSv4/pnfs: defer return_range callbacks until after inode unlock
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0655/1266] xprtrdma: Decouple req recycling from RPC completion Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0657/1266] nfs: keep PG_UPTODATE clear after read errors in page groups Greg Kroah-Hartman
` (342 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dai Ngo, Anna Schumaker, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <dai.ngo@oracle.com>
[ Upstream commit 77b160b2d863d37f36b6c38e80a7d259ce939e69 ]
Sometimes unmounting an NFS filesystem mounted with pNFS SCSI
layouts triggers the following warning:
BUG: scheduling while atomic: umount.nfs4/...
__schedule_bug+0xbd/0x100
schedule_debug.constprop.0+0x19f/0x220
__schedule+0x10d/0x10a0
schedule+0x74/0x190
schedule_timeout+0xf5/0x220
io_schedule_timeout+0xd5/0x160
__wait_for_common+0x186/0x4b0
blk_execute_rq+0x2ef/0x3a0
scsi_execute_cmd+0x1ff/0x700
sd_pr_out_command.isra.0+0x242/0x380 [sd_mod]
bl_unregister_scsi.constprop.0+0x109/0x3c0 [blocklayoutdriver]
bl_unregister_dev+0x175/0x1c0 [blocklayoutdriver]
bl_free_device+0x1f/0x1b0 [blocklayoutdriver]
bl_free_deviceid_node+0x12/0x30 [blocklayoutdriver]
nfs4_put_deviceid_node+0x171/0x360 [nfsv4]
ext_tree_remove+0x11c/0x1d0 [blocklayoutdriver]
_pnfs_return_layout+0x416/0x900 [nfsv4]
nfs4_evict_inode+0x108/0x130 [nfsv4]
evict+0x316/0x750
dispose_list+0xf1/0x1a0
evict_inodes+0x33f/0x440
generic_shutdown_super+0xc9/0x4e0
kill_anon_super+0x3a/0x90
nfs_kill_super+0x44/0x60 [nfs]
deactivate_locked_super+0xb8/0x1b0
cleanup_mnt+0x25a/0x380
task_work_run+0x13e/0x210
exit_to_user_mode_loop+0x169/0x400
do_syscall_64+0x467/0x1550
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The warning occurs because the block layout driver unregisters the SCSI
device while the inode lock is still held. Device unregistration issues
a SCSI PR command, which may sleep, resulting in a "scheduling while
atomic" warning.
During layout return, ext_tree_remove() invokes the layout driver's
return_range callback while holding the inode lock. For block layouts,
this callback eventually calls bl_unregister_scsi(), which may block in
scsi_execute_cmd() while issuing PR commands to the device.
Fix this by deferring the return_range callbacks until after the inode
lock has been released. The layout header reference count is incremented
before invoking return_range(), ensuring that the layout header remains
valid while the layout driver removes extents from the extent tree.
Fixes: c88953d87f5c8 ("pnfs: add return_range method")
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/callback_proc.c | 9 +++++----
fs/nfs/pnfs.c | 4 ++--
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 6bed1394d74894..7105e623c29488 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -248,6 +248,7 @@ static u32 initiate_file_draining(struct nfs_client *clp,
struct pnfs_layout_hdr *lo;
u32 rv = NFS4ERR_NOMATCHING_LAYOUT;
LIST_HEAD(free_me_list);
+ bool return_range = false;
ino = nfs_layout_find_inode(clp, &args->cbl_fh, &args->cbl_stateid);
if (IS_ERR(ino)) {
@@ -292,13 +293,13 @@ static u32 initiate_file_draining(struct nfs_client *clp,
/* Embrace your forgetfulness! */
rv = NFS4ERR_NOMATCHING_LAYOUT;
- if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) {
- NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo,
- &args->cbl_range);
- }
+ return_range = true;
}
unlock:
spin_unlock(&ino->i_lock);
+ if (return_range && NFS_SERVER(ino)->pnfs_curr_ld->return_range)
+ NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo,
+ &args->cbl_range);
pnfs_free_lseg_list(&free_me_list);
/* Free all lsegs that are attached to commit buckets */
nfs_commit_inode(ino, 0);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 90bd2afe23da89..e4aa1d0ccfa2ea 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1375,8 +1375,6 @@ _pnfs_return_layout(struct inode *ino)
pnfs_clear_layoutcommit(ino, &tmp_list);
pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
- if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
- NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
/* Don't send a LAYOUTRETURN if list was initially empty */
if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
@@ -1388,6 +1386,8 @@ _pnfs_return_layout(struct inode *ino)
send = pnfs_prepare_layoutreturn(lo, &stateid, &cred, NULL);
spin_unlock(&ino->i_lock);
+ if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
+ NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
if (send)
status = pnfs_send_layoutreturn(lo, &stateid, &cred, IOMODE_ANY, true);
out_wait_layoutreturn:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0657/1266] nfs: keep PG_UPTODATE clear after read errors in page groups
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0656/1266] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0658/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
` (341 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Clark Wang, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clark Wang <xiaoning.wang@nxp.com>
[ Upstream commit 3ff72e1cdf5c337b6acfcf3fcef748c5b9a5316b ]
When a read request is split into multiple subrequests, earlier
completions may advance PG_UPTODATE state for the page group once
their bytes fall within hdr->good_bytes. If a later subrequest in
the same group then completes with NFS_IOHDR_ERROR, the read path
needs to clear any accumulated PG_UPTODATE state and keep later
completions from rebuilding it.
Otherwise, a subsequent successful subrequest can re-enter
nfs_page_group_set_uptodate(), restore the page-group sync state,
and leave stale PG_UPTODATE behind for nfs_page_group_destroy()
to trip over in nfs_free_request().
Add a sticky page-group read-failed flag. Once any subrequest in
the group is known to be bad, mark the group failed, clear any
accumulated PG_UPTODATE state, and refuse further PG_UPTODATE
synchronization for the rest of the completion walk.
Fixes: 67d0338edd71 ("nfs: page group syncing in read path")
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/read.c | 25 ++++++++++++++++++++++++-
include/linux/nfs_page.h | 1 +
2 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index ed411897e33faf..bf0b6b91a1ec30 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -134,10 +134,32 @@ static void nfs_readpage_release(struct nfs_page *req, int error)
static void nfs_page_group_set_uptodate(struct nfs_page *req)
{
- if (nfs_page_group_sync_on_bit(req, PG_UPTODATE))
+ bool uptodate = false;
+
+ nfs_page_group_lock(req);
+ if (!test_bit(PG_READ_FAILED, &req->wb_head->wb_flags) &&
+ nfs_page_group_sync_on_bit_locked(req, PG_UPTODATE))
+ uptodate = true;
+ nfs_page_group_unlock(req);
+
+ if (uptodate)
folio_mark_uptodate(nfs_page_to_folio(req));
}
+static void nfs_page_group_mark_read_failed(struct nfs_page *req)
+{
+ struct nfs_page *tmp;
+
+ nfs_page_group_lock(req);
+ set_bit(PG_READ_FAILED, &req->wb_head->wb_flags);
+ tmp = req;
+ do {
+ clear_bit(PG_UPTODATE, &tmp->wb_flags);
+ tmp = tmp->wb_this_page;
+ } while (tmp != req);
+ nfs_page_group_unlock(req);
+}
+
static void nfs_read_completion(struct nfs_pgio_header *hdr)
{
unsigned long bytes = 0;
@@ -174,6 +196,7 @@ static void nfs_read_completion(struct nfs_pgio_header *hdr)
if (bytes <= hdr->good_bytes)
nfs_page_group_set_uptodate(req);
else {
+ nfs_page_group_mark_read_failed(req);
error = hdr->error;
xchg(&nfs_req_openctx(req)->error, error);
}
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index 6a46069c5a3689..dbffbd86c7ba37 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -33,6 +33,7 @@ enum {
PG_TEARDOWN, /* page group sync for destroy */
PG_UNLOCKPAGE, /* page group sync bit in read path */
PG_UPTODATE, /* page group sync bit in read path */
+ PG_READ_FAILED, /* page group saw a read error */
PG_WB_END, /* page group sync bit in write path */
PG_REMOVE, /* page group sync bit in write path */
PG_CONTENDED1, /* Is someone waiting for a lock? */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0658/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0657/1266] nfs: keep PG_UPTODATE clear after read errors in page groups Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0659/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
` (340 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 7a375cafc14ed151508f908ea5681caf0a9cc1d6 ]
Commit f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS
errors") teaches ff_layout_{read,write}_pagelist() to return
PNFS_NOT_ATTEMPTED when nfs4_ff_layout_prepare_ds() fails with a
nfs_error_is_fatal() errno (e.g. -ETIMEDOUT from a SOFTCONN connect
deadline, -ENOMEM, -ERESTARTSYS), so that the client gives up instead
of spinning. pnfs_do_{read,write}() then dispatches the I/O through
pnfs_{read,write}_through_mds() → nfs_pageio_reset_{read,write}_mds().
That fallback is unconditional and silently violates FF_FLAGS_NO_IO_THRU_MDS:
when the layout segment carries the flag (typically single-mirror
appliance layouts where MDS I/O is explicitly forbidden), the
out_failed: path's \`&& !ds_fatal_error\` clause overrides the flag's
short-circuit through ff_layout_avoid_mds_available_ds() and routes
the I/O to the MDS file handle anyway.
This is reachable in practice during a data-server restart: SOFTCONN
exhaustion produces -ETIMEDOUT, which is fatal per nfs_error_is_fatal(),
which triggers PNFS_NOT_ATTEMPTED, which silently goes to MDS.
Preserve the upstream "don't spin on fatal errors" intent for layouts
that permit MDS fallback. For layouts with FF_FLAGS_NO_IO_THRU_MDS
set, mark the layout for return and request PNFS_TRY_AGAIN instead;
if the server cannot supply a usable layout the failure now surfaces
cleanly via pnfs_update_layout(), rather than via silent MDS I/O that
contradicts the flag.
Fixes: f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS errors")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 98536d2dad5e1f..9500cefe4884e7 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1902,6 +1902,14 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
out_failed:
if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error)
return PNFS_TRY_AGAIN;
+ if (ff_layout_no_fallback_to_mds(lseg)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: force fresh LAYOUTGET,
+ * never fall through to MDS I/O.
+ */
+ pnfs_error_mark_layout_for_return(hdr->inode, lseg);
+ return PNFS_TRY_AGAIN;
+ }
trace_pnfs_mds_fallback_read_pagelist(hdr->inode,
hdr->args.offset, hdr->args.count,
IOMODE_READ, NFS_I(hdr->inode)->layout, lseg);
@@ -1973,6 +1981,14 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
out_failed:
if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error)
return PNFS_TRY_AGAIN;
+ if (ff_layout_no_fallback_to_mds(lseg)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: force fresh LAYOUTGET,
+ * never fall through to MDS I/O.
+ */
+ pnfs_error_mark_layout_for_return(hdr->inode, lseg);
+ return PNFS_TRY_AGAIN;
+ }
trace_pnfs_mds_fallback_write_pagelist(hdr->inode,
hdr->args.offset, hdr->args.count,
IOMODE_RW, NFS_I(hdr->inode)->layout, lseg);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0659/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0658/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0660/1266] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
` (339 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 1d62e659c0bf11649cf48e002c2a55d148f2610a ]
The FF_FLAGS_NO_IO_THRU_MDS flag lives on each lseg, so any fallback
decision made when there is no current lseg (e.g. between LAYOUTRETURN
and the next LAYOUTGET) cannot run the per-lseg check.
Introduce a sticky hdr-level ditto for FF_FLAGS_NO_IO_THRU_MDS in
struct nfs4_flexfile_layout::flags (NFS4_FF_HDR_NO_IO_THRU_MDS bit),
set whenever ff_layout_alloc_lseg() parses an lseg with the flag. The
bit is never cleared for the lifetime of the layout hdr; the server is
assumed to be consistent in its no-fallback policy per file.
kzalloc() in ff_layout_alloc_layout_hdr() zero-initializes the field.
Use the new ff_layout_hdr_no_fallback_to_mds() helper to gate
ff_layout_pg_get_mirror_count_write(): when pnfs_update_layout() returns
NULL (e.g. NFS_LAYOUT_BULK_RECALL, pnfs_layout_io_test_failed,
pnfs_layoutgets_blocked) the existing code unconditionally calls
nfs_pageio_reset_write_mds(). This is a source of unwanted WRITE to
MDS. Fix it by checking NFS4_FF_HDR_NO_IO_THRU_MDS bit, and if set
surface -EAGAIN instead; the writepage-side caller (nfs_do_writepage()
for buffered, nfs_direct_write_reschedule() for O_DIRECT) then
redirties the request so writeback retries via pNFS.
Fixes: 260074cd8413 ("pNFS/flexfiles: Add support for FF_FLAGS_NO_IO_THRU_MDS")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 13 +++++++++++++
fs/nfs/flexfilelayout/flexfilelayout.h | 16 ++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 9500cefe4884e7..3c60edc22b8d9d 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -539,6 +539,9 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
if (!p)
goto out_sort_mirrors;
fls->flags = be32_to_cpup(p);
+ if (fls->flags & FF_FLAGS_NO_IO_THRU_MDS)
+ set_bit(NFS4_FF_HDR_NO_IO_THRU_MDS,
+ &FF_LAYOUT_FROM_HDR(lh)->flags);
p = xdr_inline_decode(&stream, 4);
if (!p)
@@ -992,6 +995,16 @@ ff_layout_pg_get_mirror_count_write(struct nfs_pageio_descriptor *pgio,
0, NFS4_MAX_UINT64, IOMODE_RW,
NFS_I(pgio->pg_inode)->layout,
pgio->pg_lseg);
+ if (NFS_I(pgio->pg_inode)->layout &&
+ ff_layout_hdr_no_fallback_to_mds(NFS_I(pgio->pg_inode)->layout)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: no current lseg but the server's
+ * policy forbids MDS fallback. Surface -EAGAIN so writeback
+ * retries rather than silently issuing the WRITE via MDS.
+ */
+ pgio->pg_error = -EAGAIN;
+ goto out;
+ }
/* no lseg means that pnfs is not in use, so no mirroring here */
nfs_pageio_reset_write_mds(pgio);
out:
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 354a031c69b172..1d4294c6a7ec48 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -102,12 +102,16 @@ struct nfs4_ff_layout_segment {
struct nfs4_ff_layout_mirror *mirror_array[];
};
+/* nfs4_flexfile_layout::flags bit indices */
+#define NFS4_FF_HDR_NO_IO_THRU_MDS 0 /* any lseg has had FF_FLAGS_NO_IO_THRU_MDS */
+
struct nfs4_flexfile_layout {
struct pnfs_layout_hdr generic_hdr;
struct pnfs_ds_commit_info commit_info;
struct list_head mirrors;
struct list_head error_list; /* nfs4_ff_layout_ds_err */
ktime_t last_report_time; /* Layoutstat report times */
+ unsigned long flags;
};
struct nfs4_flexfile_layoutreturn_args {
@@ -174,6 +178,18 @@ ff_layout_no_fallback_to_mds(struct pnfs_layout_segment *lseg)
return FF_LAYOUT_LSEG(lseg)->flags & FF_FLAGS_NO_IO_THRU_MDS;
}
+/*
+ * Sticky hdr-level mirror of FF_FLAGS_NO_IO_THRU_MDS so callers that have
+ * no current lseg (e.g. between LAYOUTRETURN and the next LAYOUTGET) can
+ * still honor the no-MDS-fallback policy.
+ */
+static inline bool
+ff_layout_hdr_no_fallback_to_mds(struct pnfs_layout_hdr *lo)
+{
+ return test_bit(NFS4_FF_HDR_NO_IO_THRU_MDS,
+ &FF_LAYOUT_FROM_HDR(lo)->flags);
+}
+
static inline bool
ff_layout_no_read_on_rw(struct pnfs_layout_segment *lseg)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0660/1266] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0659/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0661/1266] PCI: meson: Propagate devm_add_action_or_reset() failure Greg Kroah-Hartman
` (338 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Manivannan Sadhasivam,
Krzysztof Wilczyński, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 282305d7e9c0e27fd8b4df34b7cd5506a1eccdd6 ]
The original PCIE_FTS_NUM_L0(x) macro was buggy due to improper operator
precedence, where ((x) & 0xff << 8) was evaluated as ((x) & 0xff00).
Instead of just fixing the parentheses, use the standard FIELD_PREP()
macro. This makes the code more robust by automatically handling masks
and shifts, while also adding compile-time type and range checking to
ensure the value fits within PCIE_FTS_NUM_MASK.
Fixes: 637cfacae96f ("PCI: mediatek: Add MediaTek PCIe host controller support")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
[mani: added the bitfield header include spotted by Sashiko]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260515005552.2343-1-lirongqing@baidu.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 82e575e4d3877a..bc2847fe12d1cb 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -7,6 +7,7 @@
* Honghui Zhang <honghui.zhang@mediatek.com>
*/
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/iopoll.h>
@@ -60,7 +61,7 @@
/* MediaTek specific configuration registers */
#define PCIE_FTS_NUM 0x70c
#define PCIE_FTS_NUM_MASK GENMASK(15, 8)
-#define PCIE_FTS_NUM_L0(x) ((x) & 0xff << 8)
+#define PCIE_FTS_NUM_L0(x) FIELD_PREP(PCIE_FTS_NUM_MASK, x)
#define PCIE_FC_CREDIT 0x73c
#define PCIE_FC_CREDIT_MASK (GENMASK(31, 31) | GENMASK(28, 16))
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0661/1266] PCI: meson: Propagate devm_add_action_or_reset() failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0660/1266] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0662/1266] fs/ntfs3: resize log->one_page_buf when adopting on-disk page size Greg Kroah-Hartman
` (337 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuvam Pandey, Manivannan Sadhasivam,
Neil Armstrong, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuvam Pandey <shuvampandey1@gmail.com>
[ Upstream commit b12341b98d5ac52f48ca1390e1e371aed81346c8 ]
meson_pcie_probe_clock() enables a clock and then registers a devres
action to disable it during teardown. If devm_add_action_or_reset()
fails, it runs the action immediately, disabling the clock.
The return value is currently ignored, so on that failure path,
meson_pcie_probe_clock() returns the disabled clock and probe continues.
Return the error so the existing probe error path unwinds normally.
Fixes: 9c0ef6d34fdbf ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver")
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/177909148011.9588.6639767953842842291@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-meson.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
index 407558f5d74acd..282f218e8b68e2 100644
--- a/drivers/pci/controller/dwc/pci-meson.c
+++ b/drivers/pci/controller/dwc/pci-meson.c
@@ -194,7 +194,9 @@ static inline struct clk *meson_pcie_probe_clock(struct device *dev,
return ERR_PTR(ret);
}
- devm_add_action_or_reset(dev, meson_pcie_disable_clock, clk);
+ ret = devm_add_action_or_reset(dev, meson_pcie_disable_clock, clk);
+ if (ret)
+ return ERR_PTR(ret);
return clk;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0662/1266] fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0661/1266] PCI: meson: Propagate devm_add_action_or_reset() failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0663/1266] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
` (336 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carol L Soto, Jamie Nguyen,
Konstantin Komarov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Nguyen <jamien@nvidia.com>
[ Upstream commit 5a35454179fe1041d9cd286f5d320ce0d448c12a ]
log_replay() allocates log->one_page_buf using the page size that was
chosen from the host PAGE_SIZE:
log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);
Later, when a restart area is found, the log page size recorded on disk
is adopted:
t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
if (log->page_size != t32) {
log->l_size = log->orig_file_size;
log->page_size = norm_file_page(t32, &log->l_size,
t32 == DefaultLogPageSize);
}
If the on-disk page size is larger than the size used for the initial
allocation, log->page_size grows but one_page_buf is left at its
original, smaller size. A subsequent unaligned read_log_page() then
reads log->page_size bytes into the undersized scratch buffer:
page_buf = page_off ? log->one_page_buf : *buffer;
err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
log->page_size, NULL, &log->read_ahead);
overflowing the allocation. This is reachable when mounting a dirty
NTFS volume whose log was formatted with a page size larger than the
buffer initially allocated on the mounting host (for example a 64K-log
volume mounted on a host that allocated a 4K scratch buffer).
Grow one_page_buf when the adopted on-disk page size exceeds the size
used for the initial allocation. On krealloc() failure the original
buffer is left intact and freed by the existing error path.
Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal")
Reported-by: Carol L Soto <csoto@nvidia.com>
Signed-off-by: Jamie Nguyen <jamien@nvidia.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fslog.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 9175f53cb938cc..06fd72b4bb4e21 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3938,9 +3938,28 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
*/
t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
if (log->page_size != t32) {
+ u32 old_page_size = log->page_size;
+
log->l_size = log->orig_file_size;
log->page_size = norm_file_page(t32, &log->l_size,
t32 == DefaultLogPageSize);
+
+ /*
+ * If the adopted on-disk page size is larger than the size used
+ * to allocate one_page_buf above, grow the scratch buffer so a
+ * later read_log_page() cannot overflow it.
+ */
+ if (log->page_size > old_page_size) {
+ void *buf;
+
+ buf = krealloc(log->one_page_buf, log->page_size,
+ GFP_NOFS);
+ if (!buf) {
+ err = -ENOMEM;
+ goto out;
+ }
+ log->one_page_buf = buf;
+ }
}
if (log->page_size != t32 ||
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0663/1266] perf tools: Fix get_max_num() size_t underflow on empty sysfs file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0662/1266] fs/ntfs3: resize log->one_page_buf when adopting on-disk page size Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0664/1266] perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow Greg Kroah-Hartman
` (335 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Don Zickus,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 0a012113bb3a44482c163f16f4db03ccaa37a339 ]
get_max_num() reads a sysfs file (cpu/possible, cpu/present, or
node/possible) and scans backward from the end to find the last
number. If the file is empty, filename__read_str() returns num == 0.
The loop `while (--num)` decrements the size_t from 0 to SIZE_MAX,
reading backward across the heap until a comma or hyphen is found
or unmapped memory is hit.
Add an early return for empty files before the backward scan.
Fixes: 7780c25bae59fd04 ("perf tools: Allow ability to map cpus to nodes easily")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cpumap.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 75d9f5d6d185d1..de4a710e242146 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -378,6 +378,12 @@ static int get_max_num(char *path, int *max)
buf[num] = '\0';
+ /* empty file — nothing to parse */
+ if (num == 0) {
+ err = -1;
+ goto out;
+ }
+
/* start on the right, to find highest node num */
while (--num) {
if ((buf[num] == ',') || (buf[num] == '-')) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0664/1266] perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0663/1266] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0665/1266] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
` (334 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 7953a3a9b8e02e98c6e6958f291d0ae22393e46a ]
cpu_map__snprint() accumulates snprintf() return values in ret.
snprintf() returns the number of characters that *would have been
written* on truncation, not the actual count. When a fragmented CPU
list exceeds the buffer, ret grows past size, causing `size - ret` to
underflow (both are size_t), and subsequent snprintf() calls write
past the end of the caller's stack buffer.
Switch to scnprintf() which returns the actual number of characters
written, making ret accumulation safe by construction.
Fixes: a24020e6b7cf6eb8 ("perf tools: Change cpu_map__fprintf output")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cpumap.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index de4a710e242146..c5126cdbd7dd70 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -601,21 +601,21 @@ size_t cpu_map__snprint(struct perf_cpu_map *map, char *buf, size_t size)
if (start == -1) {
start = i;
if (last) {
- ret += snprintf(buf + ret, size - ret,
- "%s%d", COMMA,
- perf_cpu_map__cpu(map, i).cpu);
+ ret += scnprintf(buf + ret, size - ret,
+ "%s%d", COMMA,
+ perf_cpu_map__cpu(map, i).cpu);
}
} else if (((i - start) != (cpu.cpu - perf_cpu_map__cpu(map, start).cpu)) || last) {
int end = i - 1;
if (start == end) {
- ret += snprintf(buf + ret, size - ret,
- "%s%d", COMMA,
- perf_cpu_map__cpu(map, start).cpu);
+ ret += scnprintf(buf + ret, size - ret,
+ "%s%d", COMMA,
+ perf_cpu_map__cpu(map, start).cpu);
} else {
- ret += snprintf(buf + ret, size - ret,
- "%s%d-%d", COMMA,
- perf_cpu_map__cpu(map, start).cpu, perf_cpu_map__cpu(map, end).cpu);
+ ret += scnprintf(buf + ret, size - ret,
+ "%s%d-%d", COMMA,
+ perf_cpu_map__cpu(map, start).cpu, perf_cpu_map__cpu(map, end).cpu);
}
first = false;
start = i;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0665/1266] perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0664/1266] perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0666/1266] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
` (333 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Kan Liang,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 5484b43a0ec8231c36fba6ead654cb72dbba8b8f ]
machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail. Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.
Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.
Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/event.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 68f45e9e63b6e4..b118766c16e657 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -12,6 +12,7 @@
#include <linux/zalloc.h>
#include "cpumap.h"
#include "dso.h"
+#include "env.h"
#include "event.h"
#include "debug.h"
#include "hist.h"
@@ -743,8 +744,18 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
if (al->cpu >= 0) {
struct perf_env *env = machine->env;
- if (env && env->cpu)
- al->socket = env->cpu[al->cpu].socket_id;
+ /*
+ * Bounds-check al->cpu (s32) before casting to struct perf_cpu
+ * (int16_t): without this, e.g. 65536 truncates to 0 and silently
+ * returns CPU 0's topology. Can go once perf_cpu.cpu is widened.
+ */
+ if (env && al->cpu < env->nr_cpus_avail) {
+ struct cpu_topology_map *topo;
+
+ topo = perf_env__get_cpu_topology(env, (struct perf_cpu){ al->cpu });
+ if (topo)
+ al->socket = topo->socket_id;
+ }
}
if (al->map) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0666/1266] PCI: rcar-host: Remove unused LIST_HEAD(res)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0665/1266] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0667/1266] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
` (332 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Manivannan Sadhasivam,
Geert Uytterhoeven, Marek Vasut, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 6ba90ce2069ae923b0ec787aebdf2d786e5d2a58 ]
Remove the unused LIST_HEAD(res) declaration from rcar_pcie_hw_enable().
The macro instantiation defines an unused 'struct list_head res' variable,
which conflicts with a valid resource loop-local 'struct resource *res'
declaration further down in the function, triggering a compiler variable
shadowing warning:
drivers/pci/controller/pcie-rcar-host.c:357:34: warning: declaration of 'res' shadows a previous local [-Wshadow]
357 | struct resource *res = win->res;
Fixes: ce351636c67f75a9 ("PCI: rcar: Add suspend/resume")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://patch.msgid.link/20260521091256.15737-1-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rcar-host.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
index 77f6366e7db107..2054492e109768 100644
--- a/drivers/pci/controller/pcie-rcar-host.c
+++ b/drivers/pci/controller/pcie-rcar-host.c
@@ -344,7 +344,6 @@ static void rcar_pcie_hw_enable(struct rcar_pcie_host *host)
struct rcar_pcie *pcie = &host->pcie;
struct pci_host_bridge *bridge = pci_host_bridge_from_priv(host);
struct resource_entry *win;
- LIST_HEAD(res);
int i = 0;
/* Try setting 5 GT/s link speed */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0667/1266] perf sched: Fix idle-hist callchain display using wrong rb_first variant
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0666/1266] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0668/1266] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
` (331 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Davidlohr Bueso,
Namhyung Kim, Ian Rogers, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit d9b99dc8148e0c1f5da3942131b47e0d21187a32 ]
timehist_print_idlehist_callchain() calls rb_first_cached() on
sorted_root, but the sort function (callchain_param.sort) populates it
via rb_insert_color() on the plain rb_root member — not the cached
variant. This means rb_leftmost is never set, so rb_first_cached()
always returns NULL and the entire callchain summary is silently
dropped from --idle-hist output.
The original code in ba957ebb54893aca ("perf sched timehist: Show
callchains for idle stat") was correct — it used struct rb_root and
rb_first(). The bug was introduced when sorted_root was converted to
rb_root_cached without converting the sort insertion path to use
rb_insert_color_cached().
Use rb_first(&root->rb_root) to match how the tree was populated.
Fixes: cb4c13a5137766c3 ("perf sched: Use cached rbtrees")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 8b1573515c5781..db4ceebab8d8ad 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -2906,7 +2906,8 @@ static size_t timehist_print_idlehist_callchain(struct rb_root_cached *root)
size_t ret = 0;
FILE *fp = stdout;
struct callchain_node *chain;
- struct rb_node *rb_node = rb_first_cached(root);
+ /* sort() uses rb_insert_color() on rb_root, not rb_root_cached */
+ struct rb_node *rb_node = rb_first(&root->rb_root);
printf(" %16s %8s %s\n", "Idle time (msec)", "Count", "Callchains");
printf(" %.16s %.8s %.50s\n", graph_dotted_line, graph_dotted_line,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0668/1266] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0667/1266] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0669/1266] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
` (330 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit cab3a9331ed0b3f884dd61c8a25b3cf123705982 ]
Both functions accumulate formatted output via ret += snprintf(buf + ret,
size - ret, ...). If the buffer is too small and snprintf() returns more
than the remaining space, ret exceeds size and the next 'size - ret'
underflows, causing snprintf() to write past the buffer end.
Switch to scnprintf() which returns the actual number of bytes written,
making the accumulation safe.
Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Song Liu <song@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 1573d6b6478d28..2a9b90aa181fc7 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -28,7 +28,7 @@ static int snprintf_hex(char *buf, size_t size, unsigned char *data, size_t len)
size_t i;
for (i = 0; i < len; i++)
- ret += snprintf(buf + ret, size - ret, "%02x", data[i]);
+ ret += scnprintf(buf + ret, size - ret, "%02x", data[i]);
return ret;
}
@@ -131,7 +131,7 @@ static int synthesize_bpf_prog_name(char *buf, int size,
const struct btf_type *t;
int name_len;
- name_len = snprintf(buf, size, "bpf_prog_");
+ name_len = scnprintf(buf, size, "bpf_prog_");
name_len += snprintf_hex(buf + name_len, size - name_len,
prog_tags[sub_id], BPF_TAG_SIZE);
if (btf) {
@@ -144,9 +144,10 @@ static int synthesize_bpf_prog_name(char *buf, int size,
short_name = info->name;
} else
short_name = "F";
- if (short_name)
- name_len += snprintf(buf + name_len, size - name_len,
- "_%s", short_name);
+ if (short_name) {
+ name_len += scnprintf(buf + name_len, size - name_len,
+ "_%s", short_name);
+ }
return name_len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0669/1266] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0668/1266] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0670/1266] xprtrdma: Check frwr_wp_create() during connect Greg Kroah-Hartman
` (329 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 227a8748742f0263f1fe3131449b44563b77a209 ]
hists__scnprintf_title() accumulates formatted output into a buffer
using scnprintf() for all filter clauses except the UID filter, which
uses snprintf(). If the buffer fills up and snprintf() returns more
than the remaining space, printed exceeds size and the next 'size -
printed' underflows, causing later scnprintf() calls to write past
the buffer.
Switch the UID filter clause to scnprintf() to match the rest of the
function.
Fixes: 25c312dbf88ca402 ("perf hists: Move hists__scnprintf_title() away from the TUI code")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/hist.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index aa450cc2648aa5..2f2a8302b796fe 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -2800,9 +2800,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh
ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events);
- if (hists->uid_filter_str)
- printed += snprintf(bf + printed, size - printed,
- ", UID: %s", hists->uid_filter_str);
+ if (hists->uid_filter_str) {
+ printed += scnprintf(bf + printed, size - printed,
+ ", UID: %s", hists->uid_filter_str);
+ }
if (thread) {
if (hists__has(hists, thread)) {
printed += scnprintf(bf + printed, size - printed,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0670/1266] xprtrdma: Check frwr_wp_create() during connect
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0669/1266] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0671/1266] xprtrdma: Document and assert reply-handler invariants Greg Kroah-Hartman
` (328 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 0f13fc7c7d2e0427517e63c739277a4cd338b0c5 ]
frwr_wp_create() creates the singleton Memory Region used to encode
padding for Write chunks whose payload length is not XDR-aligned. Its
failure paths return a negative errno and leave ep->re_write_pad_mr set
to NULL.
rpcrdma_xprt_connect() currently ignores that return value. If
frwr_wp_create() fails after the rest of the connection setup succeeds,
xprt_rdma_connect_worker() treats the connection attempt as successful
and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-aligned
receive page length reaches rpcrdma_encode_write_list(), passes the NULL
write-pad MR to encode_rdma_segment(), and dereferences it.
This is locally triggerable on an NFS/RDMA client after a connect or
reconnect hits a local MR allocation, DMA-map, MR-map, or post-send
failure; a remote peer alone cannot force the local MR setup failure.
Check the return value and fail the connect as -ENOTCONN, matching the
adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the
normal reconnect path retry.
Fixes: 21037b8c2258 ("xprtrdma: Provide a buffer to pad Write chunks of unaligned length")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index ad463196f8e95d..46e3db61f1b4e7 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -536,7 +536,17 @@ int rpcrdma_xprt_connect(struct rpcrdma_xprt *r_xprt)
goto out;
}
rpcrdma_mrs_create(r_xprt);
- frwr_wp_create(r_xprt);
+
+ /*
+ * rpcrdma_encode_write_list() dereferences the write-pad
+ * MR with no NULL check, so fail the connect rather than
+ * publish a transport whose write-pad MR is NULL.
+ */
+ rc = frwr_wp_create(r_xprt);
+ if (rc) {
+ rc = -ENOTCONN;
+ goto out;
+ }
out:
trace_xprtrdma_connect(r_xprt, rc);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0671/1266] xprtrdma: Document and assert reply-handler invariants
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0670/1266] xprtrdma: Check frwr_wp_create() during connect Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0672/1266] xprtrdma: Resize reply buffers before reposting receives Greg Kroah-Hartman
` (327 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 797943e8bd1ffcc63bfe79d24faad9a77054ec40 ]
The xprtrdma reply path has been the subject of recurring
LLM-driven review claims that 'an RPC can complete while
receive buffers are still DMA-mapped' or that 'the req can be
freed while the HCA still owns the send buffer.' No runtime
reproducer has surfaced, but the absence of a written-down
invariant set lets each pass of automated review reach the
same hypothetical conclusion. Subsequent fixes against
ce2f9a4d9ccc ('xprtrdma: Decouple req recycling from RPC
completion') closed the underlying races but did not document
the closure where future readers will look for it.
State the invariants explicitly in a comment above
rpcrdma_reply_handler() and back four of them with
WARN_ON_ONCE() probes positioned where each invariant is
locally checkable on the previous patch's cleaned-up
ownership state:
- I1 (Receive WR ownership): WARN at rpcrdma_post_recvs() that
a rep pulled from rb_free_reps carries rr_rqst == NULL.
- I2 (rep attachment): WARN at rpcrdma_reply_put() that
req->rl_reply was NULLed before the matching rep_put.
- I3 (Registered-MR fence): WARN at rpcrdma_complete_rqst()
that req->rl_registered is empty. Strong send-queue
ordering of the LocalInv WR chain makes the last
completion observe the ib_dma_unmap_sg() of every earlier
MR, so 'list empty' implies 'all MRs unmapped'.
- I4 (Send-buffer release): WARN at rpcrdma_req_release()
that req->rl_sendctx is NULL. Reaching the kref release
callback requires both the RPC-layer and Send-side
references to have dropped; the Send-side drop runs in
rpcrdma_sendctx_unmap(), which clears rl_sendctx
(previous patch). A non-NULL rl_sendctx here would mean
the Send-side owner had not run -- a contradiction.
The XXX comment in xprt_rdma_free() about signal-driven
release racing the Send completion described the pre-decouple
state. Replace it with a one-line note pointing at the
invariant set, since the kref scheme now holds the req across
the in-flight Send regardless of which path released the
rpc_task.
I5 (req lifecycle) is stated in the comment but not probed:
making it locally assertible would require moving kref_init
out of rpcrdma_req_release(), which in turn requires adding
kref_init to the bc_pa_list and backlog-wake reuse paths.
That restructuring is deferred -- the invariant is unchanged
either way.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Stable-dep-of: 234c0ff695ef ("xprtrdma: Resize reply buffers before reposting receives")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 69 +++++++++++++++++++++++++++++++++
net/sunrpc/xprtrdma/transport.c | 13 +++++--
net/sunrpc/xprtrdma/verbs.c | 6 +++
3 files changed, 84 insertions(+), 4 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index fbb78c61333132..0473d920f71c1b 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1381,6 +1381,11 @@ void rpcrdma_complete_rqst(struct rpcrdma_rep *rep)
struct rpc_rqst *rqst = rep->rr_rqst;
int status;
+ /* I3: every registered MR has been invalidated and
+ * ib_dma_unmap_sg()'d before complete_rqst runs.
+ */
+ WARN_ON_ONCE(!list_empty(&rpcr_to_rdmar(rqst)->rl_registered));
+
switch (rep->rr_proc) {
case rdma_msg:
status = rpcrdma_decode_msg(r_xprt, rep, rqst);
@@ -1412,6 +1417,70 @@ void rpcrdma_complete_rqst(struct rpcrdma_rep *rep)
goto out;
}
+/* Reply-side ownership invariants
+ *
+ * I1 (Receive WR ownership). A struct rpcrdma_rep is owned by the
+ * HCA between ib_post_recv() and the matching Receive completion.
+ * After ib_dma_sync_single_for_cpu() in rpcrdma_wc_receive() it is
+ * owned by the CPU until rpcrdma_rep_put() returns it to
+ * rb_free_reps; a rep on rb_free_reps is not re-posted until
+ * rpcrdma_post_recvs() pulls it off. Asserted: rpcrdma_post_recvs()
+ * WARNs that a pulled rep has rr_rqst == NULL.
+ *
+ * I2 (rep attachment). While req->rl_reply == rep, the rep cannot be
+ * re-posted. rpcrdma_reply_put() NULLs req->rl_reply before handing
+ * the rep to rpcrdma_rep_put(). Asserted: rpcrdma_reply_put() WARNs
+ * that rl_reply is NULL after the put.
+ *
+ * I3 (Registered-MR fence). On entry to rpcrdma_complete_rqst() every
+ * MR that was on req->rl_registered has had its rkey invalidated
+ * (remotely via IB_WC_WITH_INVALIDATE or locally via IB_WR_LOCAL_INV)
+ * and its pages ib_dma_unmap_sg()'d. The LocalInv chain is posted
+ * on a single QP; strong send-queue ordering makes the last
+ * completion (frwr_wc_localinv_done) observe the
+ * ib_dma_unmap_sg() that ran from each earlier completion's
+ * frwr_mr_put() before complete_rqst is called. The inline
+ * frwr_reminv() path unmaps its one MR synchronously before
+ * rpcrdma_reply_handler() reaches complete_rqst. Asserted:
+ * rpcrdma_complete_rqst() WARNs that rl_registered is empty.
+ *
+ * I4 (Send-buffer release). req->rl_kref carries two unconditional
+ * owners while a Send is outstanding: the RPC-layer reference (set
+ * at xprt_rdma_alloc_slot / xprt_rdma_bc_rqst_get / rpcrdma_req_release
+ * pool-entry) and the Send-side reference (kref_get() in
+ * rpcrdma_prepare_send_sges()). rpcrdma_req_release() runs only
+ * after both have dropped, so the req does not return to its free
+ * pool until rpcrdma_sendctx_unmap() has fired -- the HCA has
+ * released the send buffer before the req can be reused. Asserted:
+ * rpcrdma_req_release() WARNs that rl_sendctx is NULL.
+ *
+ * I5 (req lifecycle). A req is owned by the RPC layer between slot
+ * acquisition and the matching xprt_rdma_free_slot() (or, for the
+ * backchannel, xprt_rdma_bc_free_rqst()). While owned, rl_kref >= 1.
+ * The pools (rb_send_bufs, bc_pa_list, backlog wake target) never
+ * contain a req with outstanding Send-side or Reply-side work.
+ *
+ * Non-hazards. The following claims have been raised by adversarial
+ * review and are each closed by the invariants above:
+ *
+ * * "Reply completes the RPC while the HCA still holds the send
+ * buffer" -- excluded by I4. The Send-side kref reference is held
+ * until rpcrdma_sendctx_unmap() runs from Send completion.
+ *
+ * * "Signal-driven release races the in-flight Send" -- same
+ * resolution. xprt_rdma_free() does not touch rl_kref; the
+ * Send-side reference keeps the req out of its pool until Send
+ * completion fires.
+ *
+ * * "Receive completion races rep reuse" -- excluded by I1. A rep
+ * is on rb_free_reps only after rpcrdma_rep_put() has been called
+ * and rpcrdma_post_recvs() owns the next transition back to the HCA.
+ *
+ * * "Pages still DMA-mapped when call_decode reads them" -- excluded
+ * by I3. The matching ib_dma_unmap_sg() for every MR has run on
+ * the same CPU thread that calls rpcrdma_complete_rqst().
+ */
+
/**
* rpcrdma_reply_handler - Process received RPC/RDMA messages
* @rep: Incoming rpcrdma_rep object to process
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 9b976246f69a4d..9f46c80dba6e8f 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -510,6 +510,11 @@ static void rpcrdma_req_release(struct kref *kref)
struct rpc_xprt *xprt = rqst->rq_xprt;
struct rpcrdma_xprt *r_xprt;
+ /* I4: both the RPC-layer and Send-side owners have dropped,
+ * so rpcrdma_sendctx_unmap() has cleared rl_sendctx.
+ */
+ WARN_ON_ONCE(req->rl_sendctx);
+
kref_init(&req->rl_kref);
#if defined(CONFIG_SUNRPC_BACKCHANNEL)
@@ -653,10 +658,10 @@ xprt_rdma_free(struct rpc_task *task)
frwr_unmap_sync(rpcx_to_rdmax(rqst->rq_xprt), req);
}
- /* XXX: If the RPC is completing because of a signal and
- * not because a reply was received, we ought to ensure
- * that the Send completion has fired, so that memory
- * involved with the Send is not still visible to the NIC.
+ /* The Send-side rl_kref owner keeps req out of its free pool
+ * until rpcrdma_sendctx_unmap() has fired -- see I4 above
+ * rpcrdma_reply_handler() -- so signal-driven release here
+ * does not let the HCA touch a recycled send buffer.
*/
}
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 46e3db61f1b4e7..106a8d3638f1d6 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1222,6 +1222,10 @@ void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req)
rpcrdma_rep_put(buffers, req->rl_reply);
req->rl_reply = NULL;
}
+ /* I2: rl_reply NULL after the put closes the
+ * 'rep on rb_free_reps still referenced by req' window.
+ */
+ WARN_ON_ONCE(req->rl_reply);
}
/**
@@ -1398,6 +1402,8 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed)
rep = rpcrdma_rep_create(r_xprt);
if (!rep)
break;
+ /* I1: a rep on rb_free_reps must carry no rqst pointer. */
+ WARN_ON_ONCE(rep->rr_rqst);
if (!rpcrdma_regbuf_dma_map(r_xprt, rep->rr_rdmabuf)) {
rpcrdma_rep_put(buf, rep);
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0672/1266] xprtrdma: Resize reply buffers before reposting receives
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0671/1266] xprtrdma: Document and assert reply-handler invariants Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0673/1266] xprtrdma: Fix bcall rep leak and unbounded peek Greg Kroah-Hartman
` (326 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 234c0ff695ef3ffb656931000e6b823d0c2f30fd ]
Commit 0e13dd9ea8be ("xprtrdma: Remove temp allocation of
rpcrdma_rep objects") made rpcrdma_rep objects survive disconnects.
That is normally fine, but it also means their receive regbufs keep
the size they had when they were first allocated.
Each rep's receive buffer is sized to ep->re_inline_recv when the rep
is created. rpcrdma_ep_create() resets that threshold to the
rdma_max_inline_read ceiling for every new endpoint, and the connect
handshake then shrinks it to the peer's advertised inline send size.
A rep allocated under a smaller negotiated threshold keeps that size:
on disconnect, rpcrdma_xprt_disconnect() drains and DMA-unmaps the
surviving reps but does not free or resize them.
The threshold can come back larger on the next connection. The first
peer may supply no RPC-over-RDMA CM private data, defaulting its send
size to 1024, while the reconnect target is an ordinary server
offering 4096; or, with rdma_max_inline_read raised above its default,
the reconnect target may advertise a larger svcrdma_max_req_size than
the first. rpcrdma_post_recvs() then reposts a surviving rep whose SGE
length is still the old, smaller value, and a larger inline Reply hits
a receive length error and forces another disconnect.
The undersized rep returns to the free list when its failed Receive
flushes, so the following reconnect reposts the same rep and fails the
same way. The transport flaps without making forward progress for as
long as the peer keeps advertising the larger inline size.
This is local/admin-triggerable rather than remote-triggerable: a local
administrator must create and maintain the NFS/RDMA mount, while the
server or reconnect target has to advertise a larger inline send size
and return a reply that uses it.
Fix this by checking each rep before it is reposted. If the receive
regbuf is smaller than the current endpoint's inline receive size,
reallocate it on the current RDMA device's NUMA node and reinitialize
the rep's xdr_buf before DMA-mapping and posting the Receive WR.
Fixes: 0e13dd9ea8be ("xprtrdma: Remove temp allocation of rpcrdma_rep objects")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/verbs.c | 31 ++++++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 106a8d3638f1d6..c2718732801b3c 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -81,6 +81,8 @@ rpcrdma_regbuf_alloc_node(size_t size, enum dma_data_direction direction,
int node);
static struct rpcrdma_regbuf *
rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction);
+static bool rpcrdma_regbuf_realloc_node(struct rpcrdma_regbuf *rb,
+ size_t size, gfp_t flags, int node);
static void rpcrdma_regbuf_dma_unmap(struct rpcrdma_regbuf *rb);
static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb);
@@ -1306,10 +1308,16 @@ rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction)
* returned, @rb is left untouched.
*/
bool rpcrdma_regbuf_realloc(struct rpcrdma_regbuf *rb, size_t size, gfp_t flags)
+{
+ return rpcrdma_regbuf_realloc_node(rb, size, flags, NUMA_NO_NODE);
+}
+
+static bool rpcrdma_regbuf_realloc_node(struct rpcrdma_regbuf *rb,
+ size_t size, gfp_t flags, int node)
{
void *buf;
- buf = kmalloc(size, flags);
+ buf = kmalloc_node(size, flags, node);
if (!buf)
return false;
@@ -1321,6 +1329,23 @@ bool rpcrdma_regbuf_realloc(struct rpcrdma_regbuf *rb, size_t size, gfp_t flags)
return true;
}
+static bool rpcrdma_rep_resize(struct rpcrdma_xprt *r_xprt,
+ struct rpcrdma_rep *rep)
+{
+ struct rpcrdma_regbuf *rb = rep->rr_rdmabuf;
+ struct rpcrdma_ep *ep = r_xprt->rx_ep;
+ size_t size = ep->re_inline_recv;
+
+ if (likely(rdmab_length(rb) >= size))
+ return true;
+ if (!rpcrdma_regbuf_realloc_node(rb, size, XPRTRDMA_GFP_FLAGS,
+ ibdev_to_node(ep->re_id->device)))
+ return false;
+
+ xdr_buf_init(&rep->rr_hdrbuf, rdmab_data(rb), rdmab_length(rb));
+ return true;
+}
+
/**
* __rpcrdma_regbuf_dma_map - DMA-map a regbuf
* @r_xprt: controlling transport instance
@@ -1404,6 +1429,10 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed)
break;
/* I1: a rep on rb_free_reps must carry no rqst pointer. */
WARN_ON_ONCE(rep->rr_rqst);
+ if (!rpcrdma_rep_resize(r_xprt, rep)) {
+ rpcrdma_rep_put(buf, rep);
+ break;
+ }
if (!rpcrdma_regbuf_dma_map(r_xprt, rep->rr_rdmabuf)) {
rpcrdma_rep_put(buf, rep);
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0673/1266] xprtrdma: Fix bcall rep leak and unbounded peek
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0672/1266] xprtrdma: Resize reply buffers before reposting receives Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0674/1266] xprtrdma: Sanitize the reply credit grant after parsing Greg Kroah-Hartman
` (325 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever,
Anna Schumaker, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
[ Upstream commit c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6 ]
rpcrdma_is_bcall() decodes a reply's first words to decide whether
the frame is a backchannel call. Two issues in that decode path
let a short or malformed reply leak the receive buffer and drain
the Receive queue.
First, the speculative peek
p = xdr_inline_decode(xdr, 0);
/* five p++ reads follow */
asks xdr_inline_decode() for zero bytes, which returns xdr->p
without consulting xdr->end. The five subsequent __be32 reads can
then walk up to 20 bytes past the wire payload into stale regbuf
contents and misclassify the reply as a backchannel call.
Second, after the post-peek
p = xdr_inline_decode(xdr, 3 * sizeof(*p));
if (unlikely(!p))
return true;
the short-header arm returns true without calling
rpcrdma_bc_receive_call(). The contract with the caller is that a
true return transfers ownership of rep to the backchannel path:
rpcrdma_reply_handler()
if (rpcrdma_is_bcall(r_xprt, rep))
return; /* bare return, skips out_post */
...
out_post:
rpcrdma_post_recvs(r_xprt, credits + ...);
Because rpcrdma_bc_receive_call() never ran, no one took rep, but
rpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()
and rpcrdma_post_recvs(). The rep, with its persistently
DMA-mapped receive buffer, is orphaned on rb_all_reps and freed
only at transport teardown. This completion reposts nothing, so
its slot is reclaimed only when a later forward-channel reply
reaches out_post and rpcrdma_post_recvs() allocates a fresh rep to
backfill; absent that traffic the Receive queue drains and the
peer's Sends draw RNR NAKs.
Fix by consulting xdr->end after the zero-length peek so the five
__be32 reads cannot run unless 20 bytes of wire payload remain. A
byte-precise comparison against xdr->end is required because a
non-4-aligned receive rounds the stream's word count up past the
true payload. Also return false from the short-header arm so the
reply falls through the normal out_norqst cleanup chain
(rpcrdma_rep_put() plus rpcrdma_post_recvs()).
Fixes: 41c8f70f5a3d ("xprtrdma: Harden backchannel call decoding")
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 0473d920f71c1b..51e70c767dace2 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1133,6 +1133,8 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
/* Peek at stream contents without advancing. */
p = xdr_inline_decode(xdr, 0);
+ if ((char *)xdr->end - (char *)p < 5 * XDR_UNIT)
+ return false;
/* Chunk lists */
if (xdr_item_is_present(p++))
@@ -1157,7 +1159,7 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
*/
p = xdr_inline_decode(xdr, 3 * sizeof(*p));
if (unlikely(!p))
- return true;
+ return false;
rpcrdma_bc_receive_call(r_xprt, rep);
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0674/1266] xprtrdma: Sanitize the reply credit grant after parsing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0673/1266] xprtrdma: Fix bcall rep leak and unbounded peek Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0675/1266] xprtrdma: Repost Receive buffers for malformed replies Greg Kroah-Hartman
` (324 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit c3a628aab2dc8f5fd7bff86ceaeae64de590e60a ]
The out_norqst exit in rpcrdma_reply_handler() branches away before
the credit clamp, so a reply that matches no pending request reaches
out_post carrying the raw credit value parsed from the wire.
rpcrdma_post_recvs() does not bound its @needed argument: the refill
loop allocates and chains Receive WRs until the count is satisfied or
allocation fails. A peer that sends a well-formed reply carrying an
unknown XID and an inflated credit grant therefore drives rep
allocation and Receive posting past re_max_requests on every such
reply.
Move the clamp to immediately after the credit field is parsed,
ahead of the first branch that can reach out_post, so every later
consumer sees a sanitized value. The cwnd update stays on the
matched-request path.
Fixes: 704f3f640f72 ("xprtrdma: Post receive buffers after RPC completion")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 51e70c767dace2..34ef05ebf5fd49 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1517,6 +1517,14 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
credits = be32_to_cpu(*p++);
rep->rr_proc = *p++;
+ /* The credit grant from the wire is not trustworthy;
+ * sanitize it before any code path consumes it.
+ */
+ if (credits == 0)
+ credits = 1; /* don't deadlock */
+ else if (credits > r_xprt->rx_ep->re_max_requests)
+ credits = r_xprt->rx_ep->re_max_requests;
+
if (rep->rr_vers != rpcrdma_version)
goto out_badversion;
@@ -1533,10 +1541,6 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
xprt_pin_rqst(rqst);
spin_unlock(&xprt->queue_lock);
- if (credits == 0)
- credits = 1; /* don't deadlock */
- else if (credits > r_xprt->rx_ep->re_max_requests)
- credits = r_xprt->rx_ep->re_max_requests;
if (buf->rb_credits != credits)
rpcrdma_update_cwnd(r_xprt, credits);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0675/1266] xprtrdma: Repost Receive buffers for malformed replies
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0674/1266] xprtrdma: Sanitize the reply credit grant after parsing Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0676/1266] xprtrdma: Return sendctx slot after Send preparation failure Greg Kroah-Hartman
` (323 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit abc011ddaf1617e3e82d8a1e87daa7ddbfb9bac5 ]
rpcrdma_wc_receive() decrements the transport's Receive count for
every completion before it dispatches a successful Receive to
rpcrdma_reply_handler(). The handler must post a replacement
Receive WR before returning unless ownership of the rep has moved
elsewhere, as on the backchannel path.
Commit 2ae50ad68cd7 ("xprtrdma: Close window between waking RPC
senders and posting Receives") moved the Receive refill out of
rpcrdma_wc_receive(), where it had run ahead of every reply, into
rpcrdma_reply_handler() so that the responder's credit grant could
be parsed before reposting. The bad-version and short-reply exits
never reach that refill: they recycle the rep and return without
calling rpcrdma_post_recvs().
A remote peer can therefore drain the client's posted Receive
queue by sending a sustained stream of replies that are shorter
than the fixed transport header or that carry an unrecognized
RPC/RDMA version. Each such reply consumes one posted Receive
without replacing it. Once the queue empties, the peer's next
Send finds no posted Receive and the transport stalls until
reconnect.
Route both malformed-reply exits through the shared repost tail
after recycling the rep, refilling against buf->rb_credits, the
most recent accepted credit grant. Neither exit updates the
congestion window, so RPCs admitted under the previous grant
remain in flight awaiting replies. A smaller refill target would
let a stream of malformed replies ratchet the posted Receive count
down to the batch floor while the congestion window still admits
rb_credits RPCs; a burst of valid replies to those RPCs could then
overrun the posted Receives, and because the client connects with
rnr_retry_count of zero, a single RNR NAK terminates the
connection. Refilling against rb_credits also restores the target
that applied to malformed replies before commit 2ae50ad68cd7
("xprtrdma: Close window between waking RPC senders and posting
Receives") when rpcrdma_post_recvs() computed it from rb_credits
internally. rb_credits is at least one from connection
establishment onward, so the repost path always keeps Receives
posted.
Fixes: 2ae50ad68cd7 ("xprtrdma: Close window between waking RPC senders and posting Receives")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 34ef05ebf5fd49..f65ecbb83befc7 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1573,11 +1573,13 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
out_badversion:
trace_xprtrdma_reply_vers_err(rep);
- goto out;
+ rpcrdma_rep_put(buf, rep);
+ credits = buf->rb_credits;
+ goto out_post;
out_shortreply:
trace_xprtrdma_reply_short_err(rep);
-
-out:
rpcrdma_rep_put(buf, rep);
+ credits = buf->rb_credits;
+ goto out_post;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0676/1266] xprtrdma: Return sendctx slot after Send preparation failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0675/1266] xprtrdma: Repost Receive buffers for malformed replies Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0677/1266] perf cs-etm: Fix incorrect or missing decoder for raw trace Greg Kroah-Hartman
` (322 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 60e7870052f417d83965db144f70ae21fcfcf37f ]
rpcrdma_prepare_send_sges() gets a sendctx before it maps the SGEs
for the Send WR. If one of the mapping helpers fails, no Send WR
is posted, so no Send completion is guaranteed to advance rb_sc_tail.
Current cleanup clears sc_req so a later completion can sweep over
that slot, but a consecutive run of preparation failures can still
advance rb_sc_head until the ring appears full. At that point
rpcrdma_sendctx_get_locked() returns NULL and no Send can be posted to
produce the completion needed to recover the ring.
The trigger requires CONFIG_SUNRPC_XPRT_RDMA and an NFS/RDMA mount.
Mount setup and reliable DMA-map fault injection require local admin
authority. Unprivileged I/O on an existing mount can exercise the send
path, but a remote peer alone cannot force this local DMA-map failure.
Add rpcrdma_sendctx_unget_locked() for the single-consumer send path
to rewind rb_sc_head when the just-acquired sendctx is canceled before
ib_post_send(). Wake waiters after making the slot available again.
After the rewind, every slot the completion sweep visits belongs to a
posted Send, so rpcrdma_sendctx_put_locked() no longer needs to test
sc_req before unmapping.
Fixes: ae72950abf99 ("xprtrdma: Add data structure to manage RDMA Send arguments")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 5 ++++-
net/sunrpc/xprtrdma/verbs.c | 40 +++++++++++++++++++++++++++++----
net/sunrpc/xprtrdma/xprt_rdma.h | 2 ++
3 files changed, 42 insertions(+), 5 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index f65ecbb83befc7..e201b37578a70e 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -792,6 +792,7 @@ inline int rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
struct xdr_buf *xdr,
enum rpcrdma_chunktype rtype)
{
+ struct rpcrdma_sendctx *sc;
int ret;
ret = -EAGAIN;
@@ -834,7 +835,9 @@ inline int rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
return 0;
out_unmap:
- rpcrdma_sendctx_cancel(req->rl_sendctx);
+ sc = req->rl_sendctx;
+ rpcrdma_sendctx_cancel(sc);
+ rpcrdma_sendctx_unget_locked(r_xprt, sc);
out_nosc:
trace_xprtrdma_prepsend_failed(&req->rl_slot, ret);
return ret;
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index c2718732801b3c..27bb176f082f63 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -618,6 +618,11 @@ static void rpcrdma_sendctxs_destroy(struct rpcrdma_xprt *r_xprt)
/* The QP is drained, but the final unsignaled Sends might not
* have been walked by a signaled Send completion. Release those
* Send owners before request buffers are reset.
+ *
+ * Unlike the completion sweep, this walk can visit slots with
+ * no Send posted: after a partial rpcrdma_sendctxs_create()
+ * failure on reconnect, rb_sc_head and rb_sc_tail are stale,
+ * and slots between them can be NULL or have sc_req clear.
*/
for (i = rpcrdma_sendctx_next(buf, buf->rb_sc_tail);
i != rpcrdma_sendctx_next(buf, buf->rb_sc_head);
@@ -690,6 +695,12 @@ static unsigned long rpcrdma_sendctx_next(struct rpcrdma_buffer *buf,
return likely(item < buf->rb_sc_last) ? item + 1 : 0;
}
+static unsigned long rpcrdma_sendctx_prev(struct rpcrdma_buffer *buf,
+ unsigned long item)
+{
+ return item > 0 ? item - 1 : buf->rb_sc_last;
+}
+
/**
* rpcrdma_sendctx_get_locked - Acquire a send context
* @r_xprt: controlling transport instance
@@ -734,6 +745,29 @@ struct rpcrdma_sendctx *rpcrdma_sendctx_get_locked(struct rpcrdma_xprt *r_xprt)
return NULL;
}
+/**
+ * rpcrdma_sendctx_unget_locked - Release an unposted send context
+ * @r_xprt: controlling transport instance
+ * @sc: send context to release
+ *
+ * Usage: Called when no Send is posted for the sendctx most
+ * recently returned by rpcrdma_sendctx_get_locked().
+ *
+ * The caller serializes calls to this function and to
+ * rpcrdma_sendctx_get_locked() (per transport).
+ */
+void rpcrdma_sendctx_unget_locked(struct rpcrdma_xprt *r_xprt,
+ struct rpcrdma_sendctx *sc)
+{
+ struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+
+ if (WARN_ON_ONCE(buf->rb_sc_ctxs[buf->rb_sc_head] != sc))
+ return;
+
+ buf->rb_sc_head = rpcrdma_sendctx_prev(buf, buf->rb_sc_head);
+ xprt_write_space(&r_xprt->rx_xprt);
+}
+
/**
* rpcrdma_sendctx_put_locked - Release a send context
* @r_xprt: controlling transport instance
@@ -751,8 +785,7 @@ static void rpcrdma_sendctx_put_locked(struct rpcrdma_xprt *r_xprt,
unsigned long next_tail;
/* Release previously completed but unsignaled Sends by walking
- * up the queue until @sc is found. Entries left behind by a
- * failed rpcrdma_prepare_send_sges() have sc_req cleared.
+ * up the queue until @sc is found.
*/
next_tail = buf->rb_sc_tail;
do {
@@ -762,8 +795,7 @@ static void rpcrdma_sendctx_put_locked(struct rpcrdma_xprt *r_xprt,
/* ORDER: item must be accessed _before_ tail is updated */
cur = buf->rb_sc_ctxs[next_tail];
- if (cur->sc_req)
- rpcrdma_sendctx_unmap(cur);
+ rpcrdma_sendctx_unmap(cur);
} while (buf->rb_sc_ctxs[next_tail] != sc);
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 93ffb190ad50e2..c78734e93c717b 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -476,6 +476,8 @@ void rpcrdma_req_destroy(struct rpcrdma_req *req);
int rpcrdma_buffer_create(struct rpcrdma_xprt *);
void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
struct rpcrdma_sendctx *rpcrdma_sendctx_get_locked(struct rpcrdma_xprt *r_xprt);
+void rpcrdma_sendctx_unget_locked(struct rpcrdma_xprt *r_xprt,
+ struct rpcrdma_sendctx *sc);
struct rpcrdma_mr *rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt);
void rpcrdma_mrs_refresh(struct rpcrdma_xprt *r_xprt);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0677/1266] perf cs-etm: Fix incorrect or missing decoder for raw trace
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0676/1266] xprtrdma: Return sendctx slot after Send preparation failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0678/1266] perf cs-etm: Create decoders after both AUX and HW_ID search passes Greg Kroah-Hartman
` (321 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Besar Wicaksono, James Clark,
suzuki.poulose, mike.leach, jonathanh, rwiley, treding, vsethi,
ywan, linux-arm-kernel, coresight, linux-tegra, Namhyung Kim,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Besar Wicaksono <bwicaksono@nvidia.com>
[ Upstream commit a16afcc58a8c5ebc65c852faf001f8f61f05e4ef ]
The decoder creation for raw trace uses metadata from the first CPU.
On per-cpu mode, this metadata is incorrectly used for every decoder.
On per-process/per-thread traces, the first CPU is CPU0. If CPU0 trace
is not enabled, its metadata will be marked unused and the decoder is
not created. Perf report dump skips the decoding part because the
decoder is missing.
To fix this, use metadata of the CPU associated with sample object.
Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com>
Reviewed-by: James Clark <james.clark@arm.com>
Cc: suzuki.poulose@arm.com
Cc: mike.leach@linaro.org
Cc: jonathanh@nvidia.com
Cc: rwiley@nvidia.com
Cc: treding@nvidia.com
Cc: vsethi@nvidia.com
Cc: ywan@nvidia.com
Cc: linux-arm-kernel@lists.infradead.org
Cc: coresight@lists.linaro.org
Cc: linux-tegra@vger.kernel.org
Link: https://lore.kernel.org/r/20231010234803.5419-1-bwicaksono@nvidia.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Stable-dep-of: 68ca50bc0fa6 ("perf cs-etm: Queue context packets for frontend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 106 ++++++++++++++++++++++++---------------
1 file changed, 65 insertions(+), 41 deletions(-)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 799c104901b4ff..1fb104357eebb8 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -283,22 +283,31 @@ static int cs_etm__metadata_set_trace_id(u8 trace_chan_id, u64 *cpu_metadata)
}
/*
- * Get a metadata for a specific cpu from an array.
+ * Get a metadata index for a specific cpu from an array.
*
*/
-static u64 *get_cpu_data(struct cs_etm_auxtrace *etm, int cpu)
+static int get_cpu_data_idx(struct cs_etm_auxtrace *etm, int cpu)
{
int i;
- u64 *metadata = NULL;
for (i = 0; i < etm->num_cpu; i++) {
if (etm->metadata[i][CS_ETM_CPU] == (u64)cpu) {
- metadata = etm->metadata[i];
- break;
+ return i;
}
}
- return metadata;
+ return -1;
+}
+
+/*
+ * Get a metadata for a specific cpu from an array.
+ *
+ */
+static u64 *get_cpu_data(struct cs_etm_auxtrace *etm, int cpu)
+{
+ int idx = get_cpu_data_idx(etm, cpu);
+
+ return (idx != -1) ? etm->metadata[idx] : NULL;
}
/*
@@ -641,66 +650,80 @@ static void cs_etm__packet_dump(const char *pkt_string)
}
static void cs_etm__set_trace_param_etmv3(struct cs_etm_trace_params *t_params,
- struct cs_etm_auxtrace *etm, int idx,
- u32 etmidr)
+ struct cs_etm_auxtrace *etm, int t_idx,
+ int m_idx, u32 etmidr)
{
u64 **metadata = etm->metadata;
- t_params[idx].protocol = cs_etm__get_v7_protocol_version(etmidr);
- t_params[idx].etmv3.reg_ctrl = metadata[idx][CS_ETM_ETMCR];
- t_params[idx].etmv3.reg_trc_id = metadata[idx][CS_ETM_ETMTRACEIDR];
+ t_params[t_idx].protocol = cs_etm__get_v7_protocol_version(etmidr);
+ t_params[t_idx].etmv3.reg_ctrl = metadata[m_idx][CS_ETM_ETMCR];
+ t_params[t_idx].etmv3.reg_trc_id = metadata[m_idx][CS_ETM_ETMTRACEIDR];
}
static void cs_etm__set_trace_param_etmv4(struct cs_etm_trace_params *t_params,
- struct cs_etm_auxtrace *etm, int idx)
+ struct cs_etm_auxtrace *etm, int t_idx,
+ int m_idx)
{
u64 **metadata = etm->metadata;
- t_params[idx].protocol = CS_ETM_PROTO_ETMV4i;
- t_params[idx].etmv4.reg_idr0 = metadata[idx][CS_ETMV4_TRCIDR0];
- t_params[idx].etmv4.reg_idr1 = metadata[idx][CS_ETMV4_TRCIDR1];
- t_params[idx].etmv4.reg_idr2 = metadata[idx][CS_ETMV4_TRCIDR2];
- t_params[idx].etmv4.reg_idr8 = metadata[idx][CS_ETMV4_TRCIDR8];
- t_params[idx].etmv4.reg_configr = metadata[idx][CS_ETMV4_TRCCONFIGR];
- t_params[idx].etmv4.reg_traceidr = metadata[idx][CS_ETMV4_TRCTRACEIDR];
+ t_params[t_idx].protocol = CS_ETM_PROTO_ETMV4i;
+ t_params[t_idx].etmv4.reg_idr0 = metadata[m_idx][CS_ETMV4_TRCIDR0];
+ t_params[t_idx].etmv4.reg_idr1 = metadata[m_idx][CS_ETMV4_TRCIDR1];
+ t_params[t_idx].etmv4.reg_idr2 = metadata[m_idx][CS_ETMV4_TRCIDR2];
+ t_params[t_idx].etmv4.reg_idr8 = metadata[m_idx][CS_ETMV4_TRCIDR8];
+ t_params[t_idx].etmv4.reg_configr = metadata[m_idx][CS_ETMV4_TRCCONFIGR];
+ t_params[t_idx].etmv4.reg_traceidr = metadata[m_idx][CS_ETMV4_TRCTRACEIDR];
}
static void cs_etm__set_trace_param_ete(struct cs_etm_trace_params *t_params,
- struct cs_etm_auxtrace *etm, int idx)
+ struct cs_etm_auxtrace *etm, int t_idx,
+ int m_idx)
{
u64 **metadata = etm->metadata;
- t_params[idx].protocol = CS_ETM_PROTO_ETE;
- t_params[idx].ete.reg_idr0 = metadata[idx][CS_ETE_TRCIDR0];
- t_params[idx].ete.reg_idr1 = metadata[idx][CS_ETE_TRCIDR1];
- t_params[idx].ete.reg_idr2 = metadata[idx][CS_ETE_TRCIDR2];
- t_params[idx].ete.reg_idr8 = metadata[idx][CS_ETE_TRCIDR8];
- t_params[idx].ete.reg_configr = metadata[idx][CS_ETE_TRCCONFIGR];
- t_params[idx].ete.reg_traceidr = metadata[idx][CS_ETE_TRCTRACEIDR];
- t_params[idx].ete.reg_devarch = metadata[idx][CS_ETE_TRCDEVARCH];
+ t_params[t_idx].protocol = CS_ETM_PROTO_ETE;
+ t_params[t_idx].ete.reg_idr0 = metadata[m_idx][CS_ETE_TRCIDR0];
+ t_params[t_idx].ete.reg_idr1 = metadata[m_idx][CS_ETE_TRCIDR1];
+ t_params[t_idx].ete.reg_idr2 = metadata[m_idx][CS_ETE_TRCIDR2];
+ t_params[t_idx].ete.reg_idr8 = metadata[m_idx][CS_ETE_TRCIDR8];
+ t_params[t_idx].ete.reg_configr = metadata[m_idx][CS_ETE_TRCCONFIGR];
+ t_params[t_idx].ete.reg_traceidr = metadata[m_idx][CS_ETE_TRCTRACEIDR];
+ t_params[t_idx].ete.reg_devarch = metadata[m_idx][CS_ETE_TRCDEVARCH];
}
static int cs_etm__init_trace_params(struct cs_etm_trace_params *t_params,
struct cs_etm_auxtrace *etm,
+ bool formatted,
+ int sample_cpu,
int decoders)
{
- int i;
+ int t_idx, m_idx;
u32 etmidr;
u64 architecture;
- for (i = 0; i < decoders; i++) {
- architecture = etm->metadata[i][CS_ETM_MAGIC];
+ for (t_idx = 0; t_idx < decoders; t_idx++) {
+ if (formatted)
+ m_idx = t_idx;
+ else {
+ m_idx = get_cpu_data_idx(etm, sample_cpu);
+ if (m_idx == -1) {
+ pr_warning("CS_ETM: unknown CPU, falling back to first metadata\n");
+ m_idx = 0;
+ }
+ }
+
+ architecture = etm->metadata[m_idx][CS_ETM_MAGIC];
switch (architecture) {
case __perf_cs_etmv3_magic:
- etmidr = etm->metadata[i][CS_ETM_ETMIDR];
- cs_etm__set_trace_param_etmv3(t_params, etm, i, etmidr);
+ etmidr = etm->metadata[m_idx][CS_ETM_ETMIDR];
+ cs_etm__set_trace_param_etmv3(t_params, etm, t_idx, m_idx, etmidr);
break;
case __perf_cs_etmv4_magic:
- cs_etm__set_trace_param_etmv4(t_params, etm, i);
+ cs_etm__set_trace_param_etmv4(t_params, etm, t_idx, m_idx);
break;
case __perf_cs_ete_magic:
- cs_etm__set_trace_param_ete(t_params, etm, i);
+ cs_etm__set_trace_param_ete(t_params, etm, t_idx, m_idx);
break;
default:
return -EINVAL;
@@ -1016,7 +1039,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
}
static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
- bool formatted)
+ bool formatted, int sample_cpu)
{
struct cs_etm_decoder_params d_params;
struct cs_etm_trace_params *t_params = NULL;
@@ -1041,7 +1064,7 @@ static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
if (!t_params)
goto out_free;
- if (cs_etm__init_trace_params(t_params, etm, decoders))
+ if (cs_etm__init_trace_params(t_params, etm, formatted, sample_cpu, decoders))
goto out_free;
/* Set decoder parameters to decode trace packets */
@@ -1081,14 +1104,15 @@ static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm,
struct auxtrace_queue *queue,
unsigned int queue_nr,
- bool formatted)
+ bool formatted,
+ int sample_cpu)
{
struct cs_etm_queue *etmq = queue->priv;
if (list_empty(&queue->head) || etmq)
return 0;
- etmq = cs_etm__alloc_queue(etm, formatted);
+ etmq = cs_etm__alloc_queue(etm, formatted, sample_cpu);
if (!etmq)
return -ENOMEM;
@@ -2827,7 +2851,7 @@ static int cs_etm__process_auxtrace_event(struct perf_session *session,
* formatted in piped mode (true).
*/
err = cs_etm__setup_queue(etm, &etm->queues.queue_array[idx],
- idx, true);
+ idx, true, -1);
if (err)
return err;
@@ -3033,7 +3057,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
idx = auxtrace_event->idx;
formatted = !(aux_event->flags & PERF_AUX_FLAG_CORESIGHT_FORMAT_RAW);
return cs_etm__setup_queue(etm, &etm->queues.queue_array[idx],
- idx, formatted);
+ idx, formatted, sample->cpu);
}
/* Wasn't inside this buffer, but there were no parse errors. 1 == 'not found' */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0678/1266] perf cs-etm: Create decoders after both AUX and HW_ID search passes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0677/1266] perf cs-etm: Fix incorrect or missing decoder for raw trace Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0679/1266] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
` (320 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Mike Leach,
James Clark, James Clark, Ganapatrao Kulkarni, Leo Yan,
Suzuki Poulouse, Adrian Hunter, Alexander Shishkin,
Alexandre Torgue, Ian Rogers, Ingo Molnar, Jiri Olsa, John Garry,
Kan Liang, Leo Yan, Mark Rutland, Maxime Coquelin, Namhyung Kim,
Peter Zijlstra, Will Deacon, Arnaldo Carvalho de Melo,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@arm.com>
[ Upstream commit b6aa0de9a53a231eb068ce1e62b5e7ec9e30e627 ]
Both of these passes gather information about how to create the
decoders. AUX records determine formatted/unformatted, and the HW_IDs
determine the traceID/metadata mappings.
Therefore it makes sense to cache the information and wait until both
passes are over until creating the decoders, rather than creating them
at the first HW_ID found.
This will allow a simplification of the creation process where
cs_etm_queue->traceid_list will exclusively used to create the decoders,
rather than the current two methods depending on whether the trace is
formatted or not.
Previously the sample CPU from the AUX record was used to initialize
the decoder CPU, but actually sample CPU == AUX queue index in per-CPU
mode, so saving the sample CPU isn't required.
Similarly formatted/unformatted was used upfront to create the decoders,
but now it's cached until later.
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: James Clark <james.clark@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Tested-by: Ganapatrao Kulkarni <gankulkarni@os.amperecomputing.com>
Tested-by: Leo Yan <leo.yan@arm.com>
Acked-by: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20240722101202.26915-2-james.clark@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 68ca50bc0fa6 ("perf cs-etm: Queue context packets for frontend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 182 ++++++++++++++++++++++++---------------
1 file changed, 113 insertions(+), 69 deletions(-)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 1fb104357eebb8..9077072994b23b 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -97,12 +97,19 @@ struct cs_etm_traceid_queue {
struct cs_etm_packet_queue packet_queue;
};
+enum cs_etm_format {
+ UNSET,
+ FORMATTED,
+ UNFORMATTED
+};
+
struct cs_etm_queue {
struct cs_etm_auxtrace *etm;
struct cs_etm_decoder *decoder;
struct auxtrace_buffer *buffer;
unsigned int queue_nr;
u8 pending_timestamp_chan_id;
+ enum cs_etm_format format;
u64 offset;
const unsigned char *buf;
size_t buf_len, buf_used;
@@ -693,7 +700,7 @@ static void cs_etm__set_trace_param_ete(struct cs_etm_trace_params *t_params,
static int cs_etm__init_trace_params(struct cs_etm_trace_params *t_params,
struct cs_etm_auxtrace *etm,
- bool formatted,
+ enum cs_etm_format format,
int sample_cpu,
int decoders)
{
@@ -702,7 +709,7 @@ static int cs_etm__init_trace_params(struct cs_etm_trace_params *t_params,
u64 architecture;
for (t_idx = 0; t_idx < decoders; t_idx++) {
- if (formatted)
+ if (format == FORMATTED)
m_idx = t_idx;
else {
m_idx = get_cpu_data_idx(etm, sample_cpu);
@@ -735,8 +742,7 @@ static int cs_etm__init_trace_params(struct cs_etm_trace_params *t_params,
static int cs_etm__init_decoder_params(struct cs_etm_decoder_params *d_params,
struct cs_etm_queue *etmq,
- enum cs_etm_decoder_operation mode,
- bool formatted)
+ enum cs_etm_decoder_operation mode)
{
int ret = -EINVAL;
@@ -746,7 +752,7 @@ static int cs_etm__init_decoder_params(struct cs_etm_decoder_params *d_params,
d_params->packet_printer = cs_etm__packet_dump;
d_params->operation = mode;
d_params->data = etmq;
- d_params->formatted = formatted;
+ d_params->formatted = etmq->format == FORMATTED;
d_params->fsyncs = false;
d_params->hsyncs = false;
d_params->frame_aligned = true;
@@ -1038,81 +1044,34 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
return ret;
}
-static struct cs_etm_queue *cs_etm__alloc_queue(struct cs_etm_auxtrace *etm,
- bool formatted, int sample_cpu)
+static struct cs_etm_queue *cs_etm__alloc_queue(void)
{
- struct cs_etm_decoder_params d_params;
- struct cs_etm_trace_params *t_params = NULL;
- struct cs_etm_queue *etmq;
- /*
- * Each queue can only contain data from one CPU when unformatted, so only one decoder is
- * needed.
- */
- int decoders = formatted ? etm->num_cpu : 1;
-
- etmq = zalloc(sizeof(*etmq));
+ struct cs_etm_queue *etmq = zalloc(sizeof(*etmq));
if (!etmq)
return NULL;
etmq->traceid_queues_list = intlist__new(NULL);
if (!etmq->traceid_queues_list)
- goto out_free;
-
- /* Use metadata to fill in trace parameters for trace decoder */
- t_params = zalloc(sizeof(*t_params) * decoders);
-
- if (!t_params)
- goto out_free;
-
- if (cs_etm__init_trace_params(t_params, etm, formatted, sample_cpu, decoders))
- goto out_free;
-
- /* Set decoder parameters to decode trace packets */
- if (cs_etm__init_decoder_params(&d_params, etmq,
- dump_trace ? CS_ETM_OPERATION_PRINT :
- CS_ETM_OPERATION_DECODE,
- formatted))
- goto out_free;
-
- etmq->decoder = cs_etm_decoder__new(decoders, &d_params,
- t_params);
-
- if (!etmq->decoder)
- goto out_free;
-
- /*
- * Register a function to handle all memory accesses required by
- * the trace decoder library.
- */
- if (cs_etm_decoder__add_mem_access_cb(etmq->decoder,
- 0x0L, ((u64) -1L),
- cs_etm__mem_access))
- goto out_free_decoder;
+ free(etmq);
- zfree(&t_params);
return etmq;
-
-out_free_decoder:
- cs_etm_decoder__free(etmq->decoder);
-out_free:
- intlist__delete(etmq->traceid_queues_list);
- free(etmq);
-
- return NULL;
}
static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm,
struct auxtrace_queue *queue,
- unsigned int queue_nr,
- bool formatted,
- int sample_cpu)
+ unsigned int queue_nr, enum cs_etm_format format)
{
struct cs_etm_queue *etmq = queue->priv;
+ if (etmq && format != etmq->format) {
+ pr_err("CS_ETM: mixed formatted and unformatted trace not supported\n");
+ return -EINVAL;
+ }
+
if (list_empty(&queue->head) || etmq)
return 0;
- etmq = cs_etm__alloc_queue(etm, formatted, sample_cpu);
+ etmq = cs_etm__alloc_queue();
if (!etmq)
return -ENOMEM;
@@ -1120,7 +1079,9 @@ static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm,
queue->priv = etmq;
etmq->etm = etm;
etmq->queue_nr = queue_nr;
+ queue->cpu = queue_nr; /* Placeholder, may be reset to -1 in per-thread mode */
etmq->offset = 0;
+ etmq->format = format;
return 0;
}
@@ -2851,7 +2812,7 @@ static int cs_etm__process_auxtrace_event(struct perf_session *session,
* formatted in piped mode (true).
*/
err = cs_etm__setup_queue(etm, &etm->queues.queue_array[idx],
- idx, true, -1);
+ idx, FORMATTED);
if (err)
return err;
@@ -2972,7 +2933,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
union perf_event auxtrace_fragment;
__u64 aux_offset, aux_size;
__u32 idx;
- bool formatted;
+ enum cs_etm_format format;
struct cs_etm_auxtrace *etm = container_of(session->auxtrace,
struct cs_etm_auxtrace,
@@ -3055,9 +3016,10 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
return err;
idx = auxtrace_event->idx;
- formatted = !(aux_event->flags & PERF_AUX_FLAG_CORESIGHT_FORMAT_RAW);
- return cs_etm__setup_queue(etm, &etm->queues.queue_array[idx],
- idx, formatted, sample->cpu);
+ format = (aux_event->flags & PERF_AUX_FLAG_CORESIGHT_FORMAT_RAW) ?
+ UNFORMATTED : FORMATTED;
+
+ return cs_etm__setup_queue(etm, &etm->queues.queue_array[idx], idx, format);
}
/* Wasn't inside this buffer, but there were no parse errors. 1 == 'not found' */
@@ -3241,6 +3203,84 @@ static int cs_etm__clear_unused_trace_ids_metadata(int num_cpu, u64 **metadata)
return 0;
}
+/*
+ * Use the data gathered by the peeks for HW_ID (trace ID mappings) and AUX
+ * (formatted or not) packets to create the decoders.
+ */
+static int cs_etm__create_queue_decoders(struct cs_etm_queue *etmq)
+{
+ struct cs_etm_decoder_params d_params;
+
+ /*
+ * Each queue can only contain data from one CPU when unformatted, so only one decoder is
+ * needed.
+ */
+ int decoders = etmq->format == FORMATTED ? etmq->etm->num_cpu : 1;
+
+ /* Use metadata to fill in trace parameters for trace decoder */
+ struct cs_etm_trace_params *t_params = zalloc(sizeof(*t_params) * decoders);
+
+ if (!t_params)
+ goto out_free;
+
+ if (cs_etm__init_trace_params(t_params, etmq->etm, etmq->format,
+ etmq->queue_nr, decoders))
+ goto out_free;
+
+ /* Set decoder parameters to decode trace packets */
+ if (cs_etm__init_decoder_params(&d_params, etmq,
+ dump_trace ? CS_ETM_OPERATION_PRINT :
+ CS_ETM_OPERATION_DECODE))
+ goto out_free;
+
+ etmq->decoder = cs_etm_decoder__new(decoders, &d_params,
+ t_params);
+
+ if (!etmq->decoder)
+ goto out_free;
+
+ /*
+ * Register a function to handle all memory accesses required by
+ * the trace decoder library.
+ */
+ if (cs_etm_decoder__add_mem_access_cb(etmq->decoder,
+ 0x0L, ((u64) -1L),
+ cs_etm__mem_access))
+ goto out_free_decoder;
+
+ zfree(&t_params);
+ return 0;
+
+out_free_decoder:
+ cs_etm_decoder__free(etmq->decoder);
+out_free:
+ zfree(&t_params);
+ return -EINVAL;
+}
+
+static int cs_etm__create_decoders(struct cs_etm_auxtrace *etm)
+{
+ struct auxtrace_queues *queues = &etm->queues;
+
+ for (unsigned int i = 0; i < queues->nr_queues; i++) {
+ bool empty = list_empty(&queues->queue_array[i].head);
+ struct cs_etm_queue *etmq = queues->queue_array[i].priv;
+ int ret;
+
+ /*
+ * Don't create decoders for empty queues, mainly because
+ * etmq->format is unknown for empty queues.
+ */
+ if (empty)
+ continue;
+
+ ret = cs_etm__create_queue_decoders(etmq);
+ if (ret)
+ return ret;
+ }
+ return 0;
+}
+
int cs_etm__process_auxtrace_info_full(union perf_event *event,
struct perf_session *session)
{
@@ -3389,6 +3429,10 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
if (err)
goto err_free_queues;
+ err = cs_etm__queue_aux_records(session);
+ if (err)
+ goto err_free_queues;
+
/*
* Map Trace ID values to CPU metadata.
*
@@ -3411,7 +3455,7 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
* flags if present.
*/
- /* first scan for AUX_OUTPUT_HW_ID records to map trace ID values to CPU metadata */
+ /* Scan for AUX_OUTPUT_HW_ID records to map trace ID values to CPU metadata */
aux_hw_id_found = 0;
err = perf_session__peek_events(session, session->header.data_offset,
session->header.data_size,
@@ -3429,7 +3473,7 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
if (err)
goto err_free_queues;
- err = cs_etm__queue_aux_records(session);
+ err = cs_etm__create_decoders(etm);
if (err)
goto err_free_queues;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0679/1266] perf cs-etm: Queue context packets for frontend
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0678/1266] perf cs-etm: Create decoders after both AUX and HW_ID search passes Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0680/1266] perf pmu: Fix pmu_id() heap underwrite on empty identifier file Greg Kroah-Hartman
` (319 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Ayupov, Leo Yan, Ian Rogers,
Jiri Olsa, Jonathan Corbet, linux-doc, Mike Leach, Namhyung Kim,
Paschalis Mpeis, Robert Walker, Shuah Khan, Suzuki Poulouse,
James Clark, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@linaro.org>
[ Upstream commit 68ca50bc0fa64841cd73b8a1538df1d7f7eb4108 ]
PE_CONTEXT elements update the context ID and exception level, but the
decoder may still have prior packets cached for frontend processing.
Updating the context immediately in the decoder backend can make those
cached packets get consumed with the wrong thread or EL state.
Add a CS_ETM_CONTEXT packet carrying the TID and EL to the frontend,
this keeps context changes ordered with the rest of the packet stream
and avoids mismatches when synthesizing samples from cached packets.
Separate the memory access function into one for the frontend and one
for decoding. The frontend also needs memory access to attach the
instruction to samples. Because the frontend does memory access for
both previous and current packets, change all the frontend memory access
function signatures to take both a tidq and packet. But backend always
uses the current backend EL and thread from the tidq.
Treat context packets as a boundary for branch sample generation and
remove tidq->prev_packet_thread because it's not possible to branch to a
different thread, so only tracking the current thread is required for
sample generation.
Fixes: e573e978fb12e160 ("perf cs-etm: Inject capabilitity for CoreSight traces")
Reported-by: Amir Ayupov <aaupov@meta.com>
Closes: https://lore.kernel.org/linux-perf-users/20260515021135.1729028-1-aaupov@meta.com/
Co-authored-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: linux-doc@vger.kernel.org
Cc: Mike Leach <mike.leach@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paschalis Mpeis <Paschalis.Mpeis@arm.com>
Cc: Robert Walker <robert.walker@arm.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +-
tools/perf/util/cs-etm.c | 236 +++++++++++-------
tools/perf/util/cs-etm.h | 8 +-
3 files changed, 163 insertions(+), 102 deletions(-)
diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
index 640e383cef441c..277da9f767b9d2 100644
--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -398,6 +398,8 @@ cs_etm_decoder__buffer_packet(struct cs_etm_packet_queue *packet_queue,
packet_queue->packet_buffer[et].flags = 0;
packet_queue->packet_buffer[et].exception_number = UINT32_MAX;
packet_queue->packet_buffer[et].trace_chan_id = trace_chan_id;
+ packet_queue->packet_buffer[et].el = ocsd_EL_unknown;
+ packet_queue->packet_buffer[et].tid = -1;
if (packet_queue->packet_count == CS_ETM_PACKET_MAX_BUFFER - 1)
return OCSD_RESP_WAIT;
@@ -445,6 +447,7 @@ cs_etm_decoder__buffer_range(struct cs_etm_queue *etmq,
packet->last_instr_type = elem->last_i_type;
packet->last_instr_subtype = elem->last_i_subtype;
packet->last_instr_cond = elem->last_instr_cond;
+ packet->el = elem->context.exception_level;
if (elem->last_i_type == OCSD_INSTR_BR || elem->last_i_type == OCSD_INSTR_BR_INDIRECT)
packet->last_instr_taken_branch = elem->last_instr_exec;
@@ -518,7 +521,9 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
const ocsd_generic_trace_elem *elem,
const uint8_t trace_chan_id)
{
+ struct cs_etm_packet *packet;
pid_t tid = -1;
+ int ret;
/*
* Process the PE_CONTEXT packets if we have a valid contextID or VMID.
@@ -539,12 +544,18 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
break;
}
- if (cs_etm__etmq_set_tid_el(etmq, tid, trace_chan_id,
- elem->context.exception_level))
+ if (cs_etm__etmq_update_decode_context(etmq, trace_chan_id,
+ elem->context.exception_level, tid))
return OCSD_RESP_FATAL_SYS_ERR;
- if (tid == -1)
- return OCSD_RESP_CONT;
+ ret = cs_etm_decoder__buffer_packet(etmq, packet_queue, trace_chan_id,
+ CS_ETM_CONTEXT);
+ if (ret != OCSD_RESP_CONT && ret != OCSD_RESP_WAIT)
+ return ret;
+
+ packet = &packet_queue->packet_buffer[packet_queue->tail];
+ packet->tid = tid;
+ packet->el = elem->context.exception_level;
/*
* A timestamp is generated after a PE_CONTEXT element so make sure
@@ -552,7 +563,7 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq,
*/
cs_etm_decoder__reset_timestamp(packet_queue);
- return OCSD_RESP_CONT;
+ return ret;
}
static ocsd_datapath_resp_t cs_etm_decoder__gen_trace_elem_printer(
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 9077072994b23b..8dc12759ee62f4 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -86,15 +86,22 @@ struct cs_etm_traceid_queue {
u64 period_instructions;
size_t last_branch_pos;
union perf_event *event_buf;
- struct thread *thread;
- struct thread *prev_packet_thread;
- ocsd_ex_level prev_packet_el;
- ocsd_ex_level el;
struct branch_stack *last_branch;
struct branch_stack *last_branch_rb;
struct cs_etm_packet *prev_packet;
struct cs_etm_packet *packet;
struct cs_etm_packet_queue packet_queue;
+
+ struct thread *decode_thread;
+ ocsd_ex_level decode_el;
+
+ /*
+ * The frontend accesses the EL from '[prev_]packet' because it needs
+ * previous EL for branch and current EL for instruction samples. It's
+ * not possible to change thread in a single branch sample so no need to
+ * store or access the thread through the packet.
+ */
+ struct thread *frontend_thread;
};
enum cs_etm_format {
@@ -489,10 +496,11 @@ static int cs_etm__init_traceid_queue(struct cs_etm_queue *etmq,
queue = &etmq->etm->queues.queue_array[etmq->queue_nr];
tidq->trace_chan_id = trace_chan_id;
- tidq->el = tidq->prev_packet_el = ocsd_EL_unknown;
- tidq->thread = machine__findnew_thread(&etm->session->machines.host, -1,
+ tidq->decode_el = ocsd_EL_unknown;
+ tidq->frontend_thread = machine__findnew_thread(&etm->session->machines.host, -1,
+ queue->tid);
+ tidq->decode_thread = machine__findnew_thread(&etm->session->machines.host, -1,
queue->tid);
- tidq->prev_packet_thread = machine__idle_thread(&etm->session->machines.host);
tidq->packet = zalloc(sizeof(struct cs_etm_packet));
if (!tidq->packet)
@@ -625,21 +633,10 @@ static void cs_etm__packet_swap(struct cs_etm_auxtrace *etm,
/*
* Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for
* the next incoming packet.
- *
- * Threads and exception levels are also tracked for both the
- * previous and current packets. This is because the previous
- * packet is used for the 'from' IP for branch samples, so the
- * thread at that time must also be assigned to that sample.
- * Across discontinuity packets the thread can change, so by
- * tracking the thread for the previous packet the branch sample
- * will have the correct info.
*/
tmp = tidq->packet;
tidq->packet = tidq->prev_packet;
tidq->prev_packet = tmp;
- tidq->prev_packet_el = tidq->el;
- thread__put(tidq->prev_packet_thread);
- tidq->prev_packet_thread = thread__get(tidq->thread);
}
}
@@ -827,8 +824,8 @@ static void cs_etm__free_traceid_queues(struct cs_etm_queue *etmq)
/* Free this traceid_queue from the array */
tidq = etmq->traceid_queues[idx];
- thread__zput(tidq->thread);
- thread__zput(tidq->prev_packet_thread);
+ thread__zput(tidq->frontend_thread);
+ thread__zput(tidq->decode_thread);
zfree(&tidq->event_buf);
zfree(&tidq->last_branch);
zfree(&tidq->last_branch_rb);
@@ -969,47 +966,43 @@ static u8 cs_etm__cpu_mode(struct cs_etm_queue *etmq, u64 address,
}
}
-static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
- u64 address, size_t size, u8 *buffer,
- const ocsd_mem_space_acc_t mem_space)
+static u32 __cs_etm__mem_access(struct cs_etm_queue *etmq,
+ u64 address, size_t size, u8 *buffer,
+ const ocsd_mem_space_acc_t mem_space,
+ ocsd_ex_level el, struct thread *thread)
{
u8 cpumode;
u64 offset;
int len;
struct addr_location al;
struct dso *dso;
- struct cs_etm_traceid_queue *tidq;
int ret = 0;
if (!etmq)
return 0;
addr_location__init(&al);
- tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
- if (!tidq)
- goto out;
/*
- * We've already tracked EL along side the PID in cs_etm__set_thread()
- * so double check that it matches what OpenCSD thinks as well. It
- * doesn't distinguish between EL0 and EL1 for this mem access callback
- * so we had to do the extra tracking. Skip validation if it's any of
- * the 'any' values.
+ * We track EL for the frontend and the backend when receiving context
+ * and range packets. OpenCSD doesn't distinguish between EL0 and EL1
+ * for this mem access callback so we had to do the extra tracking. Skip
+ * validation if it's any of the 'any' values.
*/
if (!(mem_space == OCSD_MEM_SPACE_ANY ||
mem_space == OCSD_MEM_SPACE_N || mem_space == OCSD_MEM_SPACE_S)) {
if (mem_space & OCSD_MEM_SPACE_EL1N) {
/* Includes both non secure EL1 and EL0 */
- assert(tidq->el == ocsd_EL1 || tidq->el == ocsd_EL0);
+ assert(el == ocsd_EL1 || el == ocsd_EL0);
} else if (mem_space & OCSD_MEM_SPACE_EL2)
- assert(tidq->el == ocsd_EL2);
+ assert(el == ocsd_EL2);
else if (mem_space & OCSD_MEM_SPACE_EL3)
- assert(tidq->el == ocsd_EL3);
+ assert(el == ocsd_EL3);
}
- cpumode = cs_etm__cpu_mode(etmq, address, tidq->el);
+ cpumode = cs_etm__cpu_mode(etmq, address, el);
- if (!thread__find_map(tidq->thread, cpumode, address, &al))
+ if (!thread__find_map(thread, cpumode, address, &al))
goto out;
dso = map__dso(al.map);
@@ -1024,7 +1017,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
map__load(al.map);
- len = dso__data_read_offset(dso, maps__machine(thread__maps(tidq->thread)),
+ len = dso__data_read_offset(dso, maps__machine(thread__maps(thread)),
offset, buffer, size);
if (len <= 0) {
@@ -1044,6 +1037,30 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
return ret;
}
+static u32 cs_etm__frontend_mem_access(struct cs_etm_queue *etmq,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
+ u64 address, size_t size, u8 *buffer)
+{
+ return __cs_etm__mem_access(etmq, address, size, buffer, 0, packet->el,
+ tidq->frontend_thread);
+}
+
+static u32 cs_etm__decoder_mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id,
+ u64 address, size_t size, u8 *buffer,
+ const ocsd_mem_space_acc_t mem_space)
+{
+ struct cs_etm_traceid_queue *tidq;
+
+ tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
+ if (!tidq)
+ return 0;
+
+ return __cs_etm__mem_access(etmq, address, size, buffer,
+ mem_space, tidq->decode_el,
+ tidq->decode_thread);
+}
+
static struct cs_etm_queue *cs_etm__alloc_queue(void)
{
struct cs_etm_queue *etmq = zalloc(sizeof(*etmq));
@@ -1209,12 +1226,13 @@ void cs_etm__reset_last_branch_rb(struct cs_etm_traceid_queue *tidq)
}
static inline int cs_etm__t32_instr_size(struct cs_etm_queue *etmq,
- u8 trace_chan_id, u64 addr)
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet, u64 addr)
{
u8 instrBytes[2];
- cs_etm__mem_access(etmq, trace_chan_id, addr, ARRAY_SIZE(instrBytes),
- instrBytes, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ ARRAY_SIZE(instrBytes), instrBytes);
/*
* T32 instruction size is indicated by bits[15:11] of the first
* 16-bit word of the instruction: 0b11101, 0b11110 and 0b11111
@@ -1243,16 +1261,16 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)
}
static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,
- u64 trace_chan_id,
- const struct cs_etm_packet *packet,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
u64 offset)
{
if (packet->isa == CS_ETM_ISA_T32) {
u64 addr = packet->start_addr;
while (offset) {
- addr += cs_etm__t32_instr_size(etmq,
- trace_chan_id, addr);
+ addr += cs_etm__t32_instr_size(etmq, tidq, packet,
+ addr);
offset--;
}
return addr;
@@ -1344,34 +1362,51 @@ cs_etm__get_trace(struct cs_etm_queue *etmq)
return etmq->buf_len;
}
-static void cs_etm__set_thread(struct cs_etm_queue *etmq,
- struct cs_etm_traceid_queue *tidq, pid_t tid,
- ocsd_ex_level el)
+/*
+ * Convert a raw thread number to a thread struct and assign it to **thread.
+ */
+static int cs_etm__etmq_update_thread(struct cs_etm_queue *etmq,
+ ocsd_ex_level el, pid_t tid,
+ struct thread **thread)
{
struct machine *machine = cs_etm__get_machine(etmq, el);
+ if (!machine || !*thread)
+ return -EINVAL;
+
if (tid != -1) {
- thread__zput(tidq->thread);
- tidq->thread = machine__find_thread(machine, -1, tid);
+ thread__zput(*thread);
+ *thread = machine__find_thread(machine, -1, tid);
}
/* Couldn't find a known thread */
- if (!tidq->thread)
- tidq->thread = machine__idle_thread(machine);
+ if (!*thread)
+ *thread = machine__idle_thread(machine);
- tidq->el = el;
+ return 0;
}
-int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid,
- u8 trace_chan_id, ocsd_ex_level el)
+/*
+ * Set the thread and EL of the decode context which is ahead in time of the
+ * frontend context.
+ */
+int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq,
+ u8 trace_chan_id,
+ ocsd_ex_level el, pid_t tid)
{
struct cs_etm_traceid_queue *tidq;
+ int ret;
tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id);
if (!tidq)
return -EINVAL;
- cs_etm__set_thread(etmq, tidq, tid, el);
+ ret = cs_etm__etmq_update_thread(etmq, el, tid,
+ &tidq->decode_thread);
+ if (ret)
+ return ret;
+
+ tidq->decode_el = el;
return 0;
}
@@ -1381,8 +1416,8 @@ bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq)
}
static void cs_etm__copy_insn(struct cs_etm_queue *etmq,
- u64 trace_chan_id,
- const struct cs_etm_packet *packet,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
struct perf_sample *sample)
{
/*
@@ -1399,14 +1434,14 @@ static void cs_etm__copy_insn(struct cs_etm_queue *etmq,
* cs_etm__t32_instr_size().
*/
if (packet->isa == CS_ETM_ISA_T32)
- sample->insn_len = cs_etm__t32_instr_size(etmq, trace_chan_id,
+ sample->insn_len = cs_etm__t32_instr_size(etmq, tidq, packet,
sample->ip);
/* Otherwise, A64 and A32 instruction size are always 32-bit. */
else
sample->insn_len = 4;
- cs_etm__mem_access(etmq, trace_chan_id, sample->ip, sample->insn_len,
- (void *)sample->insn, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, sample->ip,
+ sample->insn_len, (void *)sample->insn);
}
u64 cs_etm__convert_sample_time(struct cs_etm_queue *etmq, u64 cs_timestamp)
@@ -1433,6 +1468,7 @@ static inline u64 cs_etm__resolve_sample_time(struct cs_etm_queue *etmq,
static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet,
u64 addr, u64 period)
{
int ret = 0;
@@ -1441,23 +1477,23 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
struct perf_sample sample = {.ip = 0,};
event->sample.header.type = PERF_RECORD_SAMPLE;
- event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, tidq->el);
+ event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, packet->el);
event->sample.header.size = sizeof(struct perf_event_header);
/* Set time field based on etm auxtrace config. */
sample.time = cs_etm__resolve_sample_time(etmq, tidq);
sample.ip = addr;
- sample.pid = thread__pid(tidq->thread);
- sample.tid = thread__tid(tidq->thread);
+ sample.pid = thread__pid(tidq->frontend_thread);
+ sample.tid = thread__tid(tidq->frontend_thread);
sample.id = etmq->etm->instructions_id;
sample.stream_id = etmq->etm->instructions_id;
sample.period = period;
- sample.cpu = tidq->packet->cpu;
+ sample.cpu = packet->cpu;
sample.flags = tidq->prev_packet->flags;
sample.cpumode = event->sample.header.misc;
- cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->packet, &sample);
+ cs_etm__copy_insn(etmq, tidq, packet, &sample);
if (etm->synth_opts.last_branch)
sample.branch_stack = tidq->last_branch;
@@ -1501,15 +1537,15 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq,
event->sample.header.type = PERF_RECORD_SAMPLE;
event->sample.header.misc = cs_etm__cpu_mode(etmq, ip,
- tidq->prev_packet_el);
+ tidq->prev_packet->el);
event->sample.header.size = sizeof(struct perf_event_header);
/* Set time field based on etm auxtrace config. */
sample.time = cs_etm__resolve_sample_time(etmq, tidq);
sample.ip = ip;
- sample.pid = thread__pid(tidq->prev_packet_thread);
- sample.tid = thread__tid(tidq->prev_packet_thread);
+ sample.pid = thread__pid(tidq->frontend_thread);
+ sample.tid = thread__tid(tidq->frontend_thread);
sample.addr = cs_etm__first_executed_instr(tidq->packet);
sample.id = etmq->etm->branches_id;
sample.stream_id = etmq->etm->branches_id;
@@ -1518,8 +1554,7 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq,
sample.flags = tidq->prev_packet->flags;
sample.cpumode = event->sample.header.misc;
- cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->prev_packet,
- &sample);
+ cs_etm__copy_insn(etmq, tidq, tidq->prev_packet, &sample);
/*
* perf report cannot handle events without a branch stack
@@ -1672,7 +1707,6 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
{
struct cs_etm_auxtrace *etm = etmq->etm;
int ret;
- u8 trace_chan_id = tidq->trace_chan_id;
u64 instrs_prev;
/* Get instructions remainder from previous packet */
@@ -1758,10 +1792,10 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
* been executed, but PC has not advanced to next
* instruction)
*/
- addr = cs_etm__instr_addr(etmq, trace_chan_id,
- tidq->packet, offset - 1);
+ addr = cs_etm__instr_addr(etmq, tidq, tidq->packet,
+ offset - 1);
ret = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->packet, addr,
etm->instructions_sample_period);
if (ret)
return ret;
@@ -1843,7 +1877,7 @@ static int cs_etm__flush(struct cs_etm_queue *etmq,
addr = cs_etm__last_executed_instr(tidq->prev_packet);
err = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->prev_packet, addr,
tidq->period_instructions);
if (err)
return err;
@@ -1898,7 +1932,7 @@ static int cs_etm__end_block(struct cs_etm_queue *etmq,
addr = cs_etm__last_executed_instr(tidq->prev_packet);
err = cs_etm__synth_instruction_sample(
- etmq, tidq, addr,
+ etmq, tidq, tidq->prev_packet, addr,
tidq->period_instructions);
if (err)
return err;
@@ -1935,9 +1969,9 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq)
return etmq->buf_len;
}
-static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
- struct cs_etm_packet *packet,
- u64 end_addr)
+static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq,
+ struct cs_etm_traceid_queue *tidq,
+ struct cs_etm_packet *packet, u64 end_addr)
{
/* Initialise to keep compiler happy */
u16 instr16 = 0;
@@ -1959,8 +1993,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* so below only read 2 bytes as instruction size for T32.
*/
addr = end_addr - 2;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr16),
- (u8 *)&instr16, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr16), (u8 *)&instr16);
if ((instr16 & 0xFF00) == 0xDF00)
return true;
@@ -1975,8 +2009,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* +---------+---------+-------------------------+
*/
addr = end_addr - 4;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32),
- (u8 *)&instr32, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr32), (u8 *)&instr32);
if ((instr32 & 0x0F000000) == 0x0F000000 &&
(instr32 & 0xF0000000) != 0xF0000000)
return true;
@@ -1992,8 +2026,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
* +-----------------------+---------+-----------+
*/
addr = end_addr - 4;
- cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32),
- (u8 *)&instr32, 0);
+ cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+ sizeof(instr32), (u8 *)&instr32);
if ((instr32 & 0xFFE0001F) == 0xd4000001)
return true;
@@ -2009,7 +2043,6 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id,
static bool cs_etm__is_syscall(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq, u64 magic)
{
- u8 trace_chan_id = tidq->trace_chan_id;
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
@@ -2024,7 +2057,7 @@ static bool cs_etm__is_syscall(struct cs_etm_queue *etmq,
*/
if (magic == __perf_cs_etmv4_magic) {
if (packet->exception_number == CS_ETMV4_EXC_CALL &&
- cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet,
+ cs_etm__is_svc_instr(etmq, tidq, prev_packet,
prev_packet->end_addr))
return true;
}
@@ -2062,7 +2095,6 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq,
struct cs_etm_traceid_queue *tidq,
u64 magic)
{
- u8 trace_chan_id = tidq->trace_chan_id;
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
@@ -2088,7 +2120,7 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq,
* (SMC, HVC) are taken as sync exceptions.
*/
if (packet->exception_number == CS_ETMV4_EXC_CALL &&
- !cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet,
+ !cs_etm__is_svc_instr(etmq, tidq, prev_packet,
prev_packet->end_addr))
return true;
@@ -2112,7 +2144,6 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
{
struct cs_etm_packet *packet = tidq->packet;
struct cs_etm_packet *prev_packet = tidq->prev_packet;
- u8 trace_chan_id = tidq->trace_chan_id;
u64 magic;
int ret;
@@ -2193,11 +2224,11 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
if (prev_packet->flags == (PERF_IP_FLAG_BRANCH |
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_INTERRUPT) &&
- cs_etm__is_svc_instr(etmq, trace_chan_id,
- packet, packet->start_addr))
+ cs_etm__is_svc_instr(etmq, tidq, packet, packet->start_addr)) {
prev_packet->flags = PERF_IP_FLAG_BRANCH |
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_SYSCALLRET;
+ }
break;
case CS_ETM_DISCONTINUITY:
/*
@@ -2278,6 +2309,7 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq,
PERF_IP_FLAG_RETURN |
PERF_IP_FLAG_INTERRUPT;
break;
+ case CS_ETM_CONTEXT:
case CS_ETM_EMPTY:
default:
break;
@@ -2353,6 +2385,19 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq,
*/
cs_etm__sample(etmq, tidq);
break;
+ case CS_ETM_CONTEXT:
+ /*
+ * Update context but don't swap packet. Keep the
+ * previous one for branch source address info, if
+ * tracing the kernel the context packet will be emitted
+ * between two ranges.
+ */
+ ret = cs_etm__etmq_update_thread(etmq, tidq->packet->el,
+ tidq->packet->tid,
+ &tidq->frontend_thread);
+ if (ret)
+ goto out;
+ break;
case CS_ETM_EXCEPTION:
case CS_ETM_EXCEPTION_RET:
/*
@@ -2381,6 +2426,7 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq,
}
}
+out:
return ret;
}
@@ -2504,7 +2550,7 @@ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
if (!tidq)
continue;
- if (tid == -1 || thread__tid(tidq->thread) == tid)
+ if (tid == -1 || thread__tid(tidq->frontend_thread) == tid)
cs_etm__run_per_thread_timeless_decoder(etmq);
} else
cs_etm__run_per_cpu_timeless_decoder(etmq);
@@ -3245,7 +3291,7 @@ static int cs_etm__create_queue_decoders(struct cs_etm_queue *etmq)
*/
if (cs_etm_decoder__add_mem_access_cb(etmq->decoder,
0x0L, ((u64) -1L),
- cs_etm__mem_access))
+ cs_etm__decoder_mem_access))
goto out_free_decoder;
zfree(&t_params);
diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
index 7cca3788791760..f7b4903d9ef726 100644
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -158,6 +158,7 @@ enum cs_etm_sample_type {
CS_ETM_DISCONTINUITY,
CS_ETM_EXCEPTION,
CS_ETM_EXCEPTION_RET,
+ CS_ETM_CONTEXT,
};
enum cs_etm_isa {
@@ -184,6 +185,8 @@ struct cs_etm_packet {
u8 last_instr_size;
u8 trace_chan_id;
int cpu;
+ int el;
+ pid_t tid;
};
#define CS_ETM_PACKET_MAX_BUFFER 1024
@@ -254,8 +257,9 @@ enum cs_etm_pid_fmt {
#include <opencsd/ocsd_if_types.h>
int cs_etm__get_cpu(u8 trace_chan_id, int *cpu);
enum cs_etm_pid_fmt cs_etm__get_pid_fmt(struct cs_etm_queue *etmq);
-int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid,
- u8 trace_chan_id, ocsd_ex_level el);
+int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq,
+ u8 trace_chan_id, ocsd_ex_level el,
+ pid_t tid);
bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq);
void cs_etm__etmq_set_traceid_queue_timestamp(struct cs_etm_queue *etmq,
u8 trace_chan_id);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0680/1266] perf pmu: Fix pmu_id() heap underwrite on empty identifier file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0679/1266] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0681/1266] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
` (318 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, John Garry,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 836455e6dbd34eb3d12eeab5e2d2b9a7f1512459 ]
pmu_id() calls filename__read_str() then strips the trailing newline
via str[len - 1] = 0. If the PMU identifier file is empty,
filename__read_str() succeeds with len = 0. len - 1 underflows
size_t to SIZE_MAX, writing a null byte before the heap allocation.
Add a len == 0 check before the newline stripping.
Fixes: 51d548471510843e ("perf pmu: Add pmu_id()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/pmu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 2587c4b463fa88..e05dff925aa069 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -774,6 +774,12 @@ static char *pmu_id(const char *name)
if (filename__read_str(path, &str, &len) < 0)
return NULL;
+ /* empty identifier file — nothing useful */
+ if (len == 0) {
+ free(str);
+ return NULL;
+ }
+
str[len - 1] = 0; /* remove line feed */
return str;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0681/1266] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0680/1266] perf pmu: Fix pmu_id() heap underwrite on empty identifier file Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0682/1266] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
` (317 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Stephane Eranian,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 33035f7dd4e49f3f117e70c5e36c8c1ae88d37f2 ]
perf_pmu__parse_scale() reads a PMU scale file then accesses
scale[sret - 1] to strip a trailing newline. Only sret < 0 is
guarded, so an empty file (sret == 0) causes scale[-1] — a stack
buffer underflow that reads and potentially writes out of bounds.
perf_pmu__parse_unit() has the same pattern: alias->unit[sret - 1]
with sret == 0 accesses the byte before the struct member, which
may corrupt the adjacent pmu_name pointer field.
Change both guards from sret < 0 to sret <= 0 so that empty files
are treated as read errors.
Fixes: 410136f5dd96b601 ("tools/perf/stat: Add event unit and scale support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Stephane Eranian <eranian@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index e05dff925aa069..d5daa6e43522db 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -318,7 +318,7 @@ static int perf_pmu__parse_scale(struct perf_pmu *pmu, struct perf_pmu_alias *al
goto error;
sret = read(fd, scale, sizeof(scale)-1);
- if (sret < 0)
+ if (sret <= 0)
goto error;
if (scale[sret - 1] == '\n')
@@ -350,7 +350,7 @@ static int perf_pmu__parse_unit(struct perf_pmu *pmu, struct perf_pmu_alias *ali
return -1;
sret = read(fd, alias->unit, UNIT_MAX_LEN);
- if (sret < 0)
+ if (sret <= 0)
goto error;
close(fd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0682/1266] tools lib api: Fix missing null termination in filename__read_int/ull()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0681/1266] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0683/1266] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
` (316 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 52b1f9678499b13b7aeb0186d9c6f486c043283f ]
filename__read_int() passes a stack buffer to read() using the full
sizeof(line) and then hands it to atoi() without null-terminating.
If a sysfs file fills the 64-byte buffer exactly, atoi() reads past
the array into uninitialized stack memory.
filename__read_ull_base() has the same issue with strtoull().
Fix both by reading sizeof(line) - 1 bytes and explicitly
null-terminating after a successful read.
Fixes: 3a351127cbc682c3 ("tools lib fs: Adopt filename__read_int from tools/perf/")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 5cb0eeec2c8a6c..1ea76e5ba9d482 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -293,11 +293,14 @@ int filename__read_int(const char *filename, int *value)
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
+ ssize_t n;
if (fd < 0)
return -1;
- if (read(fd, line, sizeof(line)) > 0) {
+ n = read(fd, line, sizeof(line) - 1);
+ if (n > 0) {
+ line[n] = '\0';
*value = atoi(line);
err = 0;
}
@@ -311,11 +314,14 @@ static int filename__read_ull_base(const char *filename,
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
+ ssize_t n;
if (fd < 0)
return -1;
- if (read(fd, line, sizeof(line)) > 0) {
+ n = read(fd, line, sizeof(line) - 1);
+ if (n > 0) {
+ line[n] = '\0';
*value = strtoull(line, NULL, base);
if (*value != ULLONG_MAX)
err = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0683/1266] perf symbols: Fix signed overflow in sysfs__read_build_id() size check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0682/1266] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0684/1266] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
` (315 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 6eaa8ee3e2abe5112e80e94c27196bb175689469 ]
sysfs__read_build_id() reads ELF note headers from sysfs files. The
note's namesz and descsz fields are used to compute the skip size:
int n = namesz + descsz;
if (n > (int)sizeof(bf))
Both namesz and descsz are size_t from NOTE_ALIGN() of 32-bit note
header fields. Their sum can exceed INT_MAX, overflowing the signed
int n to a negative value. The check n > sizeof(bf) then evaluates
false (negative < positive in signed comparison), and read(fd, bf, n)
reinterprets the negative n as a huge size_t count — the kernel writes
up to MAX_RW_COUNT bytes into the 8192-byte stack buffer.
In practice the overflow is bounded by the sysfs file's actual size,
so a real sysfs notes file won't trigger it organically. But crafted
input (e.g. via a mounted debugfs/sysfs image) could.
Fix by validating namesz and descsz individually against the buffer
size before summing, and change n to size_t to avoid the signed
overflow entirely.
Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 95e99c332d7e3f..0f5f60bc4180bf 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1062,14 +1062,17 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
} else if (read(fd, bf, descsz) != (ssize_t)descsz)
break;
} else {
- int n = namesz + descsz;
+ size_t n;
- if (n > (int)sizeof(bf)) {
+ /* int sum of namesz+descsz can overflow negative, bypassing size check */
+ if (namesz > sizeof(bf) || descsz > sizeof(bf) - namesz) {
n = sizeof(bf);
pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n",
__func__, filename, nhdr.n_namesz, nhdr.n_descsz);
+ } else {
+ n = namesz + descsz;
}
- if (read(fd, bf, n) != n)
+ if (read(fd, bf, n) != (ssize_t)n)
break;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0684/1266] perf symbols: Bounds-check .gnu_debuglink section data
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0683/1266] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0685/1266] perf intel-pt: Fix snprintf size tracking bug in insn decoder Greg Kroah-Hartman
` (314 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ]
filename__read_debuglink() copies .gnu_debuglink section data into a
caller-provided buffer via:
strncpy(debuglink, data->d_buf, size);
where size is PATH_MAX. If the ELF section is smaller than size and
lacks a null terminator, strncpy reads past data->d_buf into adjacent
memory. A malformed ELF file can trigger this, potentially causing a
segfault or leaking heap data.
Additionally, strncpy does not guarantee null termination when the
source fills the buffer.
Replace with an explicit memcpy bounded by both the output buffer
size and the actual section data size (data->d_size), followed by
explicit null termination.
Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 0f5f60bc4180bf..83b76e88ed603e 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1159,7 +1159,14 @@ int filename__read_debuglink(const char *filename, char *debuglink,
goto out_elf_end;
/* the start of this section is a zero-terminated string */
- strncpy(debuglink, data->d_buf, size);
+ if (data->d_size > 0) {
+ size_t len = min(size - 1, data->d_size);
+
+ memcpy(debuglink, data->d_buf, len);
+ debuglink[len] = '\0';
+ } else {
+ debuglink[0] = '\0';
+ }
err = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0685/1266] perf intel-pt: Fix snprintf size tracking bug in insn decoder
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0684/1266] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0686/1266] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
` (313 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter,
Andi Kleen, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit b6bb3b005dcdd960b8e0b7f9d6869132b3de08d5 ]
dump_insn() tracks remaining buffer space with a 'left' variable,
but the loop subtracts the cumulative offset 'n' each iteration
instead of just the per-iteration delta:
n += snprintf(x->out + n, left, "%02x ", inbuf[i]);
left -= n; /* BUG: n is cumulative, not the delta */
After two iterations left goes massively negative, wrapping to a
huge value when passed as size_t to snprintf(), disabling all bounds
checking for the rest of the loop.
Switch to scnprintf() accumulation using sizeof(x->out) - n as the
remaining space, which is always correct and eliminates the separate
'left' variable entirely.
Fixes: 48d02a1d5c137d36 ("perf script: Add 'brstackinsn' for branch stacks")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../util/intel-pt-decoder/intel-pt-insn-decoder.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
index c5d57027ec23d3..03a143a02d40db 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
@@ -213,7 +213,6 @@ const char *dump_insn(struct perf_insn *x, uint64_t ip __maybe_unused,
{
struct insn insn;
int n, i, ret;
- int left;
ret = insn_decode(&insn, inbuf, inlen,
x->is64bit ? INSN_MODE_64 : INSN_MODE_32);
@@ -222,13 +221,9 @@ const char *dump_insn(struct perf_insn *x, uint64_t ip __maybe_unused,
return "<bad>";
if (lenp)
*lenp = insn.length;
- left = sizeof(x->out);
- n = snprintf(x->out, left, "insn: ");
- left -= n;
- for (i = 0; i < insn.length; i++) {
- n += snprintf(x->out + n, left, "%02x ", inbuf[i]);
- left -= n;
- }
+ n = scnprintf(x->out, sizeof(x->out), "insn: ");
+ for (i = 0; i < insn.length; i++)
+ n += scnprintf(x->out + n, sizeof(x->out) - n, "%02x ", inbuf[i]);
return x->out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0686/1266] perf tools: Fix thread__set_comm_from_proc() on empty comm file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0685/1266] perf intel-pt: Fix snprintf size tracking bug in insn decoder Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0687/1266] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
` (312 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 31d596054550f793508abe7dd593853ece47d428 ]
thread__set_comm_from_proc() calls procfs__read_str() then strips
the trailing newline via comm[sz - 1] = '\0'. procfs__read_str()
allocates the buffer before reading, so on an empty /proc/pid/comm
(reachable during late exit teardown) it returns success with sz = 0
and an unterminated heap buffer.
The sz - 1 underflow was the original sashiko finding: it writes a
null byte before the allocation. But even with a sz > 0 guard on
the newline strip, the unterminated buffer would still be passed to
thread__set_comm() which calls strlen() — an unbounded heap read.
Fix by treating sz == 0 as failure: free the buffer and return -1.
This is consistent with pmu.c's perf_pmu__parse_scale/unit which
already treat len == 0 from filename__read_str as an error.
Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/thread.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 61e9f449c72581..ec0ccc310cdad8 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -273,6 +273,11 @@ int thread__set_comm_from_proc(struct thread *thread)
if (!(snprintf(path, sizeof(path), "%d/task/%d/comm",
thread__pid(thread), thread__tid(thread)) >= (int)sizeof(path)) &&
procfs__read_str(path, &comm, &sz) == 0) {
+ /* sz==0: read got nothing, e.g. race during exit teardown */
+ if (sz == 0) {
+ free(comm);
+ return -1;
+ }
comm[sz - 1] = '\0';
err = thread__set_comm(thread, comm, 0);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0687/1266] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0686/1266] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0688/1266] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
` (311 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 1b4e9fbdeabc549965e70ac0cd8095d57ff6df06 ]
When sysfs__read_build_id() matches NT_GNU_BUILD_ID with the right
namesz but the name content is not "GNU", it falls back to reading
descsz bytes into the stack buffer bf[BUFSIZ]:
} else if (read(fd, bf, descsz) != (ssize_t)descsz)
Unlike the else branch which validates namesz + descsz against
sizeof(bf), this path passes descsz directly to read() without any
bounds check. A crafted sysfs file with a large n_descsz overflows
the 8192-byte stack buffer.
Add a descsz > sizeof(bf) check before the read, breaking out of
the loop on oversized values.
Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 83b76e88ed603e..4a2fb6e3d4ef38 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1059,8 +1059,13 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
err = 0;
break;
}
- } else if (read(fd, bf, descsz) != (ssize_t)descsz)
- break;
+ } else {
+ /* descsz from untrusted file — clamp to buffer */
+ if (descsz > sizeof(bf))
+ break;
+ if (read(fd, bf, descsz) != (ssize_t)descsz)
+ break;
+ }
} else {
size_t n;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0688/1266] tools lib api: Fix filename__write_int() writing uninitialized stack data
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0687/1266] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0689/1266] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
` (310 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Kan Liang,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 438ece06185696e14c63c6113d5e2d34ec0a9680 ]
filename__write_int() formats an integer into a 64-byte buffer with
sprintf() then passes sizeof(buf) (64) as the write length. This
writes all 64 bytes including uninitialized stack data past the
formatted string. Most sysfs files reject the oversized write,
making the function always return -1.
Fix by capturing the sprintf() return value and using it as the
write length.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 3b00ea938653d136 ("tools lib api fs: Add sysfs__write_int function")
Cc: Kan Liang <kan.liang@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 1ea76e5ba9d482..60968d0a3bb445 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -404,12 +404,13 @@ int filename__write_int(const char *filename, int value)
{
int fd = open(filename, O_WRONLY), err = -1;
char buf[64];
+ int len;
if (fd < 0)
return err;
- sprintf(buf, "%d", value);
- if (write(fd, buf, sizeof(buf)) == sizeof(buf))
+ len = sprintf(buf, "%d", value);
+ if (write(fd, buf, len) == len)
err = 0;
close(fd);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0689/1266] tools lib api: Fix mount_overload() snprintf truncation and toupper range
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0688/1266] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0690/1266] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
` (309 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fd1f70776add263f8ef38a87ae593c75303f1dcd ]
mount_overload() builds an environment variable name like
"PERF_SYSFS_ENVIRONMENT" from fs->name. Two bugs:
1) snprintf() uses name_len as the buffer size instead of sizeof(upper_name).
For fs->name = "sysfs" (len=5), the output is truncated to "PERF" (4
chars + null), so getenv() never finds the intended variable.
2) mem_toupper() only uppercases name_len bytes, converting just the "PERF"
prefix rather than the full string including the filesystem name portion.
Fix by using sizeof(upper_name) for snprintf and strlen(upper_name) for
mem_toupper, so the full "PERF_SYSFS_ENVIRONMENT" string is correctly
formatted and uppercased.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 73ca85ad364769ff ("tools lib api fs: Add FSTYPE__mount() method")
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 60968d0a3bb445..36b901e8167083 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -260,8 +260,8 @@ static const char *mount_overload(struct fs *fs)
/* "PERF_" + name + "_ENVIRONMENT" + '\0' */
char upper_name[5 + name_len + 12 + 1];
- snprintf(upper_name, name_len, "PERF_%s_ENVIRONMENT", fs->name);
- mem_toupper(upper_name, name_len);
+ snprintf(upper_name, sizeof(upper_name), "PERF_%s_ENVIRONMENT", fs->name);
+ mem_toupper(upper_name, strlen(upper_name));
return getenv(upper_name) ?: *fs->mounts;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0690/1266] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0689/1266] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0691/1266] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
` (308 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 903b0526dcf86d030c5970b4b0a67f9c227368e2 ]
synthesize_bpf_prog_name() calls btf__type_by_id() and immediately
dereferences the result via t->name_off without checking for NULL.
btf__type_by_id() returns NULL when the type_id is invalid or out
of range. When processing perf.data files, finfo->type_id comes from
untrusted input, so an invalid ID causes a NULL pointer dereference.
Fix by checking t for NULL before dereferencing.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: fc462ac75b36daaa ("perf bpf: Extract logic to create program names from perf_event__synthesize_one_bpf_prog()")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 2a9b90aa181fc7..dfebec3a6e71f5 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -137,7 +137,8 @@ static int synthesize_bpf_prog_name(char *buf, int size,
if (btf) {
finfo = func_infos + sub_id * info->func_info_rec_size;
t = btf__type_by_id(btf, finfo->type_id);
- short_name = btf__name_by_offset(btf, t->name_off);
+ if (t)
+ short_name = btf__name_by_offset(btf, t->name_off);
} else if (sub_id == 0 && sub_prog_cnt == 1) {
/* no subprog */
if (info->name[0])
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0691/1266] perf symbols: Add bounds checks to elf_read_build_id() note iteration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0690/1266] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0692/1266] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
` (307 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit acc56d3941fc2997a5a21ea9233a8ac3d87c4f2f ]
elf_read_build_id() iterates ELF notes using pointer arithmetic
driven by n_namesz and n_descsz from the note headers. Neither
the note header read nor the subsequent name/desc advances are
checked against the section boundary. A malformed ELF file with
oversized note sizes causes out-of-bounds reads past the section
data buffer.
Add two bounds checks: verify the note header fits within the
remaining section data, and verify that namesz + descsz (after
alignment) fits before advancing the pointer.
Fixes: fd7a346ea292074e ("perf symbols: Filename__read_build_id should look at .notes section too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 4a2fb6e3d4ef38..96bb84a8c5c2ed 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -908,10 +908,24 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
ptr = data->d_buf;
while (ptr < (data->d_buf + data->d_size)) {
GElf_Nhdr *nhdr = ptr;
- size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
- descsz = NOTE_ALIGN(nhdr->n_descsz);
+ size_t namesz, descsz, remaining;
const char *name;
+ /* ensure the note header fits within the section */
+ if (ptr + sizeof(*nhdr) > data->d_buf + data->d_size)
+ break;
+
+ namesz = NOTE_ALIGN(nhdr->n_namesz);
+ descsz = NOTE_ALIGN(nhdr->n_descsz);
+
+ /* validate individually to avoid size_t overflow on 32-bit */
+ remaining = data->d_buf + data->d_size - ptr - sizeof(*nhdr);
+ if (namesz > remaining || descsz > remaining - namesz) {
+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
+ __func__, nhdr->n_namesz, nhdr->n_descsz);
+ break;
+ }
+
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0692/1266] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0691/1266] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0693/1266] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
` (306 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 52e582e316c48c53bb3082c29f7862ebc554087e ]
symbol-minimal.c's read_build_id() iterates ELF notes with the same
pattern as symbol-elf.c's elf_read_build_id(): pointer arithmetic
driven by n_namesz and n_descsz from 32-bit note header fields,
without validating that the name and desc fit within the note section
data. A malformed ELF file with oversized note sizes causes
out-of-bounds reads past the section data buffer.
Add the same bounds check as the libelf path: validate namesz and
descsz individually against remaining data before advancing the
pointer, avoiding size_t overflow on 32-bit.
Fixes: b691f64360ecec49 ("perf symbols: Implement poor man's ELF parser")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-minimal.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol-minimal.c b/tools/perf/util/symbol-minimal.c
index a81a14769bd101..b95dd77239e835 100644
--- a/tools/perf/util/symbol-minimal.c
+++ b/tools/perf/util/symbol-minimal.c
@@ -1,3 +1,4 @@
+#include "debug.h"
#include "dso.h"
#include "symbol.h"
#include "symsrc.h"
@@ -45,7 +46,7 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
ptr = note_data;
while (ptr < (note_data + note_len)) {
const char *name;
- size_t namesz, descsz;
+ size_t namesz, descsz, remaining;
nhdr = ptr;
if (need_swap) {
@@ -57,6 +58,14 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
namesz = NOTE_ALIGN(nhdr->n_namesz);
descsz = NOTE_ALIGN(nhdr->n_descsz);
+ /* validate individually to avoid size_t overflow on 32-bit */
+ remaining = note_data + note_len - ptr - sizeof(*nhdr);
+ if (namesz > remaining || descsz > remaining - namesz) {
+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
+ __func__, nhdr->n_namesz, nhdr->n_descsz);
+ break;
+ }
+
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0693/1266] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0692/1266] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0694/1266] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
` (305 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryder Lee, Manivannan Sadhasivam,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit ab4a4043db1fcc4fd4c5745c5be8caf053502e29 ]
As reported by the W=1 warning below, content of the 'name' variable might
get truncated with the existing size of 10 bytes. Though it is not
practically possible to exceed the 10 bytes size, increase it to 20 to
silence the warning for a clean W=1 build:
$ make W=1 drivers/pci/controller/pcie-mediatek.o
CALL scripts/checksyscalls.sh
DESCEND objtool
INSTALL libsubcmd_headers
CC drivers/pci/controller/pcie-mediatek.o
drivers/pci/controller/pcie-mediatek.c: In function ‘mtk_pcie_parse_port’:
drivers/pci/controller/pcie-mediatek.c:963:43: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 6 [-Werror=format-truncation=]
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~
drivers/pci/controller/pcie-mediatek.c:963:38: note: directive argument in the range [0, 2147483647]
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~~~~~~~
drivers/pci/controller/pcie-mediatek.c:963:9: note: ‘snprintf’ output between 6 and 15 bytes into a destination of size 10
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/b835e360b42c5e0994f9301a34dbdf140a8d3ef5.1772493898.git.ryder.lee@mediatek.com
Stable-dep-of: ebc1d9906894 ("PCI: mediatek: Use actual physical address instead of virt_to_phys()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index bc2847fe12d1cb..43e21187d91a22 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -924,7 +924,7 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
struct mtk_pcie_port *port;
struct device *dev = pcie->dev;
struct platform_device *pdev = to_platform_device(dev);
- char name[10];
+ char name[20];
int err;
port = devm_kzalloc(dev, sizeof(*port), GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0694/1266] PCI: mediatek: Use actual physical address instead of virt_to_phys()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0693/1266] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0695/1266] Revert "PCI/MSI: Unmap MSI-X region on error" Greg Kroah-Hartman
` (304 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Caleb James DeLisle, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit ebc1d9906894703286d12306a6f242d90cfb49e8 ]
The driver previously used virt_to_phys() on the ioremapped register base
(port->base) to compute the MSI message address. Using virt_to_phys() on an
IO mapped address is incorrect because it expects a kernel virtual address.
To fix it, store the physical start of the I/O register region in
mtk_pcie_port->phys_base and use it to build the MSI address. This replaces
the incorrect virt_to_phys() usage and ensures MSI addresses are generated
correctly.
Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://patch.msgid.link/20260521171951.1495781-2-cjd@cjdns.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 43e21187d91a22..6336309c8293a2 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -165,6 +165,7 @@ struct mtk_pcie_soc {
/**
* struct mtk_pcie_port - PCIe port information
* @base: IO mapped register base
+ * @phys_base: Physical address of the I/O register base region
* @list: port list
* @pcie: pointer to PCIe host info
* @reset: pointer to port reset control
@@ -187,6 +188,7 @@ struct mtk_pcie_soc {
*/
struct mtk_pcie_port {
void __iomem *base;
+ phys_addr_t phys_base;
struct list_head list;
struct mtk_pcie *pcie;
struct reset_control *reset;
@@ -398,7 +400,7 @@ static void mtk_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
phys_addr_t addr;
/* MT2712/MT7622 only support 32-bit MSI addresses */
- addr = virt_to_phys(port->base + PCIE_MSI_VECTOR);
+ addr = port->phys_base + PCIE_MSI_VECTOR;
msg->address_hi = 0;
msg->address_lo = lower_32_bits(addr);
@@ -521,7 +523,7 @@ static void mtk_pcie_enable_msi(struct mtk_pcie_port *port)
u32 val;
phys_addr_t msg_addr;
- msg_addr = virt_to_phys(port->base + PCIE_MSI_VECTOR);
+ msg_addr = port->phys_base + PCIE_MSI_VECTOR;
val = lower_32_bits(msg_addr);
writel(val, port->base + PCIE_IMSI_ADDR);
@@ -924,6 +926,7 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
struct mtk_pcie_port *port;
struct device *dev = pcie->dev;
struct platform_device *pdev = to_platform_device(dev);
+ struct resource *res;
char name[20];
int err;
@@ -932,7 +935,14 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
return -ENOMEM;
snprintf(name, sizeof(name), "port%d", slot);
- port->base = devm_platform_ioremap_resource_byname(pdev, name);
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
+ if (!res) {
+ dev_err(dev, "failed to get port%d base\n", slot);
+ return -EINVAL;
+ }
+
+ port->phys_base = res->start;
+ port->base = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(port->base)) {
dev_err(dev, "failed to map port%d base\n", slot);
return PTR_ERR(port->base);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0695/1266] Revert "PCI/MSI: Unmap MSI-X region on error"
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0694/1266] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0696/1266] security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() Greg Kroah-Hartman
` (303 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Yuanhe Shu,
Thomas Gleixner, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <xiangzao@linux.alibaba.com>
[ Upstream commit f64e03da0d83cb173743888bff4a7e61476a8fc2 ]
This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202.
Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an
iounmap(dev->msix_base) on the error path of msix_capability_init() to
release the MSI-X region when msix_setup_interrupts() fails.
When msix_setup_interrupts() fails, the call chain is:
msix_setup_interrupts()
-> __msix_setup_interrupts()
struct pci_dev *dev __free(free_msi_irqs) = __dev;
...
return ret; // __free cleanup fires on error
The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which
already handles the unmap:
void pci_free_msi_irqs(struct pci_dev *dev)
{
pci_msi_teardown_msi_irqs(dev);
if (dev->msix_base) {
iounmap(dev->msix_base); // already unmapped here
dev->msix_base = NULL; // and set to NULL
}
}
So dev->msix_base is unmapped and set to NULL before
msix_setup_interrupts() returns to msix_capability_init(). The
"goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap
MSI-X region on error") then calls iounmap() a second time on a NULL
pointer.
This was reproduced on Intel Emerald Rapids (192 CPUs) while
running tools/testing/selftests/kexec/test_kexec_jump.sh:
WARNING: CPU#44 at iounmap+0x2a/0xe0
RIP: 0010:iounmap+0x2a/0xe0
RDI: 0000000000000000
Call Trace:
msix_capability_init+0x317/0x3f0
__pci_enable_msix_range+0x21d/0x2c0
pci_alloc_irq_vectors_affinity+0xa9/0x130
nvme_setup_io_queues+0x2a8/0x420 [nvme]
nvme_reset_work+0x151/0x340 [nvme]
...
RDI=0 confirms iounmap() is called with NULL.
Restore the original "goto out_disable" and leave the unmap to the
existing __free(free_msi_irqs) cleanup.
Fixes: 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://lore.kernel.org/all/20260610194406.GA380991@bhelgaas/
Link: https://patch.msgid.link/20260611025901.1105209-1-xiangzao@linux.alibaba.com
Closes: https://lore.kernel.org/all/4fc6208d-513b-4f41-a13a-4a0829ab50ad@roeck-us.net/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/msi/msi.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index f6f4a778a98678..b638731aa5ff2f 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
ret = msix_setup_interrupts(dev, entries, nvec, affd);
if (ret)
- goto out_unmap;
+ goto out_disable;
/* Disable INTX */
pci_intx_for_msi(dev, 0);
@@ -756,8 +756,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
pcibios_free_irq(dev);
return 0;
-out_unmap:
- iounmap(dev->msix_base);
out_disable:
dev->msix_enabled = 0;
pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0696/1266] security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0695/1266] Revert "PCI/MSI: Unmap MSI-X region on error" Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0697/1266] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
` (302 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Johansen, Paul Moore,
James Morris, Serge E. Hallyn, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <akpm@linux-foundation.org>
[ Upstream commit d62d9bfe050f44f772d05a32079dba3e3523ab2a ]
Some config did this:
security/apparmor/apparmorfs.c:177:28: warning: 'get_loaddata_common_ref' defined but not used [-Wunused-function]
177 | static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
get_loaddata_common_ref() is only used if
CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y.
(Or of course move the function into that block if maintainers perfer)
Fixes: 8e135b8aee5a0 ("apparmor: fix race between freeing data and fs accessing it")
Cc: John Johansen <john.johansen@canonical.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/apparmorfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 157ebdb100c00b..3fdb084db3a917 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -174,6 +174,7 @@ static struct aa_proxy *get_proxy_common_ref(struct aa_common_ref *ref)
return NULL;
}
+#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
{
if (ref)
@@ -181,6 +182,7 @@ static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
count));
return NULL;
}
+#endif
static void aa_put_common_ref(struct aa_common_ref *ref)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0697/1266] apparmor: check label build before no_new_privs test
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0696/1266] security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0698/1266] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
` (301 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, John Johansen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit a58cafd38b46fb1a2220e2fbbcfe291ea75fa147 ]
aa_change_profile() builds a replacement label with
fn_label_build_in_scope() before the no_new_privs subset check. The build
helper can fail and return NULL or an ERR_PTR, but the result was passed
to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL()
check.
Reuse the existing target-label build failure handling immediately after
the build. This preserves the current audit handling while preventing the
subset helper from dereferencing an invalid label.
Fixes: e00b02bb6ac2a ("apparmor: move change_profile mediation to using labels")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index d6500ec4f6b636..7162088629c531 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1440,6 +1440,8 @@ int aa_change_profile(const char *fqname, int flags)
new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
aa_get_label(target),
aa_get_label(&profile->label));
+ if (IS_ERR_OR_NULL(new))
+ goto build_fail;
/*
* no new privs prevents domain transitions that would
* reduce restrictions.
@@ -1457,16 +1459,8 @@ int aa_change_profile(const char *fqname, int flags)
/* only transition profiles in the current ns */
if (stack)
new = aa_label_merge(label, target, GFP_KERNEL);
- if (IS_ERR_OR_NULL(new)) {
- info = "failed to build target label";
- if (!new)
- error = -ENOMEM;
- else
- error = PTR_ERR(new);
- new = NULL;
- perms.allow = 0;
- goto audit;
- }
+ if (IS_ERR_OR_NULL(new))
+ goto build_fail;
error = aa_replace_current_label(new);
} else {
if (new) {
@@ -1478,6 +1472,17 @@ int aa_change_profile(const char *fqname, int flags)
error = aa_set_current_onexec(target, stack);
}
+ goto audit;
+
+build_fail:
+ info = "failed to build target label";
+ if (!new)
+ error = -ENOMEM;
+ else
+ error = PTR_ERR(new);
+ new = NULL;
+ perms.allow = 0;
+
audit:
error = fn_for_each_in_ns(label, profile,
aa_audit_file(subj_cred,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0698/1266] apparmor: aa_label_alloc use aa_label_free on alloc failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0697/1266] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0699/1266] apparmor: fix rawdata_f_data implicit flex array Greg Kroah-Hartman
` (300 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zygmunt Krynicki, John Johansen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit 654fe7505dc6889724d4094fa64f89991afabfc3 ]
aa_label_alloc() allocates a secid before allocating or taking the label
proxy. If the later proxy step fails, the error path only freed the label
memory, leaking any resources initialized by aa_label_init().
Use aa_label_free() on the failure path so partially initialized labels
release their secid and other label resources before the backing memory is
freed.
Fixes: f1bd904175e81 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 73428072a754f1..37282a3c68a720 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -452,7 +452,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
return new;
fail:
- kfree(new);
+ aa_label_free(new);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0699/1266] apparmor: fix rawdata_f_data implicit flex array
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0698/1266] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0700/1266] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
` (299 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, John Johansen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit ad213bbbc0e3e270ce7df2d9d80d4ce3826993d7 ]
rawdata_f_data has a blob of data that is allocated at its end but
not explicitly declared. Makes sure it is correctly declared as a
flex_rray.
Fixes: 63c16c3a76085 ("apparmor: Initial implementation of raw policy blob compression")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/apparmorfs.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 3fdb084db3a917..bb183924b7a2cd 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -71,10 +71,10 @@
struct rawdata_f_data {
struct aa_loaddata *loaddata;
+ DECLARE_FLEX_ARRAY(char, data);
};
#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
-#define RAWDATA_F_DATA_BUF(p) (char *)(p + 1)
static void rawdata_f_data_free(struct rawdata_f_data *private)
{
@@ -1436,7 +1436,7 @@ static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
struct rawdata_f_data *private = file->private_data;
return simple_read_from_buffer(buf, size, ppos,
- RAWDATA_F_DATA_BUF(private),
+ private->data,
private->loaddata->size);
}
@@ -1469,8 +1469,7 @@ static int rawdata_open(struct inode *inode, struct file *file)
private->loaddata = loaddata;
error = decompress_zstd(loaddata->data, loaddata->compressed_size,
- RAWDATA_F_DATA_BUF(private),
- loaddata->size);
+ private->data, loaddata->size);
if (error)
goto fail_decompress;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0700/1266] apparmor: grab ns lock and refresh when looking up changehat child profiles
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0699/1266] apparmor: fix rawdata_f_data implicit flex array Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0701/1266] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
` (298 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, Ryan Lee,
John Johansen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lee <ryan.lee@canonical.com>
[ Upstream commit 32e92764d6f8d251c1bca62be33793287b453a81 ]
There was a race condition involving change_hat and profile replacement in
which replacement of the parent profile during a changehat operation could
result in the list of children becoming empty and the changehat operation
failing. To prevent this:
- grab the namespace lock until we've built the hat transition, and
- use aa_get_newest_profile to avoid using stale profile objects.
Link: https://bugs.launchpad.net/bugs/2139664
Fixes: 89dbf1962aa63 ("apparmor: move change_hat mediation to using labels")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 33 +++++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 7162088629c531..f14f8a4e859461 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -13,6 +13,7 @@
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/mount.h>
+#include <linux/mutex.h>
#include <linux/syscalls.h>
#include <linux/personality.h>
#include <linux/xattr.h>
@@ -1061,6 +1062,7 @@ static struct aa_label *change_hat(const struct cred *subj_cred,
int count, int flags)
{
struct aa_profile *profile, *root, *hat = NULL;
+ struct aa_ns *ns, *new_ns;
struct aa_label *new;
struct label_it it;
bool sibling = false;
@@ -1071,6 +1073,32 @@ static struct aa_label *change_hat(const struct cred *subj_cred,
AA_BUG(!hats);
AA_BUG(count < 1);
+ /*
+ * Acquire the newest label and then hold the lock until we choose a
+ * hat, so that profile replacement doesn't atomically truncate the
+ * list of potential hats. Because we are getting the namespaces from
+ * the profiles and label, we can rely on the namespaces being live
+ * and avoid incrementing their refcounts while grabbing the lock.
+ */
+ label = aa_get_label(label);
+ ns = labels_ns(label);
+
+retry:
+ mutex_lock_nested(&ns->lock, ns->level);
+ if (label_is_stale(label)) {
+ new = aa_get_newest_label(label);
+ new_ns = labels_ns(new);
+ if (new_ns != ns) {
+ aa_put_label(new);
+ mutex_unlock(&ns->lock);
+ ns = new_ns;
+ label = new;
+ goto retry;
+ }
+ aa_put_label(label);
+ label = new;
+ }
+
if (PROFILE_IS_HAT(labels_profile(label)))
sibling = true;
@@ -1079,7 +1107,7 @@ static struct aa_label *change_hat(const struct cred *subj_cred,
name = hats[i];
label_for_each_in_ns(it, labels_ns(label), label, profile) {
if (sibling && PROFILE_IS_HAT(profile)) {
- root = aa_get_profile_rcu(&profile->parent);
+ root = aa_get_profile(profile->parent);
} else if (!sibling && !PROFILE_IS_HAT(profile)) {
root = aa_get_profile(profile);
} else { /* conflicting change type */
@@ -1139,6 +1167,7 @@ static struct aa_label *change_hat(const struct cred *subj_cred,
GLOBAL_ROOT_UID, info, error);
}
}
+ mutex_unlock(&ns->lock);
return ERR_PTR(error);
build:
@@ -1151,7 +1180,7 @@ static struct aa_label *change_hat(const struct cred *subj_cred,
error = -ENOMEM;
goto fail;
} /* else if (IS_ERR) build_change_hat has logged error so return new */
-
+ mutex_unlock(&ns->lock);
return new;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0701/1266] apparmor: fix potential UAF in aa_replace_profiles
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0700/1266] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0702/1266] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
` (297 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, Maxime Bélair,
John Johansen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Bélair <maxime.belair@canonical.com>
[ Upstream commit 7b42f95813dc9ceb6bda35afcf914630909a19f9 ]
The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.
Fixed this by saving the size to a local variable before dropping the
reference.
Fixes: 5ac8c355ae001 ("apparmor: allow introspecting the loaded policy pre internal transform")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index c70e68977d6118..14306cfb1ae48e 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1324,13 +1324,15 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
mutex_unlock(&ns->lock);
out:
+ ssize_t udata_sz = udata->size;
+
aa_put_ns(ns);
aa_put_profile_loaddata(udata);
kfree(ns_name);
if (error)
return error;
- return udata->size;
+ return udata_sz;
fail_lock:
mutex_unlock(&ns->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0702/1266] apparmor: aa_getprocattr free procattr leak on format failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0701/1266] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0703/1266] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
` (296 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tyler Hicks, Ryan Lee,
Zygmunt Krynicki, John Johansen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit fea23bf73f0cae8ccb1d0684e4a3003874771f41 ]
aa_getprocattr() allocates the output string before rendering the label
into it. If the second aa_label_snxprint() call fails, the function
returned without freeing that allocation.
Free and clear the output pointer on the uncommon formatting failure path
before dropping the namespace reference.
Fixes: 76a1d263aba3 ("apparmor: switch getprocattr to using label_print fns()")
Reviewed-by: Tyler Hicks <code@thicks.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/procattr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/apparmor/procattr.c b/security/apparmor/procattr.c
index 197d41f9c32b7b..542c3f0255ea9a 100644
--- a/security/apparmor/procattr.c
+++ b/security/apparmor/procattr.c
@@ -53,6 +53,8 @@ int aa_getprocattr(struct aa_label *label, char **string)
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED);
if (len < 0) {
+ kfree(*string);
+ *string = NULL;
aa_put_ns(current_ns);
return len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0703/1266] apparmor: put secmark label after secid lookup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 6.6 0702/1266] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0704/1266] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
` (295 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zygmunt Krynicki, John Johansen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit 340372688bb87da45ff8d4e2f82ccfd1b64c65ff ]
apparmor_secmark_init() parses a configured secmark label to obtain its
secid. aa_label_strn_parse() returns a refcounted label, but the success
path kept that reference after copying the secid.
Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy")
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index bcba4d2a7aa4d1..390947c9302082 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -217,6 +217,7 @@ static int apparmor_secmark_init(struct aa_secmark *secmark)
return PTR_ERR(label);
secmark->secid = label->secid;
+ aa_put_label(label);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0704/1266] i3c: master: Prevent reuse of dynamic address on device add failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (702 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0703/1266] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0705/1266] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
` (294 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit b3ba8383da4d0cff15810e32ea785eceb0a80813 ]
i3c_master_add_i3c_dev_locked() is called after a device has already
been assigned a dynamic address. If the function fails, the address
remains marked as free and may be reallocated to another device,
leading to address conflicts on the bus.
Ensure the address is not marked as free on failure, by updating the
address slot state to prevent the address from being re-used.
Emit an error message to inform of the failure.
Opportunistically remove the !master check because it is impossible.
Note, directly resetting the device's dynamic address is no longer
an option, since Direct RSTDAA was deprecated from I3C starting from
version 1.1 and v1.1 (or later) target devices are meant to NACK it.
Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260612080107.11606-4-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index f74ef65d257d7b..c062e94ce22113 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2014,12 +2014,11 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
bool enable_ibi = false;
int ret;
- if (!master)
- return -EINVAL;
-
newdev = i3c_master_alloc_i3c_dev(master, &info);
- if (IS_ERR(newdev))
- return PTR_ERR(newdev);
+ if (IS_ERR(newdev)) {
+ ret = PTR_ERR(newdev);
+ goto err_prevent_addr_reuse;
+ }
ret = i3c_master_attach_i3c_dev(master, newdev);
if (ret)
@@ -2141,6 +2140,16 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
err_free_dev:
i3c_master_free_i3c_dev(newdev);
+err_prevent_addr_reuse:
+ /*
+ * Although the device has not been added, the address has been
+ * assigned. Prevent the address from being used again.
+ */
+ if (i3c_bus_get_addr_slot_status(&master->bus, addr) == I3C_ADDR_SLOT_FREE)
+ i3c_bus_set_addr_slot_status(&master->bus, addr, I3C_ADDR_SLOT_I3C_DEV);
+
+ dev_err(&master->dev, "Failed to add I3C device at address %u, error %d\n", addr, ret);
+
return ret;
}
EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0705/1266] apparmor: fix label can not be immediately before a declaration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (703 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0704/1266] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0706/1266] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
` (293 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, John Johansen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit 1ed40bd525c00d22af666016af9aef7167f8085f ]
Fix error reported by kernel test robot
security/apparmor/policy.c:1381:2: error: a label can only be part of
a statement and a declaration is not a statement
All errors (new ones prefixed by >>):
security/apparmor/policy.c: In function 'aa_replace_profiles':
>> security/apparmor/policy.c:1381:2: error: a label can only be part
of a statement and a declaration is not a statement
ssize_t udata_sz = udata->size;
^~~~~
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606150525.npax8WiH-lkp@intel.com/
Fixes: 7b42f95813dc9 ("apparmor: fix potential UAF in aa_replace_profiles")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 14306cfb1ae48e..df76104e3b3382 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1324,9 +1324,10 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
mutex_unlock(&ns->lock);
out:
+ aa_put_ns(ns);
+
ssize_t udata_sz = udata->size;
- aa_put_ns(ns);
aa_put_profile_loaddata(udata);
kfree(ns_name);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0706/1266] sparc: led: avoid trimming a newline from empty writes
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (704 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0705/1266] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0707/1266] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
` (292 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Larsson, Pengpeng Hou,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 7eb475e8a738ee6fd1260aa59ddccb610fdd4300 ]
led_proc_write() duplicates up to LED_MAX_LENGTH bytes with
memdup_user_nul() and then unconditionally inspects buf[count - 1] to
strip a trailing newline. A zero-length write therefore reads one byte
before the duplicated buffer.
The previous version rejected empty writes, but empty input already falls
through to the existing default case and turns the LED off like any other
unrecognized string. Preserve that behavior and only skip the newline
trim when there is no input byte to inspect.
Fixes: ee1858d3122d ("[SPARC]: Add sun4m LED driver.")
Suggested-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/kernel/led.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/kernel/led.c b/arch/sparc/kernel/led.c
index ab657b359789ea..36d851c7454ac6 100644
--- a/arch/sparc/kernel/led.c
+++ b/arch/sparc/kernel/led.c
@@ -78,7 +78,7 @@ static ssize_t led_proc_write(struct file *file, const char __user *buffer,
return PTR_ERR(buf);
/* work around \n when echo'ing into proc */
- if (buf[count - 1] == '\n')
+ if (count > 0 && buf[count - 1] == '\n')
buf[count - 1] = '\0';
/* before we change anything we want to stop any running timers,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0707/1266] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (705 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0706/1266] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0708/1266] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
` (291 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 063c647b24f640657d6d9e2e90d620ea3ee19ae6 ]
sysfs__read_build_id() iterates ELF note headers from sysfs files in a
while(1) loop. If the file contains a zero-filled note header (both
n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0
and calls read(fd, bf, 0). read() with count 0 returns 0, which
matches the expected (ssize_t)n value, so the error check passes and
the loop repeats — reading the same zero bytes and spinning forever.
This can happen with corrupted or zero-padded sysfs pseudo-files.
Add a check for n == 0 before the read, since no valid ELF note has
both name and description of zero length.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too")
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 96bb84a8c5c2ed..1729efd11ac5cf 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1091,6 +1091,9 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
} else {
n = namesz + descsz;
}
+ /* no valid note has both namesz and descsz zero */
+ if (n == 0)
+ break;
if (read(fd, bf, n) != (ssize_t)n)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0708/1266] perf tools: Use snprintf() for root_dir path construction
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (706 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0707/1266] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0709/1266] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
` (290 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang Yanmin,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 7b0df6f4d498b1608afccfd6dffb264e6da91693 ]
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively. Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked. A root_dir at or near
PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof(path) to prevent overflow.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 2 +-
tools/perf/util/symbol.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index e2a6facd1c4e2a..2f5a5245483ede 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1495,7 +1495,7 @@ static char *get_kernel_version(const char *root_dir)
char *name, *tmp;
const char *prefix = "Linux version ";
- sprintf(version, "%s/proc/version", root_dir);
+ snprintf(version, sizeof(version), "%s/proc/version", root_dir);
file = fopen(version, "r");
if (!file)
return NULL;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 18556b7a765630..8618e4175e20fd 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -2215,7 +2215,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map)
if (!kallsyms_filename)
return -1;
} else {
- sprintf(path, "%s/proc/kallsyms", machine->root_dir);
+ snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir);
kallsyms_filename = path;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0709/1266] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (707 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0708/1266] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0710/1266] perf bpf: Bounds-check array offsets in bpil_offs_to_addr() Greg Kroah-Hartman
` (289 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 10b3c3d63ecc17c6acb855bac5f40367f1115765 ]
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:
- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
the finfo pointer would reference a truncated entry, reading past it
into adjacent data.
- A sub_id >= nr_func_info computes an offset past the func_info buffer,
causing an out-of-bounds read.
Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index dfebec3a6e71f5..fb4eb16c7b5bae 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -134,7 +134,9 @@ static int synthesize_bpf_prog_name(char *buf, int size,
name_len = scnprintf(buf, size, "bpf_prog_");
name_len += snprintf_hex(buf + name_len, size - name_len,
prog_tags[sub_id], BPF_TAG_SIZE);
- if (btf) {
+ if (btf &&
+ info->func_info_rec_size >= sizeof(*finfo) &&
+ sub_id < info->nr_func_info) {
finfo = func_infos + sub_id * info->func_info_rec_size;
t = btf__type_by_id(btf, finfo->type_id);
if (t)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0710/1266] perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (708 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0709/1266] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0711/1266] gpio: mlxbf3: fail probe if gpiochip registration fails Greg Kroah-Hartman
` (288 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Dave Marchevsky,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 033e85edfbf271f92979d2a39aeaf40f8472a795 ]
bpil_offs_to_addr() converts offsets stored in perf.data's
bpf_prog_info_linear structure into heap pointers by adding the offset
to the data allocation base. The offsets come from untrusted file input
and are not validated against data_len.
If an offset exceeds data_len, the computed address points outside the
allocated data buffer. Callers like synthesize_bpf_prog_name() then
dereference prog_tags[sub_id] or func_info pointers, reading arbitrary
heap memory.
Add a bounds check: when an offset exceeds data_len, zero the field
and skip the conversion. This prevents out-of-bounds pointer
construction from crafted perf.data files.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 6ac22d036f86c4e2 ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
Cc: Dave Marchevsky <davemarchevsky@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-utils.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
index 80b1d2b3729ba4..a20ed281bcaf80 100644
--- a/tools/perf/util/bpf-utils.c
+++ b/tools/perf/util/bpf-utils.c
@@ -246,6 +246,7 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
struct bpil_array_desc *desc;
__u64 addr, offs;
+ __u32 count, size;
if ((info_linear->arrays & (1UL << i)) == 0)
continue;
@@ -253,6 +254,21 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
desc = bpil_array_desc + i;
offs = bpf_prog_info_read_offset_u64(&info_linear->info,
desc->array_offset);
+ count = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+ size = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->size_offset);
+ /* offset and extent from perf.data are untrusted — keep within data[] */
+ if (offs >= info_linear->data_len ||
+ (u64)count * size > info_linear->data_len - offs) {
+ bpf_prog_info_set_offset_u64(&info_linear->info,
+ desc->array_offset, 0);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+ desc->count_offset, 0);
+ /* clear the bit so bpil_addr_to_offs() won't reverse a zeroed address */
+ info_linear->arrays &= ~(1UL << i);
+ continue;
+ }
addr = offs + ptr_to_u64(info_linear->data);
bpf_prog_info_set_offset_u64(&info_linear->info,
desc->array_offset, addr);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0711/1266] gpio: mlxbf3: fail probe if gpiochip registration fails
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (709 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0710/1266] perf bpf: Bounds-check array offsets in bpil_offs_to_addr() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0712/1266] spi: dw: fix wrong BAUDR setting after resume Greg Kroah-Hartman
` (287 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Linus Walleij,
Bartosz Golaszewski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 0482862a90169f4daaba0ed31a85d8304bf51e04 ]
mlxbf3_gpio_probe() logs a devm_gpiochip_add_data() failure but still
returns success. That leaves the platform device bound even though the
GPIO chip was not registered.
Return the registration error so probe failure matches the missing
gpiochip state.
Fixes: cd33f216d241 ("gpio: mlxbf3: Add gpio driver support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260615091918.43333-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-mlxbf3.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-mlxbf3.c b/drivers/gpio/gpio-mlxbf3.c
index ed29b07d16c190..a662989ff21e7c 100644
--- a/drivers/gpio/gpio-mlxbf3.c
+++ b/drivers/gpio/gpio-mlxbf3.c
@@ -252,7 +252,8 @@ static int mlxbf3_gpio_probe(struct platform_device *pdev)
ret = devm_gpiochip_add_data(dev, &gs->gc, gs);
if (ret)
- dev_err_probe(dev, ret, "Failed adding memory mapped gpiochip\n");
+ return dev_err_probe(dev, ret,
+ "Failed adding memory mapped gpiochip\n");
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0712/1266] spi: dw: fix wrong BAUDR setting after resume
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (710 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0711/1266] gpio: mlxbf3: fail probe if gpiochip registration fails Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0713/1266] xfrm: Use the XFRM_GRO to indicate a GRO call on input Greg Kroah-Hartman
` (286 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jisheng Zhang, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <jszhang@kernel.org>
[ Upstream commit 66b6605bcea7af7aca3d1d858b9c5f14903f9f9a ]
After resuming from suspend to ram, spi transfer stops working. Further
debugging shows that the BAUDR register isn't correctly set, this is
due to dws->current_freq doesn't match the HW BAUDR setting,
specifically, the dws->current_freq equals to speed_hz, but BAUDR is 0.
so the dw_spi_set_clk() in below code won't be called:
if (dws->current_freq != speed_hz) {
dw_spi_set_clk(dws, clk_div);
dws->current_freq = speed_hz;
}
The mismatch comes from dw_spi_shutdown_chip() when suspending.
Fix this mismatch by setting dws->current_freq to 0 as well when
clearing BAUDR reg in dw_spi_shutdown_chip().
Fixes: e24c74527207 ("spi: controller driver for Designware SPI core")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260612002835.5240-1-jszhang@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-dw.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-dw.h b/drivers/spi/spi-dw.h
index 6cafeee8ee2a9a..e25e5554ce89d5 100644
--- a/drivers/spi/spi-dw.h
+++ b/drivers/spi/spi-dw.h
@@ -282,6 +282,7 @@ static inline void dw_spi_shutdown_chip(struct dw_spi *dws)
{
dw_spi_enable_chip(dws, 0);
dw_spi_set_clk(dws, 0);
+ dws->current_freq = 0;
}
extern void dw_spi_set_cs(struct spi_device *spi, bool enable);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0713/1266] xfrm: Use the XFRM_GRO to indicate a GRO call on input
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (711 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0712/1266] spi: dw: fix wrong BAUDR setting after resume Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0714/1266] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path Greg Kroah-Hartman
` (285 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steffen Klassert, Antony Antony,
Eyal Birger, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
[ Upstream commit b439475a0dba2b50fb39a6356069969780e45fd4 ]
This is needed to support GRO for ESP in UDP encapsulation.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Co-developed-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Reviewed-by: Eyal Birger <eyal.birger@gmail.com>
Stable-dep-of: 68de007d5ac9 ("xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/esp4_offload.c | 2 +-
net/ipv6/esp6_offload.c | 2 +-
net/xfrm/xfrm_input.c | 6 ++----
3 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index 028d2d3477d132..0984f330362749 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -77,7 +77,7 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head,
/* We don't need to handle errors from xfrm_input, it does all
* the error handling and frees the resources on error. */
- xfrm_input(skb, IPPROTO_ESP, spi, -2);
+ xfrm_input(skb, IPPROTO_ESP, spi, 0);
return ERR_PTR(-EINPROGRESS);
out_reset:
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 333d87557bf32b..84affcc7f4d760 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -104,7 +104,7 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
/* We don't need to handle errors from xfrm_input, it does all
* the error handling and frees the resources on error. */
- xfrm_input(skb, IPPROTO_ESP, spi, -2);
+ xfrm_input(skb, IPPROTO_ESP, spi, 0);
return ERR_PTR(-EINPROGRESS);
out_reset:
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 77bc0ad368d7eb..1d20f2a0a7386b 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -470,7 +470,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
struct xfrm_offload *xo = xfrm_offload(skb);
struct sec_path *sp;
- if (encap_type < 0) {
+ if (encap_type < 0 || (xo && xo->flags & XFRM_GRO)) {
x = xfrm_input_state(skb);
if (unlikely(x->km.state != XFRM_STATE_VALID)) {
@@ -493,9 +493,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
seq = XFRM_SKB_CB(skb)->seq.input.low;
goto resume;
}
-
- /* encap_type < -1 indicates a GRO call. */
- encap_type = 0;
+ /* GRO call */
seq = XFRM_SPI_SKB_CB(skb)->seq;
if (xo && (xo->flags & CRYPTO_DONE)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0714/1266] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (712 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0713/1266] xfrm: Use the XFRM_GRO to indicate a GRO call on input Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0715/1266] xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] Greg Kroah-Hartman
` (284 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Yu, Steffen Klassert,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Yu <yumike@google.com>
[ Upstream commit f7e8542d71e908706855a9f3e9e7844fea1feea0 ]
IPsec crypt offload supports outbound IPv6 ESP packets, but it doesn't
support inbound IPv6 ESP packets.
This change enables the crypto offload for inbound IPv6 ESP packets
that are not handled through GRO code path. If HW drivers add the
offload information to the skb, the packet will be handled in the
crypto offload rx code path.
Apart from the change in crypto offload rx code path, the change
in xfrm_policy_check is also needed.
Exampe of RX data path:
+-----------+ +-------+
| HW Driver |-->| wlan0 |--------+
+-----------+ +-------+ |
v
+---------------+ +------+
+------>| Network Stack |-->| Apps |
| +---------------+ +------+
| |
| v
+--------+ +------------+
| ipsec1 |<--| XFRM Stack |
+--------+ +------------+
Test: Enabled both in/out IPsec crypto offload, and verified IPv6
ESP packets on Android device on both wifi/cellular network
Signed-off-by: Mike Yu <yumike@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Stable-dep-of: 68de007d5ac9 ("xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_input.c | 2 +-
net/xfrm/xfrm_policy.c | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1d20f2a0a7386b..1483770f845642 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -470,7 +470,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
struct xfrm_offload *xo = xfrm_offload(skb);
struct sec_path *sp;
- if (encap_type < 0 || (xo && xo->flags & XFRM_GRO)) {
+ if (encap_type < 0 || (xo && (xo->flags & XFRM_GRO || encap_type == 0))) {
x = xfrm_input_state(skb);
if (unlikely(x->km.state != XFRM_STATE_VALID)) {
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2110941c8e9a75..ef07c9872b8d14 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3683,12 +3683,15 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
}
if (!pol) {
+ const bool is_crypto_offload = sp &&
+ (xfrm_input_state(skb)->xso.type == XFRM_DEV_OFFLOAD_CRYPTO);
+
if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
return 0;
}
- if (sp && secpath_has_nontransport(sp, 0, &xerr_idx)) {
+ if (sp && secpath_has_nontransport(sp, 0, &xerr_idx) && !is_crypto_offload) {
xfrm_secpath_reject(xerr_idx, skb, &fl);
XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0715/1266] xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (713 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0714/1266] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0716/1266] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
` (283 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d85ba1c732720b9a4097,
Eric Dumazet, Steffen Klassert, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 68de007d5ac9df0e3f4f187a179c5c842bb5a2be ]
KCSAN reported a data race involving net->xfrm.policy_count access.
Add missing READ_ONCE()/WRITE_ONCE() annotations on
xfrm_policy_count and xfrm_policy_default.
Fixes: 2518c7c2b3d7 ("[XFRM]: Hash policies when non-prefixed.")
Reported-by: syzbot+d85ba1c732720b9a4097@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2b9e96.99669fcc.12a77b.0006.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/xfrm.h | 8 ++++----
net/xfrm/xfrm_policy.c | 24 ++++++++++++------------
net/xfrm/xfrm_user.c | 18 +++++++++---------
3 files changed, 25 insertions(+), 25 deletions(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index c4aab470171100..c499c142097453 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1143,8 +1143,8 @@ int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
int dir)
{
- if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
- return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
+ if (!READ_ONCE(net->xfrm.policy_count[dir]) && !secpath_exists(skb))
+ return READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_ACCEPT;
return false;
}
@@ -1244,8 +1244,8 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
{
struct net *net = dev_net(skb->dev);
- if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
- net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
+ if (!READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]) &&
+ READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]) == XFRM_USERPOLICY_ACCEPT)
return true;
return (skb_dst(skb)->flags & DST_NOXFRM) ||
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ef07c9872b8d14..6ac96f7bfc7ed4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -656,7 +656,7 @@ static void xfrm_byidx_resize(struct net *net)
static inline int xfrm_bydst_should_resize(struct net *net, int dir, int *total)
{
- unsigned int cnt = net->xfrm.policy_count[dir];
+ unsigned int cnt = READ_ONCE(net->xfrm.policy_count[dir]);
unsigned int hmask = net->xfrm.policy_bydst[dir].hmask;
if (total)
@@ -682,12 +682,12 @@ static inline int xfrm_byidx_should_resize(struct net *net, int total)
void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
{
- si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN];
- si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT];
- si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD];
- si->inscnt = net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX];
- si->outscnt = net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX];
- si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
+ si->incnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_IN]);
+ si->outcnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]);
+ si->fwdcnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_FWD]);
+ si->inscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_IN+XFRM_POLICY_MAX]);
+ si->outscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT+XFRM_POLICY_MAX]);
+ si->fwdscnt = READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX]);
si->spdhcnt = net->xfrm.policy_idx_hmask;
si->spdhmcnt = xfrm_policy_hashmax;
}
@@ -2298,7 +2298,7 @@ static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
struct net *net = xp_net(pol);
list_add(&pol->walk.all, &net->xfrm.policy_all);
- net->xfrm.policy_count[dir]++;
+ WRITE_ONCE(net->xfrm.policy_count[dir], net->xfrm.policy_count[dir] + 1);
xfrm_pol_hold(pol);
}
@@ -2318,7 +2318,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
}
list_del_init(&pol->walk.all);
- net->xfrm.policy_count[dir]--;
+ WRITE_ONCE(net->xfrm.policy_count[dir], net->xfrm.policy_count[dir] - 1);
return pol;
}
@@ -3192,7 +3192,7 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
/* To accelerate a bit... */
if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
- !net->xfrm.policy_count[XFRM_POLICY_OUT]))
+ !READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT])))
goto nopol;
xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
@@ -3264,7 +3264,7 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
nopol:
if ((!dst_orig->dev || !(dst_orig->dev->flags & IFF_LOOPBACK)) &&
- net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+ READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_BLOCK) {
err = -EPERM;
goto error;
}
@@ -3686,7 +3686,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
const bool is_crypto_offload = sp &&
(xfrm_input_state(skb)->xso.type == XFRM_DEV_OFFLOAD_CRYPTO);
- if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+ if (READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_BLOCK) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
return 0;
}
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ec1bda65c82fdf..5a895cafbc4239 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2217,9 +2217,9 @@ static int xfrm_notify_userpolicy(struct net *net)
}
up = nlmsg_data(nlh);
- up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
- up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
- up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
+ up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]);
+ up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]);
+ up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]);
nlmsg_end(skb, nlh);
@@ -2243,13 +2243,13 @@ static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh,
struct xfrm_userpolicy_default *up = nlmsg_data(nlh);
if (xfrm_userpolicy_is_valid(up->in))
- net->xfrm.policy_default[XFRM_POLICY_IN] = up->in;
+ WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN], up->in);
if (xfrm_userpolicy_is_valid(up->fwd))
- net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd;
+ WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD], up->fwd);
if (xfrm_userpolicy_is_valid(up->out))
- net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out;
+ WRITE_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT], up->out);
rt_genid_bump_all(net);
@@ -2279,9 +2279,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
}
r_up = nlmsg_data(r_nlh);
- r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
- r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
- r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
+ r_up->in = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_IN]);
+ r_up->fwd = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_FWD]);
+ r_up->out = READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]);
nlmsg_end(r_skb, r_nlh);
return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0716/1266] xfrm: validate selector family and prefixlen during match
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (714 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0715/1266] xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0717/1266] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
` (282 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9383b1ff0df4b29ca5e6,
Eric Dumazet, Steffen Klassert, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 40f0b1047918539f0b0f795ac65e35336b4c2c78 ]
syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).
Fix this by:
- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).
Fixes: 3f0ab59e6537 ("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")
Reported-by: syzbot+9383b1ff0df4b29ca5e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2fbe35.be3f099c.2836ae.0018.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/xfrm.h | 7 +++++++
net/xfrm/xfrm_policy.c | 3 +++
2 files changed, 10 insertions(+)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index c499c142097453..3d63e52254ed02 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -836,6 +836,9 @@ static inline bool addr_match(const void *token1, const void *token2,
unsigned int pdw;
unsigned int pbi;
+ if (prefixlen > 128)
+ return false;
+
pdw = prefixlen >> 5; /* num of whole u32 in prefix */
pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
@@ -860,6 +863,10 @@ static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
if (sizeof(long) == 4 && prefixlen == 0)
return true;
+
+ if (prefixlen > 32)
+ return false;
+
return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
}
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 6ac96f7bfc7ed4..7eaaaf56e631a0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -223,6 +223,9 @@ __xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
unsigned short family)
{
+ if (family != sel->family && sel->family != AF_UNSPEC)
+ return false;
+
switch (family) {
case AF_INET:
return __xfrm4_selector_match(sel, fl);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0717/1266] perf machine: Use snprintf() for guestmount path construction
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (715 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0716/1266] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0718/1266] perf cs-etm: Validate num_cpu before metadata allocation Greg Kroah-Hartman
` (281 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fe63d3bca288c5bb983304efd5fc3a5ff3183403 ]
machines__findnew() and machines__create_guest_kernel_maps() use
sprintf() to build paths by prepending symbol_conf.guestmount.
Both write into PATH_MAX stack buffers, but guestmount comes from
user configuration and is not length-checked. A guestmount path
at or near PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof() to prevent overflow. The
subsequent access()/fopen() calls will fail on a truncated path.
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 2f5a5245483ede..9e462ebdaca686 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -369,7 +369,7 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid)
if ((pid != HOST_KERNEL_ID) &&
(pid != DEFAULT_GUEST_KERNEL_ID) &&
(symbol_conf.guestmount)) {
- sprintf(path, "%s/%d", symbol_conf.guestmount, pid);
+ snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid);
if (access(path, R_OK)) {
static struct strlist *seen;
@@ -1415,9 +1415,9 @@ int machines__create_guest_kernel_maps(struct machines *machines)
namelist[i]->d_name);
continue;
}
- sprintf(path, "%s/%s/proc/kallsyms",
- symbol_conf.guestmount,
- namelist[i]->d_name);
+ snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
+ symbol_conf.guestmount,
+ namelist[i]->d_name);
ret = access(path, R_OK);
if (ret) {
pr_debug("Can't access file %s\n", path);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0718/1266] perf cs-etm: Validate num_cpu before metadata allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (716 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0717/1266] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0719/1266] perf cs-etm: Require full global header in auxtrace_info size check Greg Kroah-Hartman
` (280 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter,
James Clark, Leo Yan, Tor Jeremiassen, Arnaldo Carvalho de Melo,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 312d91329b8fc6989a916a3f9a12d0674167b7e4 ]
cs_etm__process_auxtrace_info_full() reads num_cpu from untrusted
perf.data and uses it to allocate the metadata pointer array:
metadata = zalloc(sizeof(*metadata) * num_cpu);
On 32-bit, sizeof(*metadata) is 4, so num_cpu = 0x40000000 overflows
the multiplication to 0, causing zalloc(0) to return a valid zero-sized
allocation followed by out-of-bounds writes in the population loop.
Fix by computing priv_size early and using it to bound num_cpu: each
CPU needs at least one u64 metadata entry, so num_cpu cannot exceed
the total number of u64 entries in the event's private data area.
Fixes: cd8bfd8c973eaff8 ("perf tools: Add processing of coresight metadata")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@arm.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Tor Jeremiassen <tor@ti.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 8dc12759ee62f4..10ea1e3254fe21 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -3355,6 +3355,18 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
/* First the global part */
ptr = (u64 *) auxtrace_info->priv;
num_cpu = ptr[CS_PMU_TYPE_CPUS] & 0xffffffff;
+
+ /*
+ * Bound num_cpu by the event size: the global header consumes
+ * CS_ETM_HEADER_SIZE bytes, and each CPU needs at least one u64
+ * metadata entry after that.
+ */
+ priv_size = total_size - event_header_size - INFO_HEADER_SIZE -
+ CS_ETM_HEADER_SIZE;
+ if (num_cpu <= 0 || priv_size <= 0 ||
+ num_cpu > priv_size / (int)sizeof(u64))
+ return -EINVAL;
+
metadata = zalloc(sizeof(*metadata) * num_cpu);
if (!metadata) {
err = -ENOMEM;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0719/1266] perf cs-etm: Require full global header in auxtrace_info size check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (717 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0718/1266] perf cs-etm: Validate num_cpu before metadata allocation Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0720/1266] ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode Greg Kroah-Hartman
` (279 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Adrian Hunter,
James Clark, Leo Yan, Arnaldo Carvalho de Melo, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 78d8ba680126f3545e8d0fba667e12d79fd4353b ]
cs_etm__process_auxtrace_info() checks that header.size covers
event_header_size + INFO_HEADER_SIZE (16 bytes total), but then
accesses ptr[CS_PMU_TYPE_CPUS] at offset 24 from the start of the
event. A crafted 16-byte auxtrace_info event passes the size check
but reads out-of-bounds.
Include CS_ETM_HEADER_SIZE in the minimum size check so that the
global header entries (version, pmu_type_cpus, snapshot) are
guaranteed to fit within the event.
Fixes: 55c1de9973d66516 ("perf cs-etm: Print auxtrace info even if OpenCSD isn't linked")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@arm.com>
Cc: Leo Yan <leo.yan@linaro.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm-base.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/cs-etm-base.c b/tools/perf/util/cs-etm-base.c
index 4abe416e3febd2..aebef71d3a0a1d 100644
--- a/tools/perf/util/cs-etm-base.c
+++ b/tools/perf/util/cs-etm-base.c
@@ -170,7 +170,9 @@ int cs_etm__process_auxtrace_info(union perf_event *event,
u64 *ptr = NULL;
u64 hdr_version;
- if (auxtrace_info->header.size < (event_header_size + INFO_HEADER_SIZE))
+ /* Ensure priv[] is large enough for the global header entries */
+ if (auxtrace_info->header.size < (event_header_size + INFO_HEADER_SIZE +
+ CS_ETM_HEADER_SIZE))
return -EINVAL;
/* First the global part */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0720/1266] ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (718 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0719/1266] perf cs-etm: Require full global header in auxtrace_info size check Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0721/1266] drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free Greg Kroah-Hartman
` (278 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mir Jeffres, Sen Wang, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sen Wang <sen@ti.com>
[ Upstream commit fdf043f5f3bae150b678feae3d7bb1beed87ec14 ]
The datasheet documents that when the PLL is disabled and dual-rate mode
is enabled, only Q values {4, 8, 9, 12, 16} are valid for the CLKDIV
bypass path; all other Q values produce invalid bitclock output.
The existing loop iterates Q from 2 to 17 without this restriction,
causing silent audio failure when an out-of-spec Q is picked.
Restrict the Q search to the allowed set in dual-rate mode.
Fixes: 4f9c16ccfa26 ("[ALSA] soc - tlv320aic3x - revisit clock setup")
Suggested-by: Mir Jeffres <m-jeffres@ti.com>
Signed-off-by: Sen Wang <sen@ti.com>
Link: https://patch.msgid.link/20260616233322.873081-1-sen@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tlv320aic3x.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 591f6c9f9d3a60..05eff1ed4e96ca 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1049,11 +1049,13 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params,
struct snd_soc_dai *dai)
{
+ static const u8 dual_rate_q[] = {4, 8, 9, 12, 16};
struct snd_soc_component *component = dai->component;
struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
int codec_clk = 0, bypass_pll = 0, fsref, last_clk = 0;
u8 data, j, r, p, pll_q, pll_p = 1, pll_r = 1, pll_j = 1;
u16 d, pll_d = 1;
+ bool dual_rate;
int clk;
int width = aic3x->slot_width;
@@ -1079,14 +1081,25 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
/* Fsref can be 44100 or 48000 */
fsref = (params_rate(params) % 11025 == 0) ? 44100 : 48000;
+ dual_rate = params_rate(params) >= 64000;
/* Try to find a value for Q which allows us to bypass the PLL and
* generate CODEC_CLK directly. */
- for (pll_q = 2; pll_q < 18; pll_q++)
- if (aic3x->sysclk / (128 * pll_q) == fsref) {
- bypass_pll = 1;
- break;
+ if (dual_rate) {
+ for (int i = 0; i < ARRAY_SIZE(dual_rate_q); i++) {
+ pll_q = dual_rate_q[i];
+ if (aic3x->sysclk / (128 * pll_q) == fsref) {
+ bypass_pll = 1;
+ break;
+ }
}
+ } else {
+ for (pll_q = 2; pll_q < 18; pll_q++)
+ if (aic3x->sysclk / (128 * pll_q) == fsref) {
+ bypass_pll = 1;
+ break;
+ }
+ }
if (bypass_pll) {
pll_q &= 0xf;
@@ -1106,13 +1119,13 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
* right DAC to right channel input */
data = (LDAC2LCH | RDAC2RCH);
data |= (fsref == 44100) ? FSREF_44100 : FSREF_48000;
- if (params_rate(params) >= 64000)
+ if (dual_rate)
data |= DUAL_RATE_MODE;
snd_soc_component_write(component, AIC3X_CODEC_DATAPATH_REG, data);
/* codec sample rate select */
data = (fsref * 20) / params_rate(params);
- if (params_rate(params) < 64000)
+ if (!dual_rate)
data /= 2;
data /= 5;
data -= 2;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0721/1266] drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (719 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0720/1266] ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0722/1266] drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm Greg Kroah-Hartman
` (277 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunxiang Li, Felix Kuehling,
Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunxiang Li <Yunxiang.Li@amd.com>
[ Upstream commit 3f0cc1735273a57c5116710cf0202e12152f59cc ]
amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO
remap BOs (which are pinned at allocation time) before checking whether
the BO is still mapped to the GPU. When the BO is still mapped, the
function returns -EBUSY and leaves the BO alive, but it has already
been unpinned. The BO is then unpinned again when it is finally freed
during process teardown, triggering a ttm_bo_unpin() underflow warning:
WARNING: CPU: 18 PID: 15066 at ttm/ttm_bo.c:650 amdttm_bo_unpin+0x6d/0x80 [amdttm]
Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]
RIP: 0010:amdttm_bo_unpin+0x6d/0x80 [amdttm]
Call Trace:
amdgpu_bo_unpin+0x1a/0x90 [amdgpu]
amdgpu_amdkfd_gpuvm_unpin_bo+0x31/0xb0 [amdgpu]
amdgpu_amdkfd_gpuvm_free_memory_of_gpu+0x3bf/0x460 [amdgpu]
kfd_process_free_outstanding_kfd_bos+0xd4/0x170 [amdgpu]
kfd_process_wq_release+0x109/0x1b0 [amdgpu]
process_one_work+0x1e2/0x3b0
worker_thread+0x50/0x3a0
kthread+0xdd/0x100
ret_from_fork+0x29/0x50
Move the unpin after the mapped_to_gpu_memory check so it only happens
once we are committed to freeing the BO.
Fixes: d25e35bc26c3 ("drm/amdgpu: Pin MMIO/DOORBELL BO's in GTT domain")
Signed-off-by: Yunxiang Li <Yunxiang.Li@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 927c5b2defb9b09856444d94bebfd056a002bd75)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 9c0e4e4bf3f614..fdfed86c843215 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1823,13 +1823,6 @@ int amdgpu_amdkfd_gpuvm_free_memory_of_gpu(
mutex_lock(&mem->lock);
- /* Unpin MMIO/DOORBELL BO's that were pinned during allocation */
- if (mem->alloc_flags &
- (KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL |
- KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP)) {
- amdgpu_amdkfd_gpuvm_unpin_bo(mem->bo);
- }
-
mapped_to_gpu_memory = mem->mapped_to_gpu_memory;
is_imported = mem->is_imported;
mutex_unlock(&mem->lock);
@@ -1843,6 +1836,15 @@ int amdgpu_amdkfd_gpuvm_free_memory_of_gpu(
return -EBUSY;
}
+ /* At this point the BO is guaranteed to be freed, so unpin the
+ * MMIO/DOORBELL BOs that were pinned during allocation.
+ */
+ if (mem->alloc_flags &
+ (KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL |
+ KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP)) {
+ amdgpu_amdkfd_gpuvm_unpin_bo(mem->bo);
+ }
+
/* Make sure restore workers don't access the BO any more */
mutex_lock(&process_info->lock);
list_del(&mem->validate_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0722/1266] drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (720 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0721/1266] drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0723/1266] drm/amdgpu: initialize irq.lock spinlock earlier Greg Kroah-Hartman
` (276 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Mario Limonciello,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 8fa5655da368d0306c03e9dc9cda8ae2a7840926 ]
The cleanup tail of kfd_criu_resume_svm() walks
svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata
without removing it from the list. The list head is left pointing at
freed kmalloc-96 objects.
A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()
reads the dangling ->next (use-after-free), the loop walks freed entries,
and each is kfree()'d again (double-free). This is reachable by an
unprivileged render-group user via /dev/kfd with no capabilities required.
Add list_del() before the kfree() so the list is properly emptied. The
list_for_each_entry_safe() iterator already caches the next pointer, so
unlinking during the walk is safe.
Fixes: 2a909ae71871 ("drm/amdkfd: CRIU resume shared virtual memory ranges")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index b1fcc40b7308d9..dc4d6bd4a7d00e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -3935,6 +3935,7 @@ int kfd_criu_resume_svm(struct kfd_process *p)
list_for_each_entry_safe(criu_svm_md, next, &svms->criu_svm_metadata_list, list) {
pr_debug("freeing criu_svm_md[]\n\tstart: 0x%llx\n",
criu_svm_md->data.start_addr);
+ list_del(&criu_svm_md->list);
kfree(criu_svm_md);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0723/1266] drm/amdgpu: initialize irq.lock spinlock earlier
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (721 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0722/1266] drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0724/1266] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
` (275 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin,
Thadeu Lima de Souza Cascardo, Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
[ Upstream commit a2b270c0ecf6d95bcd14ef4c20d0301a88143ff5 ]
If there is an early failure during amdgpu probe, like missing firmware, it
will end up calling amdgpu_irq_disable_all, which takes irq.lock spinlock
without it being initialized.
Initializing irq.lock earlier at amdgpu_device_init fixes the issue.
[ 79.334079] INFO: trying to register non-static key.
[ 79.334081] The code is fine but needs lockdep annotation, or maybe
[ 79.334083] you didn't initialize this object before use?
[ 79.334084] turning off the locking correctness validator.
[ 79.334088] CPU: 2 UID: 0 PID: 1819 Comm: bash Not tainted 7.1.0-rc5-gfd06300b2348 #96 PREEMPT 8e8f461221633dae3c832d6689eaf0546c0ed4cd
[ 79.334092] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0133 08/05/2024
[ 79.334094] Call Trace:
[ 79.334095] <TASK>
[ 79.334097] dump_stack_lvl+0x5d/0x80
[ 79.334103] register_lock_class+0x7af/0x7c0
[ 79.334109] __lock_acquire+0x416/0x2610
[ 79.334114] lock_acquire+0xcf/0x310
[ 79.334117] ? amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.334503] ? _raw_spin_lock_irqsave+0x53/0x60
[ 79.334508] _raw_spin_lock_irqsave+0x3f/0x60
[ 79.334510] ? amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.334881] amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.335240] amdgpu_device_fini_hw+0x90/0x32c [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.335704] amdgpu_driver_load_kms.cold+0x22/0x44 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.336159] amdgpu_pci_probe+0x204/0x440 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180]
[ 79.336494] local_pci_probe+0x3c/0x80
[ 79.336500] pci_call_probe+0x55/0x2e0
[ 79.336505] ? _raw_spin_unlock+0x2d/0x50
[ 79.336508] ? pci_match_device+0x157/0x180
[ 79.336512] pci_device_probe+0x9b/0x170
[ 79.336516] really_probe+0xd5/0x370
[ 79.336521] __driver_probe_device+0x84/0x150
[ 79.336525] device_driver_attach+0x47/0xb0
[ 79.336528] bind_store+0x73/0xc0
[ 79.336531] kernfs_fop_write_iter+0x176/0x250
[ 79.336536] vfs_write+0x24d/0x560
[ 79.336542] ksys_write+0x71/0xe0
[ 79.336546] do_syscall_64+0x122/0x710
[ 79.336550] ? do_syscall_64+0xd1/0x710
[ 79.336553] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 79.336557] RIP: 0033:0x7f92fd675006
[ 79.336561] Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08
[ 79.336562] RSP: 002b:00007ffe4fa867a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 79.336565] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f92fd675006
[ 79.336567] RDX: 000000000000000d RSI: 000055b2dfce59b0 RDI: 0000000000000001
[ 79.336568] RBP: 00007ffe4fa867c0 R08: 0000000000000000 R09: 0000000000000000
[ 79.336569] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d
[ 79.336570] R13: 000055b2dfce59b0 R14: 00007f92fd7ca5c0 R15: 000055b2dfdbaf70
[ 79.336574] </TASK>
Fixes: 9950cda2a018 ("drm/amdgpu: drop the drm irq pre/post/un install callbacks")
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7dba3e10ecdeec85208e255853fcd3890880b10e)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 --
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ad2723206a1856..8a3674a9ea0b22 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3590,6 +3590,8 @@ int amdgpu_device_init(struct amdgpu_device *adev,
mutex_init(&adev->pm.stable_pstate_ctx_lock);
mutex_init(&adev->benchmark_mutex);
+ spin_lock_init(&adev->irq.lock);
+
amdgpu_device_init_apu_flags(adev);
r = amdgpu_device_check_arguments(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
index 5978edf7ea71e4..79b053dc173348 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -273,8 +273,6 @@ int amdgpu_irq_init(struct amdgpu_device *adev)
int r = 0;
unsigned int irq;
- spin_lock_init(&adev->irq.lock);
-
/* Enable MSI if not disabled by module parameter */
adev->irq.msi_enabled = false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0724/1266] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (722 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0723/1266] drm/amdgpu: initialize irq.lock spinlock earlier Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0725/1266] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
` (274 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksey Makarov, Ratheesh Kannoth,
Simon Horman, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <rkannoth@marvell.com>
[ Upstream commit a056db30de92945ff8ee6033096678bfbae878e3 ]
The send-queue timestamp ring is allocated with qmem_alloc() when
timestamping is used, but otx2_free_sq_res() never freed sq->timestamps,
leaking that memory across ifdown and device removal. Add the missing
qmem_free() alongside the other SQ companion buffers.
Fixes: c9c12d339d93 ("octeontx2-pf: Add support for PTP clock")
Cc: Aleksey Makarov <amakarov@marvell.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260615030704.504536-1-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 784130b4b08655..a41ca759ce77fb 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -1448,6 +1448,7 @@ static void otx2_free_sq_res(struct otx2_nic *pf)
continue;
qmem_free(pf->dev, sq->sqe);
qmem_free(pf->dev, sq->tso_hdrs);
+ qmem_free(pf->dev, sq->timestamps);
kfree(sq->sg);
kfree(sq->sqb_ptrs);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0725/1266] net: psample: fix info leak in PSAMPLE_ATTR_DATA
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (723 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0724/1266] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0726/1266] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
` (273 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Jiri Pirko,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit aedd02af1f8b0bceb7f42f5a21c41634ca9ed390 ]
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260616003046.1099490-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/psample/psample.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/psample/psample.c b/net/psample/psample.c
index ddd211a151d0d9..a4d09437795580 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -465,15 +465,17 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb,
goto error;
if (data_len) {
- int nla_len = nla_total_size(data_len);
+ int nla_len = nla_attr_size(data_len);
struct nlattr *nla;
nla = skb_put(nl_skb, nla_len);
nla->nla_type = PSAMPLE_ATTR_DATA;
- nla->nla_len = nla_attr_size(data_len);
+ nla->nla_len = nla_len;
if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
goto error;
+
+ skb_put_zero(nl_skb, nla_padlen(data_len));
}
#ifdef CONFIG_INET
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0726/1266] sctp: hold socket lock when dumping endpoints in sctp_diag
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (724 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0725/1266] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0727/1266] PCI: iproc: Restore .map_irq() for the platform bus driver Greg Kroah-Hartman
` (272 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zero Day Initiative, Xin Long,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823 ]
SCTP_DIAG endpoint dumping was traversing endpoint address lists without
holding lock_sock(), while those lists could change concurrently via
socket operations (e.g., bindx changes). This creates a race where
nla_reserve() counts addresses under RCU protection, but the subsequent
copy may see fewer entries, potentially leaking uninitialized memory to
userspace.
Fix this by:
- Taking a reference on each endpoint during hash traversal
- Moving socket operations (lock_sock()) outside read_lock_bh()
- Serializing address list access during dump
- Reworking sctp_for_each_endpoint() to support restart-based traversal
with (net, pos) tracking
Also:
- Add WARN_ON_ONCE() for inconsistent address counts
- Fix idiag_states filtering for LISTEN vs association cases
- Skip dumping endpoints being freed (ep->base.dead)
- Move dump position tracking into iterator, removing cb->args[4] and
its comment for sctp_ep_dump().,
- Update the comment for cb->args[4] and remove the comment for unused
cb->args[5] for sctp_sock_dump().
Note: traversal is restart-based and may re-scan buckets multiple times,
but this is acceptable due to small bucket sizes and required to support
sleeping-safe callbacks.
This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero
Day Initiative.
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/4c1b49ab87e0f7d552ebd8172b364b1994e913c9.1781552190.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sctp/sctp.h | 3 +-
net/sctp/diag.c | 67 ++++++++++++++++++++---------------------
net/sctp/socket.c | 29 +++++++++++++-----
3 files changed, 56 insertions(+), 43 deletions(-)
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index a2310fa995f647..54d365275764fc 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -112,7 +112,8 @@ int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
const union sctp_addr *paddr, void *p, int dif);
int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
struct net *net, int *pos, void *p);
-int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p);
+int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
+ struct net *net, int *pos, void *p);
int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
struct sctp_info *info);
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 67eefb3137e252..bc8235bb19e6f7 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -92,6 +92,7 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
if (!--addrcnt)
break;
}
+ WARN_ON_ONCE(addrcnt);
rcu_read_unlock();
return 0;
@@ -373,42 +374,39 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
struct sk_buff *skb = commp->skb;
struct netlink_callback *cb = commp->cb;
const struct inet_diag_req_v2 *r = commp->r;
- struct net *net = sock_net(skb->sk);
struct inet_sock *inet = inet_sk(sk);
int err = 0;
- if (!net_eq(sock_net(sk), net))
+ lock_sock(sk);
+ if (ep->base.dead)
goto out;
- if (cb->args[4] < cb->args[1])
- goto next;
-
- if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))
- goto next;
+ /* Skip eps with assocs if non-LISTEN states were requested, since
+ * they'll be dumped by sctp_sock_dump() during assoc traversal.
+ */
+ if ((r->idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)) &&
+ !list_empty(&ep->asocs))
+ goto out;
if (r->sdiag_family != AF_UNSPEC &&
sk->sk_family != r->sdiag_family)
- goto next;
+ goto out;
if (r->id.idiag_sport != inet->inet_sport &&
r->id.idiag_sport)
- goto next;
+ goto out;
if (r->id.idiag_dport != inet->inet_dport &&
r->id.idiag_dport)
- goto next;
-
- if (inet_sctp_diag_fill(sk, NULL, skb, r,
- sk_user_ns(NETLINK_CB(cb->skb).sk),
- NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq, NLM_F_MULTI,
- cb->nlh, commp->net_admin) < 0) {
- err = 2;
goto out;
- }
-next:
- cb->args[4]++;
+
+ err = inet_sctp_diag_fill(sk, NULL, skb, r,
+ sk_user_ns(NETLINK_CB(cb->skb).sk),
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ cb->nlh, commp->net_admin);
out:
+ release_sock(sk);
return err;
}
@@ -479,41 +477,40 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
.r = r,
.net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
};
- int pos = cb->args[2];
+ int pos;
/* eps hashtable dumps
* args:
* 0 : if it will traversal listen sock
* 1 : to record the sock pos of this time's traversal
- * 4 : to work as a temporary variable to traversal list
*/
if (cb->args[0] == 0) {
- if (!(idiag_states & TCPF_LISTEN))
- goto skip;
- if (sctp_for_each_endpoint(sctp_ep_dump, &commp))
- goto done;
-skip:
+ if (idiag_states & TCPF_LISTEN) {
+ pos = cb->args[1];
+ if (sctp_for_each_endpoint(sctp_ep_dump, net, &pos,
+ &commp)) {
+ cb->args[1] = pos;
+ return;
+ }
+ }
cb->args[0] = 1;
cb->args[1] = 0;
- cb->args[4] = 0;
}
+ if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
+ return;
+
/* asocs by transport hashtable dump
* args:
* 1 : to record the assoc pos of this time's traversal
* 2 : to record the transport pos of this time's traversal
* 3 : to mark if we have dumped the ep info of the current asoc
- * 4 : to work as a temporary variable to traversal list
- * 5 : to save the sk we get from travelsing the tsp list.
+ * 4 : to track position within ep->asocs list in sctp_sock_dump()
*/
- if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
- goto done;
-
+ pos = cb->args[2];
sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,
net, &pos, &commp);
cb->args[2] = pos;
-
-done:
cb->args[1] = cb->args[4];
cb->args[4] = 0;
}
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a6a53b0c4ea324..890c587ebe2745 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5317,24 +5317,39 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net,
}
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
- void *p) {
- int err = 0;
- int hash = 0;
- struct sctp_endpoint *ep;
+ struct net *net, int *pos, void *p) {
+ int err, hash = 0, idx = 0, start;
struct sctp_hashbucket *head;
+ struct sctp_endpoint *ep;
for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
hash++, head++) {
+ start = idx;
+again:
read_lock_bh(&head->lock);
sctp_for_each_hentry(ep, &head->chain) {
- err = cb(ep, p);
- if (err)
+ if (sock_net(ep->base.sk) != net)
+ continue;
+ if (idx++ >= *pos) {
+ sctp_endpoint_hold(ep);
break;
+ }
}
read_unlock_bh(&head->lock);
+
+ if (ep) {
+ err = cb(ep, p);
+ sctp_endpoint_put(ep);
+ if (err)
+ return err;
+ (*pos)++;
+
+ idx = start;
+ goto again;
+ }
}
- return err;
+ return 0;
}
EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0727/1266] PCI: iproc: Restore .map_irq() for the platform bus driver
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (725 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0726/1266] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0728/1266] spi: rpc-if: Use correct device for hardware reinitialization on resume Greg Kroah-Hartman
` (271 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Tomlinson,
Manivannan Sadhasivam, Bjorn Helgaas, Ray Jui, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[ Upstream commit 3c2e6cc6affa8acdb99a580be1f8f297edf54204 ]
Commit b64aa11eb2dd ("PCI: Set bridge map_irq and swizzle_irq to default
functions") moved the assignment of default .map_irq() callback to
devm_of_pci_bridge_init() and removed the initialization of
'iproc_pcie::map_irq' in platform bus driver. This led to the callback
getting assigned the NULL pointer for platform bus driver, thereby breaking
the INTx functionality, since 'iproc_pcie::map_irq' overrides the
'pci_host_bridge::map_irq' callback in iproc_pcie_setup().
This issue only affected the iproc platform bus driver as this driver
relies on the default callback for non-PAXC controllers. iproc-brcm driver
was already providing the custom mapping function, so it was unaffected.
Restore the original (and intended) behaviour to use the default map_irq
function by removing the local 'iproc_pcie::map_irq' pointer and directly
assigning the 'pci_host_bridge::map_irq' callback in iproc-bcma driver.
This ensures that the default 'map_irq' callback is used for platform bus
driver and only iproc-brcm driver overrides it with a custom one.
Fixes: b64aa11eb2dd ("PCI: Set bridge map_irq and swizzle_irq to default functions")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Ray Jui <ray.jui@broadcom.com>
Link: https://patch.msgid.link/20260430021628.1343154-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-iproc-bcma.c | 2 +-
drivers/pci/controller/pcie-iproc-platform.c | 2 +-
drivers/pci/controller/pcie-iproc.c | 1 -
drivers/pci/controller/pcie-iproc.h | 2 --
4 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/controller/pcie-iproc-bcma.c b/drivers/pci/controller/pcie-iproc-bcma.c
index 99a99900444de1..593418c2bc3aa6 100644
--- a/drivers/pci/controller/pcie-iproc-bcma.c
+++ b/drivers/pci/controller/pcie-iproc-bcma.c
@@ -64,7 +64,7 @@ static int iproc_bcma_pcie_probe(struct bcma_device *bdev)
if (ret)
return ret;
- pcie->map_irq = iproc_bcma_pcie_map_irq;
+ bridge->map_irq = iproc_bcma_pcie_map_irq;
bcma_set_drvdata(bdev, pcie);
diff --git a/drivers/pci/controller/pcie-iproc-platform.c b/drivers/pci/controller/pcie-iproc-platform.c
index acdc583d29802c..42fd1b0ded517d 100644
--- a/drivers/pci/controller/pcie-iproc-platform.c
+++ b/drivers/pci/controller/pcie-iproc-platform.c
@@ -98,7 +98,7 @@ static int iproc_pltfm_pcie_probe(struct platform_device *pdev)
switch (pcie->type) {
case IPROC_PCIE_PAXC:
case IPROC_PCIE_PAXC_V2:
- pcie->map_irq = NULL;
+ bridge->map_irq = NULL;
break;
default:
break;
diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index bd1c98b688516c..49f127a2e123f8 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -1514,7 +1514,6 @@ int iproc_pcie_setup(struct iproc_pcie *pcie, struct list_head *res)
host->ops = &iproc_pcie_ops;
host->sysdata = pcie;
- host->map_irq = pcie->map_irq;
ret = pci_host_probe(host);
if (ret < 0) {
diff --git a/drivers/pci/controller/pcie-iproc.h b/drivers/pci/controller/pcie-iproc.h
index 969ded03b8c2da..c4443f236ca3bb 100644
--- a/drivers/pci/controller/pcie-iproc.h
+++ b/drivers/pci/controller/pcie-iproc.h
@@ -61,7 +61,6 @@ struct iproc_msi;
* @base_addr: PCIe host controller register base physical address
* @mem: host bridge memory window resource
* @phy: optional PHY device that controls the Serdes
- * @map_irq: function callback to map interrupts
* @ep_is_internal: indicates an internal emulated endpoint device is connected
* @iproc_cfg_read: indicates the iProc config read function should be used
* @rej_unconfig_pf: indicates the root complex needs to detect and reject
@@ -91,7 +90,6 @@ struct iproc_pcie {
phys_addr_t base_addr;
struct resource mem;
struct phy *phy;
- int (*map_irq)(const struct pci_dev *, u8, u8);
bool ep_is_internal;
bool iproc_cfg_read;
bool rej_unconfig_pf;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0728/1266] spi: rpc-if: Use correct device for hardware reinitialization on resume
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (726 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0727/1266] PCI: iproc: Restore .map_irq() for the platform bus driver Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0729/1266] virtio-net: fix len check in receive_big() Greg Kroah-Hartman
` (270 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quang Nguyen, Biju Das,
Geert Uytterhoeven, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quang Nguyen <quang.nguyen.wx@renesas.com>
[ Upstream commit 7b25dbafa2fce50b1a48c1d057adb35da3563f9b ]
rpcif_spi_resume() currently passes the SPI controller device to
rpcif_hw_init(), but the function should be called with the RPC
interface device.
Retrieve the rpcif private data from the SPI controller and pass
rpc->dev instead. Also propagate the return value of rpcif_hw_init() so
that a failure during resume is properly reported rather than silently
ignored.
Fixes: ad4728740bd6 ("spi: rpc-if: Add resume support for RZ/G3E")
Signed-off-by: Quang Nguyen <quang.nguyen.wx@renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260618081932.172168-1-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-rpc-if.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
index a1696672d12fea..2de7ae058c2931 100644
--- a/drivers/spi/spi-rpc-if.c
+++ b/drivers/spi/spi-rpc-if.c
@@ -192,8 +192,12 @@ static int __maybe_unused rpcif_spi_suspend(struct device *dev)
static int __maybe_unused rpcif_spi_resume(struct device *dev)
{
struct spi_controller *ctlr = dev_get_drvdata(dev);
+ struct rpcif *rpc = spi_controller_get_devdata(ctlr);
+ int ret;
- rpcif_hw_init(dev, false);
+ ret = rpcif_hw_init(rpc->dev, false);
+ if (ret)
+ return ret;
return spi_controller_resume(ctlr);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0729/1266] virtio-net: fix len check in receive_big()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (727 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0728/1266] spi: rpc-if: Use correct device for hardware reinitialization on resume Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0730/1266] dpaa2-switch: fix VLAN upper check not rejecting bridge join Greg Kroah-Hartman
` (269 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Xuan Zhuo,
Michael S. Tsirkin, Bui Quang Minh, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 9e5ad06ea826322ce8c58b4a68442a96f600c3c4 ]
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
Fixes: 0c716703965f ("virtio-net: fix received length check in big packets")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://patch.msgid.link/20260616042837.2249468-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 5bcd1296851c6c..8be173b76abe5b 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1334,15 +1334,18 @@ static struct sk_buff *receive_big(struct net_device *dev,
struct virtnet_rq_stats *stats)
{
struct page *page = buf;
+ unsigned long max_len;
struct sk_buff *skb;
+ max_len = (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE -
+ sizeof(struct padded_vnet_hdr) + vi->hdr_len;
+
/* Make sure that len does not exceed the size allocated in
* add_recvbuf_big.
*/
- if (unlikely(len > (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE)) {
+ if (unlikely(len > max_len)) {
pr_debug("%s: rx error: len %u exceeds allocated size %lu\n",
- dev->name, len,
- (vi->big_packets_num_skbfrags + 1) * PAGE_SIZE);
+ dev->name, len, max_len);
goto err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0730/1266] dpaa2-switch: fix VLAN upper check not rejecting bridge join
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (728 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0729/1266] virtio-net: fix len check in receive_big() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0731/1266] devlink: Fix parent ref leak in devl_rate_node_create() Greg Kroah-Hartman
` (268 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit ed2294f94e34e97342850c40b320833d881c3819 ]
The blamed commit refactored the prechangeupper event handling but
failed to actually return an error in case
dpaa2_switch_prevent_bridging_with_8021q_upper() detected a 802.1q upper
on a port which tries to join a bridge. Fix this by returning err
instead of 0.
Fixes: 45035febc495 ("net: dpaa2-switch: refactor prechangeupper sanity checks")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260616105430.3725910-1-ioana.ciornei@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index 176f7072338b27..0f8b46dccc0971 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -2180,7 +2180,7 @@ dpaa2_switch_prechangeupper_sanity_checks(struct net_device *netdev,
if (err) {
NL_SET_ERR_MSG_MOD(extack,
"Cannot join a bridge while VLAN uppers are present");
- return 0;
+ return err;
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0731/1266] devlink: Fix parent ref leak in devl_rate_node_create()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (729 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0730/1266] dpaa2-switch: fix VLAN upper check not rejecting bridge join Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0732/1266] flow_dissector: check device type before reading ETH_ADDRS Greg Kroah-Hartman
` (267 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cosmin Ratiu, Carolina Jubran,
Simon Horman, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <cratiu@nvidia.com>
[ Upstream commit ba45106342bbdd905651cb9fcefb8c11871d4c25 ]
In the original commit the function bails out on kstrdup failure,
forgetting to decrement the refcnt of the parent.
Fix that by moving the parent refcnt setting after kstrdup.
Fixes: caba177d7f4d ("devlink: Enable creation of the devlink-rate nodes from the driver")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260616110633.1449432-2-cratiu@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/devlink/rate.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/devlink/rate.c b/net/devlink/rate.c
index e7e80af4abaf65..b4d13b5ef9b624 100644
--- a/net/devlink/rate.c
+++ b/net/devlink/rate.c
@@ -598,11 +598,6 @@ devl_rate_node_create(struct devlink *devlink, void *priv, char *node_name,
if (!rate_node)
return ERR_PTR(-ENOMEM);
- if (parent) {
- rate_node->parent = parent;
- refcount_inc(&rate_node->parent->refcnt);
- }
-
rate_node->type = DEVLINK_RATE_TYPE_NODE;
rate_node->devlink = devlink;
rate_node->priv = priv;
@@ -613,6 +608,11 @@ devl_rate_node_create(struct devlink *devlink, void *priv, char *node_name,
return ERR_PTR(-ENOMEM);
}
+ if (parent) {
+ rate_node->parent = parent;
+ refcount_inc(&rate_node->parent->refcnt);
+ }
+
refcount_set(&rate_node->refcnt, 1);
list_add(&rate_node->list, &devlink->rate_list);
devlink_rate_notify(rate_node, DEVLINK_CMD_RATE_NEW);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0732/1266] flow_dissector: check device type before reading ETH_ADDRS
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (730 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0731/1266] devlink: Fix parent ref leak in devl_rate_node_create() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0733/1266] ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints Greg Kroah-Hartman
` (266 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+fa2f5b1fb06147be5e16,
Yun Zhou, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit bf6e8af2c8be77489bedeae9f8a9654cb710e500 ]
__skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb)
when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb
has a valid Ethernet header at mac_header, which is not always the case.
The problem can be triggered by:
1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0)
2. Attaching a multiq qdisc with a flower filter matching on eth_src
3. Sending a packet through AF_PACKET
Since TUN in L3 mode has no link-layer header, mac_header points to
the L3 data area. The flow dissector reads 12 bytes of uninitialized
skb memory, which then propagates through fl_set_masked_key() and is
used as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN.
Rejecting the filter in the control path (at tc filter add time) is
not feasible because TC filter blocks can be shared between arbitrary
devices -- a filter installed on an Ethernet device may later classify
packets on a headerless device through a shared block. The device
association is not fixed at filter creation time.
Fix this by gating the memcpy on dev->type == ARPHRD_ETHER, which
ensures only true Ethernet-framed packets have their addresses read.
This is more precise than the previous hard_header_len >= 12 check,
which would incorrectly pass for non-Ethernet link types like IPoIB
(ARPHRD_INFINIBAND, hard_header_len=24) and FDDI (hard_header_len=21)
whose L2 headers are not in Ethernet format. Additionally check
skb_mac_header_was_set() to guard against the pathological case where
mac_header is the unset sentinel (~0U), which would cause eth_hdr() to
return a wild pointer.
For the act_mirred redirect case (Ethernet packet redirected to a
non-Ethernet device sharing a TC block), zeroing the key is the correct
behavior: the packet is now being classified on the target device, where
Ethernet address matching is not semantically meaningful.
Note: on non-Ethernet devices, the zeroed key will match a filter
configured with all-zero MAC addresses. This is an improvement over the
previous behavior where uninitialized memory could randomly match any
filter.
Reported-by: syzbot+fa2f5b1fb06147be5e16@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fa2f5b1fb06147be5e16
Fixes: 67a900cc0436 ("flow_dissector: introduce support for Ethernet addresses")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260616123057.482154-1-yun.zhou@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/flow_dissector.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 9432e5362b44f1..5ac4cd4f3c6832 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1149,13 +1149,21 @@ bool __skb_flow_dissect(const struct net *net,
if (dissector_uses_key(flow_dissector,
FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
- struct ethhdr *eth = eth_hdr(skb);
struct flow_dissector_key_eth_addrs *key_eth_addrs;
key_eth_addrs = skb_flow_dissector_target(flow_dissector,
FLOW_DISSECTOR_KEY_ETH_ADDRS,
target_container);
- memcpy(key_eth_addrs, eth, sizeof(*key_eth_addrs));
+ /* TC filter blocks can be shared across devices with
+ * different link types, so we cannot validate this
+ * when the filter is installed -- check at dissect time.
+ */
+ if (skb && skb->dev &&
+ skb->dev->type == ARPHRD_ETHER &&
+ skb_mac_header_was_set(skb))
+ memcpy(key_eth_addrs, eth_hdr(skb), sizeof(*key_eth_addrs));
+ else
+ memset(key_eth_addrs, 0, sizeof(*key_eth_addrs));
}
if (dissector_uses_key(flow_dissector,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0733/1266] ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (731 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0732/1266] flow_dissector: check device type before reading ETH_ADDRS Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0734/1266] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
` (265 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cen Zhang, Takashi Iwai, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit f199c8a8bdd54296d3458777e70fe82a78bd9817 ]
MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A
later setup failure can still jump to snd_usb_midi_v2_free(), which
currently frees each endpoint and its coherent URB buffers without first
stopping the submitted URBs. A completion can then dereference the
embedded URB context and endpoint state after they have been freed, or
try to resubmit from the stale endpoint.
This was observed as a KASAN slab-use-after-free in
input_urb_complete().
The buggy scenario involves two paths, with each column showing the order
within that path:
probe error path: USB completion path:
1. start_input_streams() submits 1. The HCD still owns a
input URBs. submitted input URB.
2. A later setup helper returns 2. input_urb_complete() runs
an error. with urb->context in ep.
3. snd_usb_midi_v2_free() frees 3. The completion reads ep
endpoint storage and URB buffers. state and can requeue URBs.
Make the endpoint destructor follow the same teardown ordering used for
disconnect when the endpoint has not already been disconnected: publish
ep->disconnected, kill the URBs synchronously, and drain the endpoint
before freeing URB buffers and endpoint storage. The guard avoids
repeating the stop sequence after the normal
snd_usb_midi_v2_disconnect_all() path, while still synchronizing the
direct MIDI 2.0 create-error free path.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in input_urb_complete+0x37/0x1b0
Workqueue: usb_hub_wq hub_event
RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50
Read of size 8
Call trace:
dump_stack_lvl+0x77/0xb0
print_report+0xce/0x5f0
input_urb_complete+0x37/0x1b0 (sound/usb/midi2.c:186)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
__usb_hcd_giveback_urb+0x112/0x1d0
dummy_timer+0xaaa/0x19a0
lock_is_held_type+0x9a/0x110
__lock_acquire+0x467/0x28b0
mark_held_locks+0x40/0x70
_raw_spin_unlock_irqrestore+0x44/0x60
lockdep_hardirqs_on_prepare+0xbb/0x1a0
__hrtimer_run_queues+0x101/0x520
hrtimer_run_softirq+0xd0/0x130
handle_softirqs+0x15b/0x670
__irq_exit_rcu+0xd0/0x170
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
Fixes: d9c99876868c ("ALSA: usb-audio: Create UMP blocks from USB MIDI GTBs")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Link: https://patch.msgid.link/20260618170010.191433-1-zzzccc427@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/midi2.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sound/usb/midi2.c b/sound/usb/midi2.c
index 42a82aad8a3be8..925399e2cbbc07 100644
--- a/sound/usb/midi2.c
+++ b/sound/usb/midi2.c
@@ -478,6 +478,11 @@ static int create_midi2_endpoint(struct snd_usb_midi2_interface *umidi,
static void free_midi2_endpoint(struct snd_usb_midi2_endpoint *ep)
{
list_del(&ep->list);
+ if (!ep->disconnected) {
+ ep->disconnected = 1;
+ kill_midi_urbs(ep, false);
+ drain_urb_queue(ep);
+ }
free_midi_urbs(ep);
kfree(ep);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0734/1266] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (732 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0733/1266] ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0735/1266] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
` (264 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Breno Leitao, Will Deacon,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 4cc70f75853bebac022334b6a86b953348072f74 ]
hw_breakpoint_arch_parse() positions the BAS bit pattern in
hw->ctrl.len with
offset = hw->address & alignment_mask; /* 0..7 */
hw->ctrl.len <<= offset;
ctrl.len is an 8-bit bitfield (struct arch_hw_breakpoint_ctrl::len is
u32 :8), so the shift silently drops any bits past bit 7. For
non-compat AArch64 watchpoints the offset is unbounded relative to
ctrl.len: a perf_event_open(PERF_TYPE_BREAKPOINT) caller asking for
HW_BREAKPOINT_W with bp_addr=page+1 and bp_len=HW_BREAKPOINT_LEN_8
ends up with 0xff << 1 = 0x1fe, stored as 0xfe. The kernel programs
WCR.BAS=0xfe and the hardware watches bytes [1..7] instead of the
requested [1..8] -- the eighth byte is silently dropped. The
syscall still returns success, leaving userspace to discover the
gap by empirical probing.
The same class affects HW_BREAKPOINT_LEN_{2,4} when offset pushes the
high BAS bit past bit 7 (e.g. LEN_4 with offset=5 yields 0xe0
instead of 0x1e0). No memory-safety impact -- the value is masked
into 8 bits before encoding -- but debuggers and perf users observe
missed events on bytes they thought they were watching.
The AArch32 branch immediately above already rejects unrepresentable
(offset, len) combinations via an explicit switch. Mirror that for
the non-compat branch by checking that the shifted pattern fits in
the BAS field, returning -EINVAL when it does not.
GDB and similar debuggers are unaffected by the stricter check.
aarch64_linux_set_debug_regs() already treats EINVAL on
NT_ARM_HW_WATCH as a downgrade signal: it clears
kernel_supports_any_contiguous_range, calls aarch64_downgrade_regs()
to round the BAS up to a legacy 0x01/03/0f/ff mask with an aligned
base, and retries -- the same fallback path that PR-20207 introduced.
The new -EINVAL is therefore reachable only from a raw
perf_event_open() that pairs an unaligned base with an oversized
bp_len, which is precisely the bug.
Reproducer:
struct perf_event_attr a = {
.type = PERF_TYPE_BREAKPOINT, .size = sizeof(a),
.bp_type = HW_BREAKPOINT_W,
.bp_addr = (uintptr_t)(buf + 1),
.bp_len = HW_BREAKPOINT_LEN_8,
.exclude_kernel = 1, .exclude_hv = 1,
};
int fd = perf_event_open(&a, 0, -1, -1, 0);
/* before this fix: succeeds, watches 7 bytes (buf+1..buf+7) */
/* after this fix: fails with EINVAL */
Fixes: b08fb180bb88 ("arm64: Allow hw watchpoint at varied offset from base address")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/hw_breakpoint.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index 35225632d70ad3..c94dcffb7e83d0 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -557,6 +557,15 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
else
alignment_mask = 0x7;
offset = hw->address & alignment_mask;
+
+ /*
+ * BAS is an 8-bit field in WCR/BCR; the shift below would
+ * silently drop the high bits of ctrl.len when offset + len
+ * exceeds 8, programming hardware to watch fewer bytes than
+ * the user requested.
+ */
+ if (((u32)hw->ctrl.len << offset) > ARM_BREAKPOINT_LEN_8)
+ return -EINVAL;
}
hw->address &= ~alignment_mask;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0735/1266] thermal: intel: Fix dangling resources on thermal_throttle_online() failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (733 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0734/1266] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0736/1266] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
` (263 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Neri, Rafael J. Wysocki,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit b91d287fa7a1ba0727eed5823c6ee4924ee5fa31 ]
The function thermal_throttle_add_dev() may fail and abort a CPU hotplug
online operation. Since the failure occurs within the online callback,
thermal_throttle_online(), the CPU hotplug framework does not invoke the
corresponding offline callback. As a result, the hardware and software
resources set up during the failed operation are not torn down.
Since only thermal_throttle_add_dev() can fail, call it before setting up
the rest of the resources.
Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle")
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20260613-rneri-directed-therm-intr-v3-1-3a26d1e47fc8@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/therm_throt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/therm_throt.c b/drivers/thermal/intel/therm_throt.c
index e69868e868eb9e..dfdc8c1b0eb5d3 100644
--- a/drivers/thermal/intel/therm_throt.c
+++ b/drivers/thermal/intel/therm_throt.c
@@ -528,8 +528,13 @@ static int thermal_throttle_online(unsigned int cpu)
{
struct thermal_state *state = &per_cpu(thermal_state, cpu);
struct device *dev = get_cpu_device(cpu);
+ int err;
u32 l;
+ err = thermal_throttle_add_dev(dev, cpu);
+ if (err)
+ return err;
+
state->package_throttle.level = PACKAGE_LEVEL;
state->core_throttle.level = CORE_LEVEL;
@@ -547,7 +552,7 @@ static int thermal_throttle_online(unsigned int cpu)
l = apic_read(APIC_LVTTHMR);
apic_write(APIC_LVTTHMR, l & ~APIC_LVT_MASKED);
- return thermal_throttle_add_dev(dev, cpu);
+ return err;
}
static int thermal_throttle_offline(unsigned int cpu)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0736/1266] ACPI: resource: Amend kernel-doc style
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (734 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0735/1266] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0737/1266] ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() Greg Kroah-Hartman
` (262 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Rafael J. Wysocki,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 78ad5c7722b7bed9d35ffc5b45eb0f12e2c22fee ]
The functions are referred as func() in the kernel-doc. The % (percent)
character makes the rendering for constants as described in the respective
documentation. Amend all these.
Fixes: 8e345c991c8c ("ACPI: Centralized processing of ACPI device resources")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260617090555.2648709-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 531684a69c645d..672ccad447ccda 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -839,7 +839,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
EXPORT_SYMBOL_GPL(acpi_dev_resource_interrupt);
/**
- * acpi_dev_free_resource_list - Free resource from %acpi_dev_get_resources().
+ * acpi_dev_free_resource_list - Free resource from acpi_dev_get_resources().
* @list: The head of the resource list to free.
*/
void acpi_dev_free_resource_list(struct list_head *list)
@@ -959,7 +959,7 @@ static int __acpi_dev_get_resources(struct acpi_device *adev,
*
* The resultant struct resource objects are put on the list pointed to by
* @list, that must be empty initially, as members of struct resource_entry
- * objects. Callers of this routine should use %acpi_dev_free_resource_list() to
+ * objects. Callers of this routine should use acpi_dev_free_resource_list() to
* free that list.
*
* The number of resources in the output list is returned on success, an error
@@ -1000,7 +1000,7 @@ static int is_memory(struct acpi_resource *ares, void *not_used)
* The resultant struct resource objects are put on the list pointed to
* by @list, that must be empty initially, as members of struct
* resource_entry objects. Callers of this routine should use
- * %acpi_dev_free_resource_list() to free that list.
+ * acpi_dev_free_resource_list() to free that list.
*
* The number of resources in the output list is returned on success,
* an error code reflecting the error condition is returned otherwise.
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0737/1266] ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (735 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0736/1266] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0738/1266] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
` (261 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Rafael J. Wysocki,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
[ Upstream commit 71b57aca295d61276a60e131d8f62b0cc7cf1a35 ]
Before commit a1a69b297e47 ("ACPI / IPMI: Fix race caused by the
unprotected ACPI IPMI user"), ipmi_bmc_gone() skipped entries whose
interface number did not match the SMI being removed, then killed the
matching entry:
if (ipmi_device->ipmi_ifnum != iface)
continue;
__ipmi_dev_kill(ipmi_device);
That commit folded the removal block into the existing non-match test
while converting the object lifetime handling, but left the comparison
unchanged. The old != meant "continue past this entry"; after the
refactor it meant "kill this entry".
As a result, a single ACPI IPMI interface is never removed when its SMI
disappears. If multiple interfaces are tracked, the first interface
whose number differs from iface is removed instead, while the interface
that actually disappeared remains on driver_data.ipmi_devices. The
stale entry is not marked dead and can continue to be selected for ACPI
IPMI transactions. It can also prevent the same ACPI handle from being
registered again.
Change the comparison to == so ipmi_bmc_gone() removes exactly the
interface reported as gone by the SMI watcher. This restores the
pre-a1a69b297e47 behavior and is the correct interface matching logic.
Fixes: a1a69b297e47 ("ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI user")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/B486593E06E6F6E0+20260616093621.1039943-1-raoxu@uniontech.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_ipmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index 148d9486106cad..acecb7f86fd976 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -485,7 +485,7 @@ static void ipmi_bmc_gone(int iface)
mutex_lock(&driver_data.ipmi_lock);
list_for_each_entry_safe(iter, temp,
&driver_data.ipmi_devices, head) {
- if (iter->ipmi_ifnum != iface) {
+ if (iter->ipmi_ifnum == iface) {
ipmi_device = iter;
__ipmi_dev_kill(iter);
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0738/1266] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (736 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0737/1266] ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0739/1266] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
` (260 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Ivan Abramov,
Stefan Schmidt, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit e69ed6fc9fb3b386b5fcdb9f51623f122cee2ebd ]
There's no need to call WARN_ON() in cfg802154_pernet_exit(), since
every point of failure in cfg802154_switch_netns() is covered with
WARN_ON(), so remove it.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 66e5c2672cd1 ("ieee802154: add netns support")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://lore.kernel.org/20250403101935.991385-4-i.abramov@mt-integration.ru
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ieee802154/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ieee802154/core.c b/net/ieee802154/core.c
index 57546e07e06ade..cdf4b41c54b2b1 100644
--- a/net/ieee802154/core.c
+++ b/net/ieee802154/core.c
@@ -327,7 +327,7 @@ static void __net_exit cfg802154_pernet_exit(struct net *net)
rtnl_lock();
list_for_each_entry(rdev, &cfg802154_rdev_list, list) {
if (net_eq(wpan_phy_net(&rdev->wpan_phy), net))
- WARN_ON(cfg802154_switch_netns(rdev, &init_net));
+ cfg802154_switch_netns(rdev, &init_net);
}
rtnl_unlock();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0739/1266] ieee802154: fix kernel-infoleak in dgram_recvmsg()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (737 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0738/1266] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0740/1266] md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry Greg Kroah-Hartman
` (259 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+346474e3bf0b26bd3090,
Aleksandr Nogikh, Miquel Raynal, Stefan Schmidt, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
[ Upstream commit 4db86f8ab11b5a41bfc36680be837e6ac1375ec6 ]
KMSAN reported a kernel-infoleak in move_addr_to_user():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:131 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user
include/linux/uaccess.h:205 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120
lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:131 [inline]
_inline_copy_to_user include/linux/uaccess.h:205 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:236 [inline]
move_addr_to_user+0x2e7/0x440 net/socket.c:302
____sys_recvmsg+0x232/0x610 net/socket.c:2925
...
Uninit was stored to memory at:
ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline]
dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739
The issue occurs because the `pan_id` field of `struct ieee802154_addr`
is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`.
The execution flow is as follows:
1. `__ieee802154_rx_handle_packet()` declares a local `struct
ieee802154_hdr hdr` on the stack.
2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse
the source and destination addresses into this structure.
3. If the address mode is `IEEE802154_ADDR_NONE`,
`ieee802154_hdr_get_addr()` previously only set the `mode` field,
leaving the `pan_id` field containing uninitialized stack memory.
4. This uninitialized `pan_id` is later copied into a `struct
sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`.
5. Finally, `move_addr_to_user()` copies the socket address structure to
user space, leaking the uninitialized bytes.
Fix this by using `memset` to zero out the address structure in
`ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.
Fixes: 94b4f6c21cf5 ("ieee802154: add header structs with endiannes and operations")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+346474e3bf0b26bd3090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=346474e3bf0b26bd3090
Link: https://syzkaller.appspot.com/ai_job?id=a507a109-d683-4a2c-bc03-93394f491b17
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/62795fd9-fc0c-48eb-bb82-05ffc5a57104@mail.kernel.org
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--git a/net/ieee802154/header_ops.c b/net/ieee802154/header_ops.c
index 41a556be101790..a9f0c8df5ae4ac 100644
--- a/net/ieee802154/header_ops.c
+++ b/net/ieee802154/header_ops.c
@@ -173,10 +173,13 @@ ieee802154_hdr_get_addr(const u8 *buf, int mode, bool omit_pan,
{
int pos = 0;
- addr->mode = mode;
-
- if (mode == IEEE802154_ADDR_NONE)
+ if (mode == IEEE802154_ADDR_NONE) {
+ memset(addr, 0, sizeof(*addr));
+ addr->mode = IEEE802154_ADDR_NONE;
return 0;
+ }
+
+ addr->mode = mode;
if (!omit_pan) {
memcpy(&addr->pan_id, buf + pos, 2);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0740/1266] md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (738 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0739/1266] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0741/1266] netfilter: ipset: Fix data race between add and dump in all hash types Greg Kroah-Hartman
` (258 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Abd-Alrhman Masalkhi,
Yu Kuai, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
[ Upstream commit 69ad6ce47f9bf2b9fe0ed69b042db993d33bbf12 ]
When a read is retried, raid1_read_request() may be called with a
pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT
read, the bio is completed and the function returns immediately. In this
case the existing r1_bio is leaked.
This fixes a leak of pre-allocated r1_bio structures for retried reads.
Fixes: 5aa705039c4f ("md: raid1 add nowait support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260611083514.754922-1-abd.masalkhi@gmail.com?part=1
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Link: https://patch.msgid.link/20260611101350.759154-1-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid1.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 259cc8a97348bf..836123f2929a58 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1245,6 +1245,12 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio,
if (!wait_read_barrier(conf, bio->bi_iter.bi_sector,
bio->bi_opf & REQ_NOWAIT)) {
bio_wouldblock_error(bio);
+
+ if (r1bio_existed) {
+ set_bit(R1BIO_Returned, &r1_bio->state);
+ raid_end_bio_io(r1_bio);
+ }
+
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0741/1266] netfilter: ipset: Fix data race between add and dump in all hash types
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (739 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0740/1266] md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0742/1266] netfilter: ipset: annotate "pos" for concurrent readers/writers Greg Kroah-Hartman
` (257 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+786c889f046e8b003ca6,
syzbot+1da17e4b41d795df059e, syzbot+421c5f3ff8e9493084d9,
Jozsef Kadlecsik, Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@netfilter.org>
[ Upstream commit 2358f7427ccd6ec8867a48205d8fcec973683a3f ]
When adding a new entry to the next position in the existing hash bucket,
the position index was incremented too early and parallel dump could
read it before the entry was populated with the value. Move the setting
of the position index after populating the entry.
v2: Position counting fixed, noticed by Florian Westphal.
Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types")
Reported-by: syzbot+786c889f046e8b003ca6@syzkaller.appspotmail.com
Reported-by: syzbot+1da17e4b41d795df059e@syzkaller.appspotmail.com
Reported-by: syzbot+421c5f3ff8e9493084d9@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: e4b4984e28c1 ("netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 9da9420703216b..a41b50489e227e 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -843,7 +843,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
const struct mtype_elem *d = value;
struct mtype_elem *data;
struct hbucket *n, *old = ERR_PTR(-ENOENT);
- int i, j = -1, ret;
+ int i, j = -1, npos = 0, ret;
bool flag_exist = flags & IPSET_FLAG_EXIST;
bool deleted = false, forceadd = false, reuse = false;
u32 r, key, multi = 0, elements, maxelem;
@@ -888,6 +888,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
ext_size(AHASH_INIT_SIZE, set->dsize);
goto copy_elem;
}
+ npos = n->pos;
for (i = 0; i < n->pos; i++) {
if (!test_bit(i, n->used)) {
/* Reuse first deleted entry */
@@ -961,7 +962,8 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
}
copy_elem:
- j = n->pos++;
+ j = npos;
+ npos = n->pos + 1;
data = ahash_data(n, j, set->dsize);
copy_data:
t->hregion[r].elements++;
@@ -984,6 +986,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
if (SET_WITH_TIMEOUT(set))
ip_set_timeout_set(ext_timeout(data, set), ext->timeout);
smp_mb__before_atomic();
+ n->pos = npos;
set_bit(j, n->used);
if (old != ERR_PTR(-ENOENT)) {
rcu_assign_pointer(hbucket(t, key), n);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0742/1266] netfilter: ipset: annotate "pos" for concurrent readers/writers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (740 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0741/1266] netfilter: ipset: Fix data race between add and dump in all hash types Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0743/1266] netfilter: ipset: Dont use test_bit() in lockless RCU readers in hash types Greg Kroah-Hartman
` (256 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jozsef Kadlecsik, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@netfilter.org>
[ Upstream commit 7f7445840b7771338618930e45ee641104b38ed8 ]
The "pos" structure member of struct hbucket stores the first
free slot in the hash bucket of a hash type of set and there
are concurrent readers/writers. Annotate accesses properly.
Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: e4b4984e28c1 ("netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 62 ++++++++++++++++-----------
1 file changed, 38 insertions(+), 24 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index a41b50489e227e..3ed883b4be54b4 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -385,8 +385,9 @@ static void
mtype_ext_cleanup(struct ip_set *set, struct hbucket *n)
{
int i;
+ u8 pos = smp_load_acquire(&n->pos);
- for (i = 0; i < n->pos; i++)
+ for (i = 0; i < pos; i++)
if (test_bit(i, n->used))
ip_set_ext_destroy(set, ahash_data(n, i, set->dsize));
}
@@ -489,7 +490,7 @@ mtype_gc_do(struct ip_set *set, struct htype *h, struct htable *t, u32 r)
#ifdef IP_SET_HASH_WITH_NETS
u8 k;
#endif
- u8 htable_bits = t->htable_bits;
+ u8 pos, htable_bits = t->htable_bits;
spin_lock_bh(&t->hregion[r].lock);
for (i = ahash_bucket_start(r, htable_bits);
@@ -497,7 +498,8 @@ mtype_gc_do(struct ip_set *set, struct htype *h, struct htable *t, u32 r)
n = __ipset_dereference(hbucket(t, i));
if (!n)
continue;
- for (j = 0, d = 0; j < n->pos; j++) {
+ pos = smp_load_acquire(&n->pos);
+ for (j = 0, d = 0; j < pos; j++) {
if (!test_bit(j, n->used)) {
d++;
continue;
@@ -533,7 +535,7 @@ mtype_gc_do(struct ip_set *set, struct htype *h, struct htable *t, u32 r)
/* Still try to delete expired elements. */
continue;
tmp->size = n->size - AHASH_INIT_SIZE;
- for (j = 0, d = 0; j < n->pos; j++) {
+ for (j = 0, d = 0; j < pos; j++) {
if (!test_bit(j, n->used))
continue;
data = ahash_data(n, j, dsize);
@@ -622,7 +624,7 @@ mtype_resize(struct ip_set *set, bool retried)
{
struct htype *h = set->data;
struct htable *t, *orig;
- u8 htable_bits;
+ u8 pos, htable_bits;
size_t hsize, dsize = set->dsize;
#ifdef IP_SET_HASH_WITH_NETS
u8 flags;
@@ -684,7 +686,8 @@ mtype_resize(struct ip_set *set, bool retried)
n = __ipset_dereference(hbucket(orig, i));
if (!n)
continue;
- for (j = 0; j < n->pos; j++) {
+ pos = smp_load_acquire(&n->pos);
+ for (j = 0; j < pos; j++) {
if (!test_bit(j, n->used))
continue;
data = ahash_data(n, j, dsize);
@@ -808,9 +811,10 @@ mtype_ext_size(struct ip_set *set, u32 *elements, size_t *ext_size)
{
struct htype *h = set->data;
const struct htable *t;
- u32 i, j, r;
struct hbucket *n;
struct mtype_elem *data;
+ u32 i, j, r;
+ u8 pos;
t = rcu_dereference_bh(h->table);
for (r = 0; r < ahash_numof_locks(t->htable_bits); r++) {
@@ -819,7 +823,8 @@ mtype_ext_size(struct ip_set *set, u32 *elements, size_t *ext_size)
n = rcu_dereference_bh(hbucket(t, i));
if (!n)
continue;
- for (j = 0; j < n->pos; j++) {
+ pos = smp_load_acquire(&n->pos);
+ for (j = 0; j < pos; j++) {
if (!test_bit(j, n->used))
continue;
data = ahash_data(n, j, set->dsize);
@@ -843,10 +848,11 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
const struct mtype_elem *d = value;
struct mtype_elem *data;
struct hbucket *n, *old = ERR_PTR(-ENOENT);
- int i, j = -1, npos = 0, ret;
+ int i, j = -1, ret;
bool flag_exist = flags & IPSET_FLAG_EXIST;
bool deleted = false, forceadd = false, reuse = false;
u32 r, key, multi = 0, elements, maxelem;
+ u8 npos = 0;
rcu_read_lock_bh();
t = rcu_dereference_bh(h->table);
@@ -888,8 +894,8 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
ext_size(AHASH_INIT_SIZE, set->dsize);
goto copy_elem;
}
- npos = n->pos;
- for (i = 0; i < n->pos; i++) {
+ npos = smp_load_acquire(&n->pos);
+ for (i = 0; i < npos; i++) {
if (!test_bit(i, n->used)) {
/* Reuse first deleted entry */
if (j == -1) {
@@ -933,7 +939,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
if (elements >= maxelem)
goto set_full;
/* Create a new slot */
- if (n->pos >= n->size) {
+ if (npos >= n->size) {
#ifdef IP_SET_HASH_WITH_MULTI
if (h->bucketsize >= AHASH_MAX_TUNED)
goto set_full;
@@ -962,8 +968,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
}
copy_elem:
- j = npos;
- npos = n->pos + 1;
+ j = npos++;
data = ahash_data(n, j, set->dsize);
copy_data:
t->hregion[r].elements++;
@@ -986,7 +991,8 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
if (SET_WITH_TIMEOUT(set))
ip_set_timeout_set(ext_timeout(data, set), ext->timeout);
smp_mb__before_atomic();
- n->pos = npos;
+ /* Ensure all data writes are visible before updating position */
+ smp_store_release(&n->pos, npos);
set_bit(j, n->used);
if (old != ERR_PTR(-ENOENT)) {
rcu_assign_pointer(hbucket(t, key), n);
@@ -1045,6 +1051,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
int i, j, k, r, ret = -IPSET_ERR_EXIST;
u32 key, multi = 0;
size_t dsize = set->dsize;
+ u8 pos;
/* Userspace add and resize is excluded by the mutex.
* Kernespace add does not trigger resize.
@@ -1060,7 +1067,8 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
n = rcu_dereference_bh(hbucket(t, key));
if (!n)
goto out;
- for (i = 0, k = 0; i < n->pos; i++) {
+ pos = smp_load_acquire(&n->pos);
+ for (i = 0, k = 0; i < pos; i++) {
if (!test_bit(i, n->used)) {
k++;
continue;
@@ -1074,8 +1082,8 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
ret = 0;
clear_bit(i, n->used);
smp_mb__after_atomic();
- if (i + 1 == n->pos)
- n->pos--;
+ if (i + 1 == pos)
+ smp_store_release(&n->pos, --pos);
t->hregion[r].elements--;
#ifdef IP_SET_HASH_WITH_NETS
for (j = 0; j < IPSET_NET_COUNT; j++)
@@ -1097,11 +1105,11 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
x->flags = flags;
}
}
- for (; i < n->pos; i++) {
+ for (; i < pos; i++) {
if (!test_bit(i, n->used))
k++;
}
- if (k == n->pos) {
+ if (k == pos) {
t->hregion[r].ext_size -= ext_size(n->size, dsize);
rcu_assign_pointer(hbucket(t, key), NULL);
kfree_rcu(n, rcu);
@@ -1112,7 +1120,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
if (!tmp)
goto out;
tmp->size = n->size - AHASH_INIT_SIZE;
- for (j = 0, k = 0; j < n->pos; j++) {
+ for (j = 0, k = 0; j < pos; j++) {
if (!test_bit(j, n->used))
continue;
data = ahash_data(n, j, dsize);
@@ -1173,6 +1181,7 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,
int ret, i, j = 0;
#endif
u32 key, multi = 0;
+ u8 pos;
pr_debug("test by nets\n");
for (; j < NLEN && h->nets[j].cidr[0] && !multi; j++) {
@@ -1190,7 +1199,8 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,
n = rcu_dereference_bh(hbucket(t, key));
if (!n)
continue;
- for (i = 0; i < n->pos; i++) {
+ pos = smp_load_acquire(&n->pos);
+ for (i = 0; i < pos; i++) {
if (!test_bit(i, n->used))
continue;
data = ahash_data(n, i, set->dsize);
@@ -1224,6 +1234,7 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext,
struct mtype_elem *data;
int i, ret = 0;
u32 key, multi = 0;
+ u8 pos;
rcu_read_lock_bh();
t = rcu_dereference_bh(h->table);
@@ -1246,7 +1257,8 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext,
ret = 0;
goto out;
}
- for (i = 0; i < n->pos; i++) {
+ pos = smp_load_acquire(&n->pos);
+ for (i = 0; i < pos; i++) {
if (!test_bit(i, n->used))
continue;
data = ahash_data(n, i, set->dsize);
@@ -1363,6 +1375,7 @@ mtype_list(const struct ip_set *set,
/* We assume that one hash bucket fills into one page */
void *incomplete;
int i, ret = 0;
+ u8 pos;
atd = nla_nest_start(skb, IPSET_ATTR_ADT);
if (!atd)
@@ -1381,7 +1394,8 @@ mtype_list(const struct ip_set *set,
cb->args[IPSET_CB_ARG0], t, n);
if (!n)
continue;
- for (i = 0; i < n->pos; i++) {
+ pos = smp_load_acquire(&n->pos);
+ for (i = 0; i < pos; i++) {
if (!test_bit(i, n->used))
continue;
e = ahash_data(n, i, set->dsize);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0743/1266] netfilter: ipset: Dont use test_bit() in lockless RCU readers in hash types
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (741 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0742/1266] netfilter: ipset: annotate "pos" for concurrent readers/writers Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0744/1266] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
` (255 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jozsef Kadlecsik, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@netfilter.org>
[ Upstream commit e4b4984e28c16406ecb318444dea4a8bf47def3e ]
Sashiko pointed out that there are a few lockless RCU readers
using test_bit() which is a relaxed atomic operation and
provides no memory barrier guarantees. Use test_bit_acquire()
instead where the operation may run parallel with add/del/gc,
i.e. is not one from the next cases
- protected by region lock
- in a set destroy phase
- in a new/temporary set creation phase
Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 3ed883b4be54b4..ad2ff9cc0b58d9 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -688,7 +688,7 @@ mtype_resize(struct ip_set *set, bool retried)
continue;
pos = smp_load_acquire(&n->pos);
for (j = 0; j < pos; j++) {
- if (!test_bit(j, n->used))
+ if (!test_bit_acquire(j, n->used))
continue;
data = ahash_data(n, j, dsize);
if (SET_ELEM_EXPIRED(set, data))
@@ -825,7 +825,7 @@ mtype_ext_size(struct ip_set *set, u32 *elements, size_t *ext_size)
continue;
pos = smp_load_acquire(&n->pos);
for (j = 0; j < pos; j++) {
- if (!test_bit(j, n->used))
+ if (!test_bit_acquire(j, n->used))
continue;
data = ahash_data(n, j, set->dsize);
if (!SET_ELEM_EXPIRED(set, data))
@@ -1201,7 +1201,7 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,
continue;
pos = smp_load_acquire(&n->pos);
for (i = 0; i < pos; i++) {
- if (!test_bit(i, n->used))
+ if (!test_bit_acquire(i, n->used))
continue;
data = ahash_data(n, i, set->dsize);
if (!mtype_data_equal(data, d, &multi))
@@ -1259,7 +1259,7 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext,
}
pos = smp_load_acquire(&n->pos);
for (i = 0; i < pos; i++) {
- if (!test_bit(i, n->used))
+ if (!test_bit_acquire(i, n->used))
continue;
data = ahash_data(n, i, set->dsize);
if (!mtype_data_equal(data, d, &multi))
@@ -1396,7 +1396,7 @@ mtype_list(const struct ip_set *set,
continue;
pos = smp_load_acquire(&n->pos);
for (i = 0; i < pos; i++) {
- if (!test_bit(i, n->used))
+ if (!test_bit_acquire(i, n->used))
continue;
e = ahash_data(n, i, set->dsize);
if (SET_ELEM_EXPIRED(set, e))
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0744/1266] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (742 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0743/1266] netfilter: ipset: Dont use test_bit() in lockless RCU readers in hash types Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0745/1266] netfilter: nf_reject: skip iphdr options when looking for icmp header Greg Kroah-Hartman
` (254 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jozsef Kadlecsik, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@netfilter.org>
[ Upstream commit 3ca9982a8882470aa0ac4e8bb9a552b181d1efcd ]
Sashiko pointed out that kfree_rcu() was called before
rcu_assign_pointer() in handling the comment extension.
Fix the order so that rcu_assign_pointer() called first.
Fixes: b57b2d1fa53f ("netfilter: ipset: Prepare the ipset core to use RCU at set level")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 94157104d85a95..f51a1af31513cd 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -351,8 +351,8 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
if (unlikely(c)) {
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
- kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
+ kfree_rcu(c, rcu);
}
if (!len)
return;
@@ -393,8 +393,8 @@ ip_set_comment_free(struct ip_set *set, void *ptr)
if (unlikely(!c))
return;
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
- kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
+ kfree_rcu(c, rcu);
}
typedef void (*destroyer)(struct ip_set *, void *);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0745/1266] netfilter: nf_reject: skip iphdr options when looking for icmp header
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (743 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0744/1266] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0746/1266] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
` (253 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit af8d6ae09c0a5f8b8a0d5680203c74b3c1daa85b ]
Not a big deal but this hould have used the real ip header length and not the
base header size. As-is, if there are options then
nf_skb_is_icmp_unreach() result will be random.
Fixes: db99b2f2b3e2 ("netfilter: nf_reject: don't reply to icmp error messages")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/netfilter/nf_reject_ipv4.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 2064b401304129..1632cedcd348ca 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -80,7 +80,7 @@ static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
if (iph->protocol != IPPROTO_ICMP)
return false;
- thoff = skb_network_offset(skb) + sizeof(*iph);
+ thoff = skb_network_offset(skb) + ip_hdrlen(skb);
tp = skb_header_pointer(skb,
thoff + offsetof(struct icmphdr, type),
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0746/1266] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (744 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0745/1266] netfilter: nf_reject: skip iphdr options when looking for icmp header Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0747/1266] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
` (252 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 27dd2997746d54ebc079bb13161cc1bdd401d4a6 ]
This needs to test for nonzero retval.
Fixes: c54c7c685494 ("netfilter: nft_meta_bridge: add NFT_META_BRI_IIFPVID support")
Closes: https://sashiko.dev/#/patchset/20260618061631.21919-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/netfilter/nft_meta_bridge.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index d12a221366d60c..475d7d1709b9fb 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -44,7 +44,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
if (!br_dev || !br_vlan_enabled(br_dev))
goto err;
- br_vlan_get_pvid_rcu(in, &p_pvid);
+ if (br_vlan_get_pvid_rcu(in, &p_pvid))
+ goto err;
+
nft_reg_store16(dest, p_pvid);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0747/1266] irqchip/crossbar: Fix parent domain resource leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (745 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0746/1266] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0748/1266] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
` (251 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bhargav Joshi, Thomas Gleixner,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhargav Joshi <j.bhargav.u@gmail.com>
[ Upstream commit a1074dd62faa6572921d387e8a21589ccea00efc ]
irq_domain_alloc_irqs_parent() is called in allocate_gic_irq() but
irq_domain_free_irqs_parent() is never called which causes a resource leak.
Fix this by calling irq_domain_free_irqs_parent() in
crossbar_domain_free().
Fixes: 783d31863fb82 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains")
Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260620-irq-crossbar-fix-v2-2-b8e8499f468a@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-crossbar.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index a05a7501e10790..729492772ff46e 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -163,6 +163,7 @@ static void crossbar_domain_free(struct irq_domain *domain, unsigned int virq,
cb->write(d->hwirq, cb->safe_map);
}
raw_spin_unlock(&cb->lock);
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
}
static int crossbar_domain_translate(struct irq_domain *d,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0748/1266] selftests/mm: clarify alternate unmapping in compaction_test
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (746 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0747/1266] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0749/1266] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
` (250 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sayali Patil, Venkat Rao Bagalkote,
David Hildenbrand (Arm), Dev Jain, Liam Howlett, Miaohe Lin,
Michal Hocko, Oscar Salvador, Ritesh Harjani (IBM), Shuah Khan,
Zi Yan, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 69ba1d76d93ab818245333cf400928477ba72053 ]
Add a comment explaining that every other entry in the list is unmapped to
intentionally create fragmentation with locked pages before invoking
check_compaction().
Link: https://lore.kernel.org/da5e0a8d5152e54152c0d2f456aac2fac35af291.1779296493.git.sayalip@linux.ibm.com
Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory")
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/compaction_test.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/testing/selftests/mm/compaction_test.c b/tools/testing/selftests/mm/compaction_test.c
index 38fec412206b9a..e74622e023cadf 100644
--- a/tools/testing/selftests/mm/compaction_test.c
+++ b/tools/testing/selftests/mm/compaction_test.c
@@ -234,6 +234,9 @@ int main(int argc, char **argv)
mem_fragmentable_MB -= MAP_SIZE_MB;
}
+ /* Unmap every other entry in the list to create fragmentation with
+ * locked pages before invoking check_compaction().
+ */
for (entry = list; entry != NULL; entry = entry->next) {
munmap(entry->map, MAP_SIZE);
if (!entry->next)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0749/1266] selftests/mm: allow PUD-level entries in compound testcase of hmm tests
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (747 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0748/1266] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0750/1266] selftests/mm: fix exclusive_cow test fork() handling Greg Kroah-Hartman
` (249 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sayali Patil, Aboorva Devarajan,
Alex Sierra, Alistair Popple, Balbir Singh, David Hildenbrand,
Jason Gunthorpe, Leon Romanovsky, Liam R. Howlett,
Lorenzo Stoakes, Matthew Brost, Matthew Wilcox (Oracle),
Michal Hocko, Mike Rapoport, Ralph Campbell, Shuah Khan,
Suren Baghdasaryan, Vlastimil Babka, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 224ed0e019b122d08580362abe57574a78f2b5fa ]
Patch series "selftests/mm: assorted fixes for hmm-tests", v3.
This series fixes a few issues in hmm-tests that show up when page-size
and huge-page configuration differ from the hardcoded assumptions the
tests were written for (PMD/THP sizing, default hugepage size, and related
cases).
It also includes a fix to exclusive_cow: the test ignored the return value
of fork(), so both parent and child ran the same teardown path.
This patch (of 3):
The HMM compound testcase currently assumes only PMD-level mappings and
fails on systems where default_hugepagesz=1G is set, because the region is
then reported by the device at PUD level.
Determine the mapping level (PMD or PUD) the device reports for the first
page of the range and require every page to match that level exactly via
ASSERT_EQ(). This accepts PUD-level mappings while preserving the
expected/observed protection values printed on failure, and rejects a
fragmented mapping that mixes PMD- and PUD-level entries within the same
range (which a per-page OR check would have let pass).
Link: https://lore.kernel.org/20260611034102.1030738-1-aboorvad@linux.ibm.com
Link: https://lore.kernel.org/20260611034102.1030738-2-aboorvad@linux.ibm.com
Fixes: e478425bec93 ("mm/hmm: add tests for hmm_pfn_to_map_order()")
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Co-developed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Alex Sierra <alex.sierra@amd.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/hmm-tests.c | 32 +++++++++++++++++++-------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/mm/hmm-tests.c b/tools/testing/selftests/mm/hmm-tests.c
index 69b88e973cee31..243dd421ed3842 100644
--- a/tools/testing/selftests/mm/hmm-tests.c
+++ b/tools/testing/selftests/mm/hmm-tests.c
@@ -1612,8 +1612,8 @@ TEST_F(hmm2, snapshot)
}
/*
- * Test the hmm_range_fault() HMM_PFN_PMD flag for large pages that
- * should be mapped by a large page table entry.
+ * Test the hmm_range_fault() handling of large pages (PMD or PUD)
+ * that should be mapped by a large page table entry.
*/
TEST_F(hmm, compound)
{
@@ -1623,6 +1623,7 @@ TEST_F(hmm, compound)
unsigned long default_hsize;
int *ptr;
unsigned char *m;
+ unsigned char prot;
int ret;
unsigned long i;
@@ -1661,11 +1662,20 @@ TEST_F(hmm, compound)
ASSERT_EQ(ret, 0);
ASSERT_EQ(buffer->cpages, npages);
- /* Check what the device saw. */
+ /*
+ * Check what the device saw. The region is backed by a single huge
+ * page that the device reports either at PMD or at PUD level depending
+ * on the configured default hugepage size. Determine that level from
+ * the first page and require every page in the range to match it
+ * exactly, so that a fragmented mapping mixing levels (or a missing
+ * large-page bit) is still caught and reported with its actual value.
+ */
m = buffer->mirror;
+ prot = HMM_DMIRROR_PROT_WRITE |
+ ((m[0] & HMM_DMIRROR_PROT_PUD) ? HMM_DMIRROR_PROT_PUD :
+ HMM_DMIRROR_PROT_PMD);
for (i = 0; i < npages; ++i)
- ASSERT_EQ(m[i], HMM_DMIRROR_PROT_WRITE |
- HMM_DMIRROR_PROT_PMD);
+ ASSERT_EQ(m[i], prot);
/* Make the region read-only. */
ret = mprotect(buffer->ptr, size, PROT_READ);
@@ -1676,11 +1686,17 @@ TEST_F(hmm, compound)
ASSERT_EQ(ret, 0);
ASSERT_EQ(buffer->cpages, npages);
- /* Check what the device saw. */
+ /*
+ * Check what the device saw after mprotect(PROT_READ). Same
+ * approach as above: determine the mapping level from the first
+ * page and require every page to match it exactly.
+ */
m = buffer->mirror;
+ prot = HMM_DMIRROR_PROT_READ |
+ ((m[0] & HMM_DMIRROR_PROT_PUD) ? HMM_DMIRROR_PROT_PUD :
+ HMM_DMIRROR_PROT_PMD);
for (i = 0; i < npages; ++i)
- ASSERT_EQ(m[i], HMM_DMIRROR_PROT_READ |
- HMM_DMIRROR_PROT_PMD);
+ ASSERT_EQ(m[i], prot);
munmap(buffer->ptr, buffer->size);
buffer->ptr = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0750/1266] selftests/mm: fix exclusive_cow test fork() handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (748 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0749/1266] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0751/1266] net: marvell: prestera: initialize err in prestera_port_sfp_bind Greg Kroah-Hartman
` (248 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan, Alex Sierra,
Alistair Popple, Balbir Singh, David Hildenbrand, Jason Gunthorpe,
Leon Romanovsky, Liam R. Howlett, Lorenzo Stoakes, Matthew Brost,
Matthew Wilcox (Oracle), Michal Hocko, Mike Rapoport,
Ralph Campbell, Sayali Patil, Shuah Khan, Suren Baghdasaryan,
Vlastimil Babka, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit cea5702144615878600d3a39b5d8b3cc34719012 ]
The test ignores the return value of fork(), so both the parent and the
(newly created) child run the COW verification loops and then call
hmm_buffer_free() before returning into the kselftest harness, which
_exit()s each side. This duplicated teardown sequence has been observed
to manifest as a SIGSEGV in the test child, e.g.:
hmm-tests[360141]: segfault (11) at 0 nip 10006964 lr 1000ac3c code 1
in hmm-tests[6964,10000000+30000]
Fix this by adopting the same fork()-then-wait pattern already used by the
nearby anon_write_child / anon_write_child_shared tests in this file: the
child performs the COW verification and then _exit(0)s so it does not run
the test teardown, while the parent independently verifies COW, waits for
the child, and only then frees the buffer.
Link: https://lore.kernel.org/20260611034102.1030738-4-aboorvad@linux.ibm.com
Fixes: b659baea75469 ("mm: selftests for exclusive device memory")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Alex Sierra <alex.sierra@amd.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Sayali Patil <sayalip@linux.ibm.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/hmm-tests.c | 31 +++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/mm/hmm-tests.c b/tools/testing/selftests/mm/hmm-tests.c
index 243dd421ed3842..5286e400ce8bed 100644
--- a/tools/testing/selftests/mm/hmm-tests.c
+++ b/tools/testing/selftests/mm/hmm-tests.c
@@ -1896,6 +1896,8 @@ TEST_F(hmm, exclusive_cow)
unsigned long i;
int *ptr;
int ret;
+ pid_t pid;
+ int status;
npages = ALIGN(HMM_BUFFER_SIZE, self->page_size) >> self->page_shift;
ASSERT_NE(npages, 0);
@@ -1924,14 +1926,37 @@ TEST_F(hmm, exclusive_cow)
ASSERT_EQ(ret, 0);
ASSERT_EQ(buffer->cpages, npages);
- fork();
+ pid = fork();
+ if (pid == -1)
+ ASSERT_EQ(pid, 0);
- /* Fault pages back to system memory and check them. */
+ if (pid == 0) {
+ /*
+ * Child verifies COW independently, then _exit(0)s so it does
+ * not run the test teardown. A failed ASSERT_* here makes the
+ * harness abort() the child, so the parent sees
+ * !WIFEXITED(status) below and fails in turn.
+ */
+ for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i)
+ ASSERT_EQ(ptr[i]++, i);
+
+ for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i)
+ ASSERT_EQ(ptr[i], i + 1);
+
+ _exit(0);
+ }
+
+ /* Parent: also increment to verify COW works for both processes. */
for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i)
ASSERT_EQ(ptr[i]++, i);
for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i)
- ASSERT_EQ(ptr[i], i+1);
+ ASSERT_EQ(ptr[i], i + 1);
+
+ /* Parent: wait for child and then free the buffer. */
+ ASSERT_EQ(waitpid(pid, &status, 0), pid);
+ ASSERT_TRUE(WIFEXITED(status));
+ ASSERT_EQ(WEXITSTATUS(status), 0);
hmm_buffer_free(buffer);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0751/1266] net: marvell: prestera: initialize err in prestera_port_sfp_bind
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (749 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0750/1266] selftests/mm: fix exclusive_cow test fork() handling Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0752/1266] tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Greg Kroah-Hartman
` (247 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Maxime Chevallier,
Elad Nachman, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 62b01f72d93c7bc8fde3b2e5b5f783eca5f53324 ]
prestera_port_sfp_bind() returns err after walking the ports node. If no
child node matches the port's front-panel id, err is never assigned.
Initialize err to 0 because absence of a matching optional port device
tree node is not an error. In that case no phylink is created and port
creation should continue with port->phy_link left NULL. Errors from
malformed matched nodes and phylink_create() still propagate.
Fixes: 52323ef75414 ("net: marvell: prestera: add phylink support")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Acked-by: Elad Nachman <enachman@marvell.com>
Link: https://patch.msgid.link/20260617193228.1653582-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/prestera/prestera_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c
index 4fb886c57cd778..fa35372ded43c8 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c
@@ -372,7 +372,7 @@ static int prestera_port_sfp_bind(struct prestera_port *port)
struct device_node *ports, *node;
struct fwnode_handle *fwnode;
struct phylink *phy_link;
- int err;
+ int err = 0;
if (!sw->np)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0752/1266] tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (750 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0751/1266] net: marvell: prestera: initialize err in prestera_port_sfp_bind Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0753/1266] net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths Greg Kroah-Hartman
` (246 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi, Tung Nguyen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 1579342d71133da7f00daa02c75cebec7372097b ]
bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).
L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:
BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
<IRQ>
tipc_disc_rcv (net/tipc/discover.c:149)
tipc_rcv (net/tipc/node.c:2126)
tipc_udp_recv (net/tipc/udp_media.c:391)
udp_rcv (net/ipv4/udp.c:2643)
ip_local_deliver_finish (net/ipv4/ip_input.c:241)
</IRQ>
Freed by task 181:
kfree (mm/slub.c:6565)
bearer_disable (net/tipc/bearer.c:418)
tipc_nl_bearer_disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.
Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.
Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260617135744.3383175-3-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/core.c | 5 +++++
net/tipc/discover.c | 14 ++++++++++++--
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 434e70eabe0812..1ddecea1df6e91 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -218,6 +218,11 @@ static void __exit tipc_exit(void)
unregister_pernet_device(&tipc_net_ops);
tipc_unregister_sysctl();
+ /* TODO: Wait for all timers that called call_rcu() to finish before
+ * calling rcu_barrier().
+ */
+ rcu_barrier();
+
pr_info("Deactivated\n");
}
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 685389d4b245ea..da60f572dda03a 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -58,6 +58,7 @@
* @skb: request message to be (repeatedly) sent
* @timer: timer governing period between requests
* @timer_intv: current interval between requests (in ms)
+ * @rcu: RCU head for deferred freeing
*/
struct tipc_discoverer {
u32 bearer_id;
@@ -69,6 +70,7 @@ struct tipc_discoverer {
struct sk_buff *skb;
struct timer_list timer;
unsigned long timer_intv;
+ struct rcu_head rcu;
};
/**
@@ -382,6 +384,15 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
return 0;
}
+static void tipc_disc_free_rcu(struct rcu_head *rp)
+{
+ struct tipc_discoverer *d = container_of(rp, struct tipc_discoverer,
+ rcu);
+
+ kfree_skb(d->skb);
+ kfree(d);
+}
+
/**
* tipc_disc_delete - destroy object sending periodic link setup requests
* @d: ptr to link dest structure
@@ -389,8 +400,7 @@ int tipc_disc_create(struct net *net, struct tipc_bearer *b,
void tipc_disc_delete(struct tipc_discoverer *d)
{
timer_shutdown_sync(&d->timer);
- kfree_skb(d->skb);
- kfree(d);
+ call_rcu(&d->rcu, tipc_disc_free_rcu);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0753/1266] net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (751 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0752/1266] tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0754/1266] octeontx2-af: mcs: Fix unsupported secy stats read Greg Kroah-Hartman
` (245 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayen Yan, Lorenzo Bianconi,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayen Yan <win847@gmail.com>
[ Upstream commit 41782770be567abc6509169d0ffdada31c783a66 ]
In mtk_ppe_init(), when accounting is enabled, the error paths for
dmam_alloc_coherent(mib) and devm_kzalloc(acct) failures return NULL
directly, bypassing the err_free_l2_flows label that destroys the
rhashtable initialized earlier.
While this leak only occurs during probe (not runtime) and the leaked
memory is minimal (an empty rhash table), fixing it ensures proper
error path cleanup consistency.
Fix by changing the two return NULL statements to goto err_free_l2_flows.
Fixes: 603ea5e7ffa7 ("net: ethernet: mtk_eth_soc: fix memory leak in error path")
Signed-off-by: Wayen Yan <win847@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/178167550101.2217645.14579307712717502425@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mediatek/mtk_ppe.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c
index 1e033d63b45100..eb4df95fe9d0f4 100644
--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
+++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
@@ -916,7 +916,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),
&ppe->mib_phys, GFP_KERNEL);
if (!mib)
- return NULL;
+ goto err_free_l2_flows;
ppe->mib_table = mib;
@@ -924,7 +924,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int index)
GFP_KERNEL);
if (!acct)
- return NULL;
+ goto err_free_l2_flows;
ppe->acct_table = acct;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0754/1266] octeontx2-af: mcs: Fix unsupported secy stats read
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (752 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0753/1266] net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0755/1266] octeontx2-pf: Clear stats of all resources when freeing resources Greg Kroah-Hartman
` (244 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geetha sowjanya, Subbaraya Sundeep,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <gakula@marvell.com>
[ Upstream commit d4b7440f7316e76f013f57d8b6da069a1b9c34e7 ]
Secy control stats counter doesn't exist for CNF10KB platform.
Skip reading this respective register for CNF10KB silicon while
fetching secy stats.
Fixes: 9312150af8da ("octeontx2-af: cn10k: mcs: Support for stats collection")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://patch.msgid.link/1781636420-19816-1-git-send-email-sbhatta@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 6 +++---
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 3 ++-
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
index c1775bd01c2b48..a07e0b3d8d0006 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
@@ -120,13 +120,13 @@ void mcs_get_rx_secy_stats(struct mcs *mcs, struct mcs_secy_stats *stats, int id
reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYUNTAGGEDX(id);
stats->pkt_untaged_cnt = mcs_reg_read(mcs, reg);
- reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id);
- stats->pkt_ctl_cnt = mcs_reg_read(mcs, reg);
-
if (mcs->hw->mcs_blks > 1) {
reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYNOTAGX(id);
stats->pkt_notag_cnt = mcs_reg_read(mcs, reg);
+ return;
}
+ reg = MCSX_CSE_RX_MEM_SLAVE_INPKTSSECYCTLX(id);
+ stats->pkt_ctl_cnt = mcs_reg_read(mcs, reg);
}
void mcs_get_flowid_stats(struct mcs *mcs, struct mcs_flowid_stats *stats,
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index 56dab11833b533..285ae29396342a 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -505,10 +505,11 @@ static int rvu_dbg_mcs_rx_secy_stats_display(struct seq_file *filp, void *unused
seq_printf(filp, "secy%d: Tagged ctrl pkts: %lld\n", secy_id,
stats.pkt_tagged_ctl_cnt);
seq_printf(filp, "secy%d: Untaged pkts: %lld\n", secy_id, stats.pkt_untaged_cnt);
- seq_printf(filp, "secy%d: Ctrl pkts: %lld\n", secy_id, stats.pkt_ctl_cnt);
if (mcs->hw->mcs_blks > 1)
seq_printf(filp, "secy%d: pkts notag: %lld\n", secy_id,
stats.pkt_notag_cnt);
+ else
+ seq_printf(filp, "secy%d: Ctrl pkts: %lld\n", secy_id, stats.pkt_ctl_cnt);
}
mutex_unlock(&mcs->stats_lock);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0755/1266] octeontx2-pf: Clear stats of all resources when freeing resources
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (753 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0754/1266] octeontx2-af: mcs: Fix unsupported secy stats read Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0756/1266] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown Greg Kroah-Hartman
` (243 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Subbaraya Sundeep, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <sbhatta@marvell.com>
[ Upstream commit fd4460721fb4062ef470ecdfdaedadfe7e415c09 ]
When all MCS resources mapped to a PF are being freed then clear
stats of all those resources too.
Fixes: 815debbbf7b5 ("octeontx2-pf: mcs: Clear stats before freeing resource")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://patch.msgid.link/1781636420-19816-2-git-send-email-sbhatta@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
index 3af58bc9f533cc..b288edd9e22db0 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
@@ -213,6 +213,7 @@ static void cn10k_mcs_free_rsrc(struct otx2_nic *pfvf, enum mcs_direction dir,
clear_req->id = hw_rsrc_id;
clear_req->type = type;
clear_req->dir = dir;
+ clear_req->all = all;
req = otx2_mbox_alloc_msg_mcs_free_resources(mbox);
if (!req)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0756/1266] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (754 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0755/1266] octeontx2-pf: Clear stats of all resources when freeing resources Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0757/1266] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
` (242 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geetha sowjanya, Subbaraya Sundeep,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <gakula@marvell.com>
[ Upstream commit 450d0e90b10393bd9f50c127875a9fdd4cc81c30 ]
On PF shutdown, the current driver free mcs hardware
resources though mcs resources are not allocated to it.
This patch checks the mcs resources status and if resources
are allocated then only sends mailbox message to free them.
Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://patch.msgid.link/1781636420-19816-3-git-send-email-sbhatta@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
index b288edd9e22db0..8f07d19819cec8 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
@@ -1808,11 +1808,16 @@ int cn10k_mcs_init(struct otx2_nic *pfvf)
void cn10k_mcs_free(struct otx2_nic *pfvf)
{
+ struct cn10k_mcs_cfg *cfg = pfvf->macsec_cfg;
+
if (!test_bit(CN10K_HW_MACSEC, &pfvf->hw.cap_flag))
return;
- cn10k_mcs_free_rsrc(pfvf, MCS_TX, MCS_RSRC_TYPE_SECY, 0, true);
- cn10k_mcs_free_rsrc(pfvf, MCS_RX, MCS_RSRC_TYPE_SECY, 0, true);
+ if (!list_empty(&cfg->txsc_list)) {
+ cn10k_mcs_free_rsrc(pfvf, MCS_TX, MCS_RSRC_TYPE_SECY, 0, true);
+ cn10k_mcs_free_rsrc(pfvf, MCS_RX, MCS_RSRC_TYPE_SECY, 0, true);
+ }
+
kfree(pfvf->macsec_cfg);
pfvf->macsec_cfg = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0757/1266] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (755 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0756/1266] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0758/1266] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
` (241 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoni Pokusinski, Alexandre Belloni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoni Pokusinski <apokusinski01@gmail.com>
[ Upstream commit 419719c514252a2dbb2e2976f564c83417dd6d0a ]
The RTC_VL_CLR ioctl intends to clear only the battery low flag (BLF),
however the current implementation writes 0 to the status register,
clearing all status bits.
Fix this by writing back the masked status value so that only BLF is
cleared, preserving other status flags.
Fixes: ffe1c5a2d427 ("rtc: abx80x: Implement RTC_VL_READ,CLR ioctls")
Signed-off-by: Antoni Pokusinski <apokusinski01@gmail.com>
Link: https://patch.msgid.link/20260415160610.127155-2-apokusinski01@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-abx80x.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-abx80x.c b/drivers/rtc/rtc-abx80x.c
index 5f3a3e60a19d09..862833519d7f4d 100644
--- a/drivers/rtc/rtc-abx80x.c
+++ b/drivers/rtc/rtc-abx80x.c
@@ -545,7 +545,8 @@ static int abx80x_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
status &= ~ABX8XX_STATUS_BLF;
- tmp = i2c_smbus_write_byte_data(client, ABX8XX_REG_STATUS, 0);
+ tmp = i2c_smbus_write_byte_data(client, ABX8XX_REG_STATUS,
+ status);
if (tmp < 0)
return tmp;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0758/1266] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (756 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0757/1266] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0759/1266] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
` (240 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronan Dalton, linux-rtc,
linux-kernel, Alexandre Belloni, Tyler Hicks, Sasha Levin,
Meagan Lloyd, Rodolfo Giometti, Chris Packham
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
[ Upstream commit a091e1ba3b68cabc9caedafc6f81d9fe9b3b2200 ]
Prior to commit 48458654659c ("rtc: ds1307: remove clear of oscillator
stop flag (OSF) in probe"), the oscillator stop flag (OSF) bit was
checked during device probe for the ds1337, ds1339, ds1341, and ds3231
chips; if it was set, it would be cleared and a warning would be logged
saying "SET TIME!". Since that commit, the OSF bit is no longer cleared,
but the warning is still printed.
Directly following that commit, there was no way to get rid of this
warning because nothing cleared the OSF bit on these chips.
The commit associated with the previous commit, 523923cfd5d6 ("rtc:
ds1307: handle oscillator stop flag (OSF) for ds1341"), made proper use
of the OSF when getting and setting the time in the RTC. However, the
other RTC variants ds1337, ds1339 and ds3231 didn't have a corresponding
change made.
Given that the OSF bit is no longer cleared at probe time when it is
set, the remaining three chips should have the same handling as the
ds1341 chip has for the OSF bit.
Fix the issue on the ds1337, ds1339 and ds3231 chips by applying the
same logic as the ds1341 has to these chips.
Note that any devices brought up between the first referenced commit and
this one may begin mistrusting the time reported by the RTC until it is
set again, if the bit was never explicitly cleared.
Note that only the ds1339 was tested with this change, but the
datasheets for the other chips contain essentially identical
descriptions of the OSF bit so the same change should work.
Signed-off-by: Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
Cc: linux-rtc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Tyler Hicks <code@tyhicks.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Cc: Rodolfo Giometti <giometti@enneenne.com>
Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
Fixes: 48458654659c ("rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe")
Reviewed-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Reviewed-by: Tyler Hicks <code@tyhicks.com>
Link: https://patch.msgid.link/20260508032518.3696705-2-ronan.dalton@alliedtelesis.co.nz
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-ds1307.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 74aad2b12460c3..26b63cd0929154 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -264,6 +264,16 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
if (tmp & DS1338_BIT_OSF)
return -EINVAL;
break;
+ case ds_1337:
+ case ds_1339:
+ case ds_1341:
+ case ds_3231:
+ ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp);
+ if (ret)
+ return ret;
+ if (tmp & DS1337_BIT_OSF)
+ return -EINVAL;
+ break;
case ds_1340:
if (tmp & DS1340_BIT_nEOSC)
return -EINVAL;
@@ -274,13 +284,6 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
if (tmp & DS1340_BIT_OSF)
return -EINVAL;
break;
- case ds_1341:
- ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp);
- if (ret)
- return ret;
- if (tmp & DS1337_BIT_OSF)
- return -EINVAL;
- break;
case ds_1388:
ret = regmap_read(ds1307->regmap, DS1388_REG_FLAG, &tmp);
if (ret)
@@ -375,14 +378,17 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t)
regmap_update_bits(ds1307->regmap, DS1307_REG_CONTROL,
DS1338_BIT_OSF, 0);
break;
- case ds_1340:
- regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG,
- DS1340_BIT_OSF, 0);
- break;
+ case ds_1337:
+ case ds_1339:
case ds_1341:
+ case ds_3231:
regmap_update_bits(ds1307->regmap, DS1337_REG_STATUS,
DS1337_BIT_OSF, 0);
break;
+ case ds_1340:
+ regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG,
+ DS1340_BIT_OSF, 0);
+ break;
case ds_1388:
regmap_update_bits(ds1307->regmap, DS1388_REG_FLAG,
DS1388_BIT_OSF, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0759/1266] bpf: Fix stack slot index in nospec checks
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (757 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0758/1266] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0760/1266] bpf: zero-initialize the fib lookup flow struct Greg Kroah-Hartman
` (239 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Gerhorst, Jiayuan Chen,
Emil Tsalapatis, Nuoqi Gui, Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ Upstream commit d1d53aa30ab3b5ae89161c9cc840b3f7489ad386 ]
check_stack_write_fixed_off() computes the byte slot for a fixed-offset
stack write as -off - 1, and records each written byte in slot_type[] with
(slot - i) % BPF_REG_SIZE.
The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a
4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the
pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates
bytes 7..4. That can leave the second half-slot write without nospec_result
even though the bytes being overwritten still require sanitization.
Use the same slot index in the sanitization pre-check that the write path uses
when updating slot_type[].
Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation")
Acked-by: Luis Gerhorst <luis.gerhorst@fau.de>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260618-f01-11-stack-nospec-slot-index-v3-1-780297041721@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f638b2d3a42fbc..1da0092122c1db 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4672,7 +4672,8 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
bool sanitize = reg && is_spillable_regtype(reg->type);
for (i = 0; i < size; i++) {
- u8 type = state->stack[spi].slot_type[i];
+ u8 type = state->stack[spi].slot_type[(slot - i) %
+ BPF_REG_SIZE];
if (type != STACK_MISC && type != STACK_ZERO) {
sanitize = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0760/1266] bpf: zero-initialize the fib lookup flow struct
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (758 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0759/1266] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0761/1266] bpf: Fix effective prog array index with BPF_F_PREORDER Greg Kroah-Hartman
` (238 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avinash Duduskar,
Toke Høiland-Jørgensen, Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avinash Duduskar <avinash.duduskar@gmail.com>
[ Upstream commit 0dfcb68a6a5ac517b22dff6a1f01cb4f126dfc57 ]
bpf_ipv4_fib_lookup() and bpf_ipv6_fib_lookup() build the flow key on
the stack with a bare "struct flowi4 fl4;" / "struct flowi6 fl6;" and
fill it field by field, but never set flowi4_l3mdev / flowi6_l3mdev.
On the non-DIRECT path the lookup goes through the fib rules whenever the
netns has custom rules, which a VRF installs:
bpf_ipv4_fib_lookup() -> fib_lookup() -> __fib_lookup()
-> l3mdev_update_flow() reads !fl->flowi_l3mdev
-> fib_rules_lookup() -> fib_rule_match()
-> l3mdev_fib_rule_match() uses fl->flowi_l3mdev
l3mdev_update_flow() resolves the l3mdev master from the ingress device
only while the field is still zero. Left at a nonzero stack value the
resolution is skipped, and l3mdev_fib_rule_match() then tests that value
as an ifindex, so the VRF master is not resolved and the rule fails to
match: an ingress enslaved to a VRF can fail to select its table. FIB
rules matching on an L3 master device (l3mdev_fib_rule_iif_match()/
_oif_match()) read the same value, so an "ip rule iif/oif <vrf>"
mismatches the same way.
Zero-initialize the whole flow struct rather than adding one more
field assignment, so any flowi field added later is covered too.
ip_route_input_slow() likewise zeroes the field before its input lookup.
CONFIG_INIT_STACK_ALL_ZERO masks this by default, but it depends on
compiler support (CC_HAS_AUTO_VAR_INIT_ZERO), so INIT_STACK_NONE builds,
including older toolchains that fall back to it, are exposed. Built with
INIT_STACK_ALL_PATTERN, a plain bpf_fib_lookup (no VLAN, no DIRECT) over a
VRF slave whose destination is routed only in the VRF table returns
BPF_FIB_LKUP_RET_NOT_FWDED, and resolves with this patch. On the default
config the lookup succeeds either way, so ordinary testing does not catch
the bug.
Fixes: 40867d74c374 ("net: Add l3mdev index to flow struct and avoid oif reset for port devices")
Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/20260617224719.1428599-1-avinash.duduskar@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 3e01ce9f01dfd0..5bbad21c7757c3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5955,7 +5955,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
struct neighbour *neigh;
struct net_device *dev;
struct fib_result res;
- struct flowi4 fl4;
+ struct flowi4 fl4 = {};
u32 mtu = 0;
int err;
@@ -6092,7 +6092,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
struct neighbour *neigh;
struct net_device *dev;
struct inet6_dev *idev;
- struct flowi6 fl6;
+ struct flowi6 fl6 = {};
int strict = 0;
int oif, err;
u32 mtu = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0761/1266] bpf: Fix effective prog array index with BPF_F_PREORDER
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (759 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0760/1266] bpf: zero-initialize the fib lookup flow struct Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0762/1266] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
` (237 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amery Hung, Yonghong Song,
Alexei Starovoitov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amery Hung <ameryhung@gmail.com>
[ Upstream commit f08aaee3152d0dfc578b3f2586932d82062701dd ]
replace_effective_prog() and purge_effective_progs() located the slot in
the effective array by walking the program hlist and counting entries
linearly. That count does not match the array layout: compute_effective_
progs() places BPF_F_PREORDER programs at the front (ancestor cgroup
first, attach order within a cgroup) and the rest after them (descendant
cgroup first). So when a preorder program is present, the linear hlist
position no longer equals the program's index in the effective array.
For replace_effective_prog() (bpf_link_update()) this overwrote the
wrong slot, corrupting the effective order. For purge_effective_progs(),
it could dummy out a slot belonging to a different program and leave the
detached program in the array while bpf_prog_put() drops its reference,
i.e. a use-after-free.
Fix both by replaying compute_effective_progs()'s placement (including
the per-cgroup preorder reversal) in a shared effective_prog_pos()
helper. Identify the entry by its struct bpf_prog_list pointer rather
than by (prog, link) value, so the lookup resolves to exactly the
attachment the syscall selected even when the same bpf_prog is attached
to several cgroups in the hierarchy.
Fixes: 4b82b181a26c ("bpf: Allow pre-ordering for bpf cgroup progs")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260619063520.2690547-2-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/cgroup.c | 108 +++++++++++++++++++++++++-------------------
1 file changed, 62 insertions(+), 46 deletions(-)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 6f59bf271ece89..b75b63e675066f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -769,19 +769,65 @@ static int cgroup_bpf_attach(struct cgroup *cgrp,
return ret;
}
+static int effective_prog_pos(struct cgroup *cgrp,
+ enum cgroup_bpf_attach_type atype,
+ struct bpf_prog_list *target_pl)
+{
+ int cnt = 0, preorder_cnt = 0, fstart, bstart, init_bstart, pos = -1;
+ struct bpf_prog_list *pl;
+ struct cgroup *p = cgrp;
+
+ /* count effective programs to find where the preorder region ends */
+ do {
+ if (cnt == 0 || (p->bpf.flags[atype] & BPF_F_ALLOW_MULTI))
+ cnt += prog_list_length(&p->bpf.progs[atype], &preorder_cnt);
+ p = cgroup_parent(p);
+ } while (p);
+
+ /* replay compute_effective_progs() placement and record target's slot */
+ cnt = 0;
+ p = cgrp;
+ fstart = preorder_cnt;
+ bstart = preorder_cnt - 1;
+ do {
+ if (cnt > 0 && !(p->bpf.flags[atype] & BPF_F_ALLOW_MULTI))
+ continue;
+
+ init_bstart = bstart;
+ hlist_for_each_entry(pl, &p->bpf.progs[atype], node) {
+ if (!prog_list_prog(pl))
+ continue;
+
+ if (pl->flags & BPF_F_PREORDER) {
+ if (pl == target_pl)
+ pos = bstart;
+ bstart--;
+ } else {
+ if (pl == target_pl)
+ pos = fstart;
+ fstart++;
+ }
+ cnt++;
+ }
+
+ /* reverse pre-ordering progs at this cgroup level */
+ if (pos >= bstart + 1 && pos <= init_bstart)
+ pos = bstart + 1 + init_bstart - pos;
+ } while ((p = cgroup_parent(p)));
+
+ return pos;
+}
+
/* Swap updated BPF program for given link in effective program arrays across
* all descendant cgroups. This function is guaranteed to succeed.
*/
static void replace_effective_prog(struct cgroup *cgrp,
enum cgroup_bpf_attach_type atype,
- struct bpf_cgroup_link *link)
+ struct bpf_prog_list *pl)
{
struct bpf_prog_array_item *item;
struct cgroup_subsys_state *css;
struct bpf_prog_array *progs;
- struct bpf_prog_list *pl;
- struct hlist_head *head;
- struct cgroup *cg;
int pos;
css_for_each_descendant_pre(css, &cgrp->self) {
@@ -790,27 +836,15 @@ static void replace_effective_prog(struct cgroup *cgrp,
if (percpu_ref_is_zero(&desc->bpf.refcnt))
continue;
- /* find position of link in effective progs array */
- for (pos = 0, cg = desc; cg; cg = cgroup_parent(cg)) {
- if (pos && !(cg->bpf.flags[atype] & BPF_F_ALLOW_MULTI))
- continue;
+ pos = effective_prog_pos(desc, atype, pl);
+ if (WARN_ON_ONCE(pos < 0))
+ continue;
- head = &cg->bpf.progs[atype];
- hlist_for_each_entry(pl, head, node) {
- if (!prog_list_prog(pl))
- continue;
- if (pl->link == link)
- goto found;
- pos++;
- }
- }
-found:
- BUG_ON(!cg);
progs = rcu_dereference_protected(
desc->bpf.effective[atype],
lockdep_is_held(&cgroup_mutex));
item = &progs->items[pos];
- WRITE_ONCE(item->prog, link->link.prog);
+ WRITE_ONCE(item->prog, pl->link->link.prog);
}
}
@@ -853,7 +887,7 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
return -ENOENT;
old_prog = xchg(&link->link.prog, new_prog);
- replace_effective_prog(cgrp, atype, link);
+ replace_effective_prog(cgrp, atype, pl);
bpf_prog_put(old_prog);
return 0;
}
@@ -920,19 +954,14 @@ static struct bpf_prog_list *find_detach_entry(struct hlist_head *progs,
* recomputing the array in place.
*
* @cgrp: The cgroup which descendants to travers
- * @prog: A program to detach or NULL
- * @link: A link to detach or NULL
+ * @pl: The prog_list entry being detached
* @atype: Type of detach operation
*/
-static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog,
- struct bpf_cgroup_link *link,
+static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog_list *pl,
enum cgroup_bpf_attach_type atype)
{
struct cgroup_subsys_state *css;
struct bpf_prog_array *progs;
- struct bpf_prog_list *pl;
- struct hlist_head *head;
- struct cgroup *cg;
int pos;
/* recompute effective prog array in place */
@@ -942,24 +971,11 @@ static void purge_effective_progs(struct cgroup *cgrp, struct bpf_prog *prog,
if (percpu_ref_is_zero(&desc->bpf.refcnt))
continue;
- /* find position of link or prog in effective progs array */
- for (pos = 0, cg = desc; cg; cg = cgroup_parent(cg)) {
- if (pos && !(cg->bpf.flags[atype] & BPF_F_ALLOW_MULTI))
- continue;
-
- head = &cg->bpf.progs[atype];
- hlist_for_each_entry(pl, head, node) {
- if (!prog_list_prog(pl))
- continue;
- if (pl->prog == prog && pl->link == link)
- goto found;
- pos++;
- }
- }
-
+ pos = effective_prog_pos(desc, atype, pl);
/* no link or prog match, skip the cgroup of this layer */
- continue;
-found:
+ if (pos < 0)
+ continue;
+
progs = rcu_dereference_protected(
desc->bpf.effective[atype],
lockdep_is_held(&cgroup_mutex));
@@ -1020,7 +1036,7 @@ static int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
/* if update effective array failed replace the prog with a dummy prog*/
pl->prog = old_prog;
pl->link = link;
- purge_effective_progs(cgrp, old_prog, link, atype);
+ purge_effective_progs(cgrp, pl, atype);
}
/* now can actually delete it from this cgroup list */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0762/1266] drm/edid: fix OOB read in drm_parse_tiled_block()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (760 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0761/1266] bpf: Fix effective prog array index with BPF_F_PREORDER Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0763/1266] PCI: endpoint: pci-epf-vntb: Add check to detect db_count value of 0 Greg Kroah-Hartman
` (236 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Jani Nikula,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ]
drm_parse_tiled_block() casts the DisplayID block to a
struct displayid_tiled_block and reads the full fixed layout up to
tile->topology_id[7] without checking block->num_bytes. The DisplayID
iterator only validates the declared payload length, so a crafted EDID
can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or
DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at
the end of a DisplayID extension. The read then runs past the end of the
exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.
Reject blocks shorter than the spec's 22-byte tiled payload before
reading the fixed struct, as drm_parse_vesa_mso_data() already does.
BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update
Read of size 2 at addr ffff888010077700 by task exploit/147
dump_stack_lvl (lib/dump_stack.c:94 ...)
print_report (mm/kasan/report.c:378 ...)
kasan_report (mm/kasan/report.c:595)
drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)
bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)
drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)
status_store (drivers/gpu/drm/drm_sysfs.c:219)
...
vfs_write (fs/read_write.c:595 fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_edid.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c6e6e4766c8bf6..dbeae02c76d6a9 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -7279,6 +7279,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector,
u8 num_v_tile, num_h_tile;
struct drm_tile_group *tg;
+ /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */
+ if (block->num_bytes < 22) {
+ drm_dbg_kms(connector->dev,
+ "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n",
+ connector->base.id, connector->name, block->num_bytes);
+ return;
+ }
+
w = tile->tile_size[0] | tile->tile_size[1] << 8;
h = tile->tile_size[2] | tile->tile_size[3] << 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0763/1266] PCI: endpoint: pci-epf-vntb: Add check to detect db_count value of 0
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (761 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 6.6 0762/1266] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0764/1266] PCI: endpoint: pci-epf-ntb: " Greg Kroah-Hartman
` (235 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Bjorn Helgaas, Koichiro Den, Frank Li,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 33bd1ea748bc897c4d13437284e08c658e8d1340 ]
epf_ntb->db_count value should be within 1 to MAX_DB_COUNT. Current code
only checks for the upper bound, while the lower bound is unchecked. This
can cause a lot of issues in the driver if the user passes 'db_count' as 0.
Add a check for 0 also. While at it, remove the redundant 'db_count'
assignment.
Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260407124421.282766-2-mani@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-vntb.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index 6590f77c1a0dcc..0ebd37e7ecd0f4 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -484,7 +484,6 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
{
const struct pci_epc_features *epc_features;
struct device *dev;
- u32 db_count;
int ret;
dev = &ntb->epf->dev;
@@ -496,14 +495,12 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
return -EINVAL;
}
- db_count = ntb->db_count;
- if (db_count > MAX_DB_COUNT) {
- dev_err(dev, "DB count cannot be more than %d\n", MAX_DB_COUNT);
+ if (!ntb->db_count || ntb->db_count > MAX_DB_COUNT) {
+ dev_err(dev, "DB count %d out of range (1 - %d)\n",
+ ntb->db_count, MAX_DB_COUNT);
return -EINVAL;
}
- ntb->db_count = db_count;
-
if (epc_features->msi_capable) {
ret = pci_epc_set_msi(ntb->epf->epc,
ntb->epf->func_no,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0764/1266] PCI: endpoint: pci-epf-ntb: Add check to detect db_count value of 0
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (762 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0763/1266] PCI: endpoint: pci-epf-vntb: Add check to detect db_count value of 0 Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0765/1266] ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Greg Kroah-Hartman
` (234 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit d1db6d7c2485ee475a04d8354fbb5b26ea10d978 ]
epf_ntb->db_count value should be within 1 to MAX_DB_COUNT. Current code
only checks for the upper bound, while the lower bound is unchecked. This
can cause a lot of issues in the driver if the user passes 'db_count' as 0.
Add a check for 0 also. While at it, remove the redundant 'db_count'
variable from epf_ntb_configure_interrupt().
Fixes: 8b821cf76150 ("PCI: endpoint: Add EP function driver to provide NTB functionality")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260407124421.282766-3-mani@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-ntb.c | 21 ++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-ntb.c b/drivers/pci/endpoint/functions/pci-epf-ntb.c
index b759b4e0bfb598..cba6bab067b61d 100644
--- a/drivers/pci/endpoint/functions/pci-epf-ntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-ntb.c
@@ -559,12 +559,15 @@ static int epf_ntb_configure_db(struct epf_ntb *ntb,
struct pci_epc *epc;
int ret;
- if (db_count > MAX_DB_COUNT)
- return -EINVAL;
-
ntb_epc = ntb->epc[type];
epc = ntb_epc->epc;
+ if (!db_count || db_count > MAX_DB_COUNT) {
+ dev_err(&epc->dev, "DB count %d out of range (1 - %d)\n",
+ db_count, MAX_DB_COUNT);
+ return -EINVAL;
+ }
+
if (msix)
ret = epf_ntb_configure_msix(ntb, type, db_count);
else
@@ -1278,7 +1281,6 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb,
u8 func_no, vfunc_no;
struct pci_epc *epc;
struct device *dev;
- u32 db_count;
int ret;
ntb_epc = ntb->epc[type];
@@ -1296,17 +1298,16 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb,
func_no = ntb_epc->func_no;
vfunc_no = ntb_epc->vfunc_no;
- db_count = ntb->db_count;
- if (db_count > MAX_DB_COUNT) {
- dev_err(dev, "DB count cannot be more than %d\n", MAX_DB_COUNT);
+ if (!ntb->db_count || ntb->db_count > MAX_DB_COUNT) {
+ dev_err(dev, "DB count %d out of range (1 - %d)\n",
+ ntb->db_count, MAX_DB_COUNT);
return -EINVAL;
}
- ntb->db_count = db_count;
epc = ntb_epc->epc;
if (msi_capable) {
- ret = pci_epc_set_msi(epc, func_no, vfunc_no, db_count);
+ ret = pci_epc_set_msi(epc, func_no, vfunc_no, ntb->db_count);
if (ret) {
dev_err(dev, "%s intf: MSI configuration failed\n",
pci_epc_interface_string(type));
@@ -1315,7 +1316,7 @@ static int epf_ntb_configure_interrupt(struct epf_ntb *ntb,
}
if (msix_capable) {
- ret = pci_epc_set_msix(epc, func_no, vfunc_no, db_count,
+ ret = pci_epc_set_msix(epc, func_no, vfunc_no, ntb->db_count,
ntb_epc->msix_bar,
ntb_epc->msix_table_offset);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0765/1266] ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (763 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0764/1266] PCI: endpoint: pci-epf-ntb: " Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0766/1266] ice: fix AQ error code comparison in ice_set_pauseparam() Greg Kroah-Hartman
` (233 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dawid Osuchowski,
Aleksandr Loktionov, Simon Horman, Rafal Romanowski, Tony Nguyen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
[ Upstream commit ebbe8868cf473f698e0fbaf436d2618b2bcda806 ]
Resetting all VFs causes resource leak on VFs with FDIR filters
enabled as CTRL VSIs are only invalidated and not freed. Fix by using
ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which
aligns behavior with the ice_reset_vf() function.
Reproduction:
echo 1 > /sys/class/net/$pf/device/sriov_numvfs
ethtool -N $vf flow-type ether proto 0x9000 action 0
echo 1 > /sys/class/net/$pf/device/reset
Fixes: da62c5ff9dcd ("ice: Add support for per VF ctrl VSI enabling")
Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_vf_lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
index 1463fee451efcc..fe4a641ce70dca 100644
--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
@@ -784,7 +784,7 @@ void ice_reset_all_vfs(struct ice_pf *pf)
* setup only when VF creates its first FDIR rule.
*/
if (vf->ctrl_vsi_idx != ICE_NO_VSI)
- ice_vf_ctrl_invalidate_vsi(vf);
+ ice_vf_ctrl_vsi_release(vf);
ice_vf_pre_vsi_rebuild(vf);
if (ice_vf_rebuild_vsi(vf)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0766/1266] ice: fix AQ error code comparison in ice_set_pauseparam()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (764 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0765/1266] ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0767/1266] i40e: Fix i40e_debug() to use struct i40e_hw argument Greg Kroah-Hartman
` (232 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Simon Horman, Tony Nguyen, Sasha Levin, Rinitha S
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
[ Upstream commit 2bf7744bc3221a63b95c76c94eab1dad832fa401 ]
Fix unreachable code: the conditionals in ice_set_pauseparam() used
the bitwise-AND operator suggesting aq_failures is a bitmap, but it
is actually an enum, making the third condition logically unreachable.
Replace the if-else ladder with a switch statement. Also move the
aq_failures initialization to the variable declaration and remove the
redundant zeroing from ice_set_fc().
Fixes: fcea6f3da546 ("ice: Add stats and ethtool support")
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_common.c | 1 -
drivers/net/ethernet/intel/ice/ice_ethtool.c | 12 ++++++++----
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index eaf1ed6c9df4a2..fbc448fa6e9d3f 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -3454,7 +3454,6 @@ ice_set_fc(struct ice_port_info *pi, u8 *aq_failures, bool ena_auto_link_update)
if (!pi || !aq_failures)
return -EINVAL;
- *aq_failures = 0;
hw = pi->hw;
pcaps = devm_kzalloc(ice_hw_to_dev(hw), sizeof(*pcaps), GFP_KERNEL);
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index c254484e9b6b2b..988788d21dd5a5 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -3015,7 +3015,7 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
struct ice_vsi *vsi = np->vsi;
struct ice_hw *hw = &pf->hw;
struct ice_port_info *pi;
- u8 aq_failures;
+ u8 aq_failures = 0;
bool link_up;
u32 is_an;
int err;
@@ -3086,18 +3086,22 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
/* Set the FC mode and only restart AN if link is up */
err = ice_set_fc(pi, &aq_failures, link_up);
- if (aq_failures & ICE_SET_FC_AQ_FAIL_GET) {
+ switch (aq_failures) {
+ case ICE_SET_FC_AQ_FAIL_GET:
netdev_info(netdev, "Set fc failed on the get_phy_capabilities call with err %d aq_err %s\n",
err, ice_aq_str(hw->adminq.sq_last_status));
err = -EAGAIN;
- } else if (aq_failures & ICE_SET_FC_AQ_FAIL_SET) {
+ break;
+ case ICE_SET_FC_AQ_FAIL_SET:
netdev_info(netdev, "Set fc failed on the set_phy_config call with err %d aq_err %s\n",
err, ice_aq_str(hw->adminq.sq_last_status));
err = -EAGAIN;
- } else if (aq_failures & ICE_SET_FC_AQ_FAIL_UPDATE) {
+ break;
+ case ICE_SET_FC_AQ_FAIL_UPDATE:
netdev_info(netdev, "Set fc failed on the get_link_info call with err %d aq_err %s\n",
err, ice_aq_str(hw->adminq.sq_last_status));
err = -EAGAIN;
+ break;
}
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0767/1266] i40e: Fix i40e_debug() to use struct i40e_hw argument
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (765 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0766/1266] ice: fix AQ error code comparison in ice_set_pauseparam() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0768/1266] rtc: msc313: fix NULL deref in shared IRQ handler at probe Greg Kroah-Hartman
` (231 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamed Khalfella,
Aleksandr Loktionov, Paul Menzel, Alexander Nowlin, Tony Nguyen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <mkhalfella@purestorage.com>
[ Upstream commit 798f94603eb0737033861efd320a9159f382a7c5 ]
i40e_debug() macro takes struct i40e_hw *h as first argument. But the
macro body uses hw instead of h. This has been working so far because hw
happens to be the name of the variable in the context where the macro is
expanded. Fix the macro to use the passed argument.
Fixes: 5dfd37c37a44 ("i40e: Split i40e_osdep.h")
Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Tested-by: Alexander Nowlin <alexander.nowlin@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_debug.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debug.h b/drivers/net/ethernet/intel/i40e/i40e_debug.h
index 27ebc72d8bfe5f..8e650ae035d1f6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debug.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_debug.h
@@ -41,7 +41,7 @@ struct device *i40e_hw_to_dev(struct i40e_hw *hw);
#define i40e_debug(h, m, s, ...) \
do { \
if (((m) & (h)->debug_mask)) \
- dev_info(i40e_hw_to_dev(hw), s, ##__VA_ARGS__); \
+ dev_info(i40e_hw_to_dev(h), s, ##__VA_ARGS__); \
} while (0)
#endif /* _I40E_DEBUG_H_ */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0768/1266] rtc: msc313: fix NULL deref in shared IRQ handler at probe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (766 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0767/1266] i40e: Fix i40e_debug() to use struct i40e_hw argument Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0769/1266] ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE Greg Kroah-Hartman
` (230 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Alexandre Belloni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit a369f48be8de426a7d2bca18dbd46c2ad1138803 ]
msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and
&pdev->dev as the cookie, but platform_set_drvdata() is only called
later after the clock setup. With a shared IRQ line, another device
on the same line can trigger the handler in that window. The
handler does dev_get_drvdata() on the cookie, gets NULL, and
dereferences priv->rtc_base in interrupt context.
Pass priv as the cookie directly so the handler reads it from
dev_id without the lookup, removing the dependency on probe order.
Fixes: be7d9c9161b9 ("rtc: Add support for the MSTAR MSC313 RTC")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Link: https://patch.msgid.link/20260511032703.48262-1-sozdayvek@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-msc313.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/rtc/rtc-msc313.c b/drivers/rtc/rtc-msc313.c
index 8d7737e0e2e02c..6ef9c4efd7c92e 100644
--- a/drivers/rtc/rtc-msc313.c
+++ b/drivers/rtc/rtc-msc313.c
@@ -160,7 +160,7 @@ static const struct rtc_class_ops msc313_rtc_ops = {
static irqreturn_t msc313_rtc_interrupt(s32 irq, void *dev_id)
{
- struct msc313_rtc *priv = dev_get_drvdata(dev_id);
+ struct msc313_rtc *priv = dev_id;
u16 reg;
reg = readw(priv->rtc_base + REG_RTC_STATUS_INT);
@@ -206,7 +206,7 @@ static int msc313_rtc_probe(struct platform_device *pdev)
priv->rtc_dev->range_max = U32_MAX;
ret = devm_request_irq(dev, irq, msc313_rtc_interrupt, IRQF_SHARED,
- dev_name(&pdev->dev), &pdev->dev);
+ dev_name(&pdev->dev), priv);
if (ret) {
dev_err(dev, "Could not request IRQ\n");
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0769/1266] ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (767 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0768/1266] rtc: msc313: fix NULL deref in shared IRQ handler at probe Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0770/1266] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
` (229 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
[ Upstream commit 0c054227479ed7e36ebccb3a558bc0ef698264f6 ]
conn->preauth_info is shared connection state (struct
preauth_integrity_info, kmalloc-96) that is allocated and freed by the
SMB2 NEGOTIATE handler and read by the response send path.
smb2_handle_negotiate() allocates conn->preauth_info, and on a
deassemble_neg_contexts() failure kfrees it and sets it to NULL. Both the
allocation and the free/NULL happen under ksmbd_conn_lock(conn) (the
connection srv_mutex), which is held across the whole handler body.
The response send path smb3_preauth_hash_rsp(), called from the send:
block of __handle_ksmbd_work(), reads conn->preauth_info and dereferences
conn->preauth_info->Preauth_HashValue (via
ksmbd_gen_preauth_integrity_hash()) without taking conn_lock. When a
client drives two SMB2 NEGOTIATE requests on the same connection, one
worker can free conn->preauth_info on the failing-negotiate path while a
concurrent send-path worker is reading it, producing a slab
use-after-free read (KASAN-confirmed).
The send-path read tested conn->preauth_info for NULL but raced with the
free that occurs between the NULL check and the dereference, so the NULL
guard alone does not close the window.
Serialize the NEGOTIATE-branch read in smb3_preauth_hash_rsp() under
ksmbd_conn_lock(conn) and re-check conn->preauth_info inside the lock.
Because the negotiate handler holds conn_lock across its kfree + NULL
assignment, a reader that also takes conn_lock either runs fully before
the allocation or fully after the NULL store, and can never observe the
freed-but-not-yet-NULLed pointer. ksmbd_gen_preauth_integrity_hash()
takes no locks itself (it only computes a SHA-512 over the buffer), so
no lock-ordering inversion is introduced, and conn_lock is a sleepable
mutex which is safe on this send path (it already performs network I/O).
Fixes: aa7253c2393f ("ksmbd: fix memory leak in smb2_handle_negotiate")
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smb2pdu.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index fafbb4275bba4d..03d4432e3a1a43 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9132,10 +9132,13 @@ void smb3_preauth_hash_rsp(struct ksmbd_work *work)
WORK_BUFFERS(work, req, rsp);
- if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE &&
- conn->preauth_info)
- ksmbd_gen_preauth_integrity_hash(conn, work->response_buf,
- conn->preauth_info->Preauth_HashValue);
+ if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE) {
+ ksmbd_conn_lock(conn);
+ if (conn->preauth_info)
+ ksmbd_gen_preauth_integrity_hash(conn, work->response_buf,
+ conn->preauth_info->Preauth_HashValue);
+ ksmbd_conn_unlock(conn);
+ }
if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE && sess) {
__u8 *hash_value;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0770/1266] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (768 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0769/1266] ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0771/1266] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
` (228 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905 ]
fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and
dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown()
clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has
released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and
oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(),
but this re-fetch is unguarded; nexthop-backed routes survive
addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is
nulled.
Return 0 when idev is NULL, matching rt6_mtu_change_route() and the
fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in
fib6_mtu().").
Oops: general protection fault, ... KASAN: null-ptr-deref in range
[0x00000000000002a8-0x00000000000002af]
RIP: 0010:fib6_nh_mtu_change+0x203/0x990
rt6_mtu_change_route+0x141/0x1d0
__fib6_clean_all+0xd0/0x160
rt6_mtu_change+0xb4/0x100
ndisc_router_discovery+0x24b5/0x2cb0
icmpv6_rcv+0x12e9/0x1710
ipv6_rcv+0x39b/0x410
Fixes: c0b220cf7d80 ("ipv6: Refactor exception functions")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260619045334.2427073-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c3257e8d575485..e6f1a22bc2bea2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4980,6 +4980,9 @@ static int fib6_nh_mtu_change(struct fib6_nh *nh, void *_arg)
struct inet6_dev *idev = __in6_dev_get(arg->dev);
u32 mtu = f6i->fib6_pmtu;
+ if (!idev)
+ return 0;
+
if (mtu >= arg->mtu ||
(mtu < arg->mtu && mtu == idev->cnf.mtu6))
fib6_metric_set(f6i, RTAX_MTU, arg->mtu);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0771/1266] ipv4: fib: Dont ignore error route in local/main tables.
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (769 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0770/1266] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0772/1266] bpf, lsm: Add disabled BPF LSM hook list Greg Kroah-Hartman
` (227 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Ido Schimmel,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit b72f0db64205d9ce462038ba995d5d31eff32dc1 ]
When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,
fib_lookup() performs route lookup directly on two tables.
Since the first lookup does not properly bail out, the result
of an error route in the merged local/main table could be
overwritten by another route in the default table:
# unshare -n
# ip link set lo up
# ip route add 192.168.0.0/24 dev lo table 253
# ip route add unreachable 192.168.0.0/24
# ip route get 192.168.0.1
192.168.0.1 dev lo table default uid 0
cache <local>
Once a random rule is added, the error route is respected:
# ip rule add table 0
# ip rule del table 0
# ip route get 192.168.0.1
RTNETLINK answers: No route to host
Let's fix the inconsistent behaviour.
Fixes: f4530fa574df ("ipv4: Avoid overhead when no custom FIB rules are installed.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260619212753.3367244-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_fib.h | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index ca1700c2a5733b..b6fc9924ef7a0b 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -370,7 +370,7 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
struct fib_result *res, unsigned int flags)
{
struct fib_table *tb;
- int err = -ENETUNREACH;
+ int err = -EAGAIN;
flags |= FIB_LOOKUP_NOREF;
if (net->ipv4.fib_has_custom_rules)
@@ -384,17 +384,16 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
if (tb)
err = fib_table_lookup(tb, flp, res, flags);
- if (!err)
+ if (err != -EAGAIN)
goto out;
tb = rcu_dereference_rtnl(net->ipv4.fib_default);
if (tb)
err = fib_table_lookup(tb, flp, res, flags);
-out:
if (err == -EAGAIN)
err = -ENETUNREACH;
-
+out:
rcu_read_unlock();
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0772/1266] bpf, lsm: Add disabled BPF LSM hook list
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (770 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0771/1266] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0773/1266] bpf: Disable xfrm_decode_session hook attachment Greg Kroah-Hartman
` (226 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, KP Singh, Xu Kuohai,
Alexei Starovoitov, Andrii Nakryiko, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <xukuohai@huawei.com>
[ Upstream commit 21c7063f6d08ab9afa088584939791bee0c177e5 ]
Add a disabled hooks list for BPF LSM. progs being attached to the
listed hooks will be rejected by the verifier.
Suggested-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20240719110059.797546-2-xukuohai@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Stable-dep-of: 12091470c6b4 ("bpf: Disable xfrm_decode_session hook attachment")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/bpf_lsm.c | 31 +++++++++++++++++++++++++++++--
1 file changed, 29 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 92486a7b916e38..c7c4201644322b 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -36,6 +36,24 @@ BTF_SET_START(bpf_lsm_hooks)
#undef LSM_HOOK
BTF_SET_END(bpf_lsm_hooks)
+BTF_SET_START(bpf_lsm_disabled_hooks)
+BTF_ID(func, bpf_lsm_vm_enough_memory)
+BTF_ID(func, bpf_lsm_inode_need_killpriv)
+BTF_ID(func, bpf_lsm_inode_getsecurity)
+BTF_ID(func, bpf_lsm_inode_listsecurity)
+BTF_ID(func, bpf_lsm_inode_copy_up_xattr)
+BTF_ID(func, bpf_lsm_getselfattr)
+BTF_ID(func, bpf_lsm_getprocattr)
+BTF_ID(func, bpf_lsm_setprocattr)
+#ifdef CONFIG_KEYS
+BTF_ID(func, bpf_lsm_key_getsecurity)
+#endif
+#ifdef CONFIG_AUDIT
+BTF_ID(func, bpf_lsm_audit_rule_match)
+#endif
+BTF_ID(func, bpf_lsm_ismaclabel)
+BTF_SET_END(bpf_lsm_disabled_hooks)
+
/* List of LSM hooks that should operate on 'current' cgroup regardless
* of function signature.
*/
@@ -97,15 +115,24 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
const struct bpf_prog *prog)
{
+ u32 btf_id = prog->aux->attach_btf_id;
+ const char *func_name = prog->aux->attach_func_name;
+
if (!prog->gpl_compatible) {
bpf_log(vlog,
"LSM programs must have a GPL compatible license\n");
return -EINVAL;
}
- if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) {
+ if (btf_id_set_contains(&bpf_lsm_disabled_hooks, btf_id)) {
+ bpf_log(vlog, "attach_btf_id %u points to disabled hook %s\n",
+ btf_id, func_name);
+ return -EINVAL;
+ }
+
+ if (!btf_id_set_contains(&bpf_lsm_hooks, btf_id)) {
bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n",
- prog->aux->attach_btf_id, prog->aux->attach_func_name);
+ btf_id, func_name);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0773/1266] bpf: Disable xfrm_decode_session hook attachment
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (771 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0772/1266] bpf, lsm: Add disabled BPF LSM hook list Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0774/1266] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() Greg Kroah-Hartman
` (225 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Alexei Starovoitov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
[ Upstream commit 12091470c6b4c1c14b2de12dcbae2ada6cb6d20b ]
BPF LSM programs can currently attach to xfrm_decode_session(). That
hook may return an error, but security_skb_classify_flow() calls it
from a void path and triggers BUG_ON() if an error is returned.
Disable BPF attachment to the hook to prevent a BPF LSM program from
turning packet classification into a full panic.
Fixes: 9e4e01dfd325 ("bpf: lsm: Implement attach, detach and execution")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Link: https://lore.kernel.org/r/20260619130305.27779-1-include@grrlz.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/bpf_lsm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index c7c4201644322b..147c3a8ad4e8e0 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -51,6 +51,9 @@ BTF_ID(func, bpf_lsm_key_getsecurity)
#ifdef CONFIG_AUDIT
BTF_ID(func, bpf_lsm_audit_rule_match)
#endif
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+BTF_ID(func, bpf_lsm_xfrm_decode_session)
+#endif
BTF_ID(func, bpf_lsm_ismaclabel)
BTF_SET_END(bpf_lsm_disabled_hooks)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0774/1266] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (772 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0773/1266] bpf: Disable xfrm_decode_session hook attachment Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0775/1266] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
` (224 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mathias Krause, Pablo Neira Ayuso,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@grsecurity.net>
[ Upstream commit 069cfe3de2a5e16069485893cd04665ab769c1d8 ]
We ran into below KASAN splat, which is mostly uninteresting, beside
for having nf_nat_register_fn() in the call chain as a cause for the
offending access:
==================================================================
BUG: KASAN: slab-out-of-bounds in nf_nat_register_fn+0x5f9/0x640
Read of size 8 at addr ffff890031e54c20 by task iptables/9510
CPU: 0 UID: 0 PID: 9510 Comm: iptables Not tainted 6.18.18-grsec-full-20260320181326 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
[…] dump_stack_lvl+0xee/0x160 ffff88004117eeb8
[…] print_report+0x6e/0x640 ffff88004117eee0
[…] ? __phys_addr+0x8e/0x140 ffff88004117eef0
[…] ? kasan_addr_to_slab+0x51/0xe0 ffff88004117ef08
[…] ? complete_report_info+0xec/0x1c0 ffff88004117ef20
[…] ? nf_nat_register_fn+0x5f9/0x640 ffff88004117ef48
[…] kasan_report+0xbc/0x140 ffff88004117ef50
[…] ? nf_nat_register_fn+0x5f9/0x640 ffff88004117ef90
[…] nf_nat_register_fn+0x5f9/0x640 ffff88004117eff8
[…] ? nf_nat_icmp_reply_translation+0x6e0/0x6e0 ffff88004117f070
[…] nf_tables_register_hook.part.0+0xa0/0x220 ffff88004117f080
[…] nf_tables_addchain.constprop.0+0x1054/0x1fc0 ffff88004117f0b8
[…] ? nft_chain_lookup.part.0+0x4ce/0xac0 ffff88004117f130
[…] ? nf_tables_abort+0x3d80/0x3d80 ffff88004117f190
[…] ? nf_tables_dumpreset_obj+0x100/0x100 ffff88004117f1c8
[…] ? nft_table_lookup.part.0+0x255/0x300 ffff88004117f310
[…] ? nf_tables_newchain+0x21a4/0x2fa0 ffff88004117f358
[…] nf_tables_newchain+0x21a4/0x2fa0 ffff88004117f360
[…] ? nf_tables_addchain.constprop.0+0x1fc0/0x1fc0 ffff88004117f458
[…] ? nla_get_range_signed+0x4a0/0x4a0 ffff88004117f488
[…] ? lock_acquire+0x16f/0x320 ffff88004117f490
[…] ? find_held_lock+0x3b/0xe0 ffff88004117f4b0
[…] ? __nla_parse+0x45/0x80 ffff88004117f500
[…] nfnetlink_rcv_batch+0xbca/0x19a0 ffff88004117f550
[…] ? nfnetlink_net_exit_batch+0x120/0x120 ffff88004117f618
[…] ? __sanitizer_cov_trace_switch+0x63/0xe0 ffff88004117f720
[…] ? gr_acl_handle_mmap+0x1c4/0x320 ffff88004117f7c0
[…] ? nla_get_range_signed+0x4a0/0x4a0 ffff88004117f7e8
[…] ? gr_is_capable+0x6f/0xe0 ffff88004117f830
[…] ? __nla_parse+0x45/0x80 ffff88004117f860
[…] ? skb_pull+0x103/0x1a0 ffff88004117f880
[…] nfnetlink_rcv+0x3db/0x4a0 ffff88004117f8b0
[…] ? nfnetlink_rcv_batch+0x19a0/0x19a0 ffff88004117f8d8
[…] ? netlink_lookup+0xe2/0x240 ffff88004117f900
[…] netlink_unicast+0x74b/0xb00 ffff88004117f930
[…] ? netlink_attachskb+0xb20/0xb20 ffff88004117f980
[…] ? __check_object_size+0x3e/0xaa0 ffff88004117f998
[…] ? security_netlink_send+0x51/0x160 ffff88004117f9c8
[…] netlink_sendmsg+0xa03/0x1200 ffff88004117f9f8
[…] ? netlink_unicast+0xb00/0xb00 ffff88004117fa70
[…] ? netlink_unicast+0xb00/0xb00 ffff88004117fac8
[…] ? ____sys_sendmsg+0xe2a/0x1040 ffff88004117faf8
[…] ____sys_sendmsg+0xe2a/0x1040 ffff88004117fb00
[…] ? kernel_recvmsg+0x300/0x300 ffff88004117fb60
[…] ? reacquire_held_locks+0xe9/0x260 ffff88004117fbc8
[…] ___sys_sendmsg+0x138/0x200 ffff88004117fbf8
[…] ? do_recvmmsg+0x7e0/0x7e0 ffff88004117fc30
[…] ? lockdep_hardirqs_on_prepare+0x101/0x1e0 ffff88004117fc50
[…] ? lock_acquire+0x16f/0x320 ffff88004117fd20
[…] ? lock_acquire+0x16f/0x320 ffff88004117fd58
[…] ? find_held_lock+0x3b/0xe0 ffff88004117fd70
[…] __sys_sendmsg+0x17a/0x260 ffff88004117fdc8
[…] ? __sys_sendmsg_sock+0x80/0x80 ffff88004117fdf0
[…] ? syscall_trace_enter+0x15e/0x2c0 ffff88004117fe98
[…] do_syscall_64+0x7d/0x400 ffff88004117fec8
[…] entry_SYSCALL_64_safe_stack+0x4a/0x60 ffff88004117fef8
</TASK>
==================================================================
The out-of-bounds report, though, is a red herring as it is for an
access that shouldn't have happened in the first place.
When nf_nat_init() fails to register its BPF kfuncs, it'll unwind and,
among others, call unregister_pernet_subsys() to deregister its per-net
ops. This makes the previously allocated net id available for reuse by
the next caller of register_pernet_subsys(), in our case, synproxy.
However, 'nat_net_id' will still hold the previously allocated value.
If nf_nat.o gets build as a module, all this doesn't matter. A failed
initialization routine makes the module fail to load and any dependent
module won't be able to load either. However, if nf_nat.o is built-in,
a failing init won't /completely/ make its functionality unavailable to
dependent modules, namely the code and static data is still there, free
to be called by modules like nft_chain_nat.ko.
Case in point, nft_chain_nat registers hooks that'll call into nf_nat
which, in our case, failed to initialize and therefore won't have a
valid net id nor related net_nat object any more.
Code in nf_nat, namely nf_nat_register_fn() and nf_nat_unregister_fn(),
still making use of the reallocated net id, lead to a type confusion as
the call to net_generic() will no longer return memory belonging to an
object suited to fit 'struct nat_net' but 'struct synproxy_net' instead.
The latter is only 24 bytes on 64-bit systems, much smaller than struct
nat_net which is 176 bytes, perfectly explaining the OOB KASAN report.
Detect and handle a failed nf_nat_init() by testing the 'nf_nat_hook'
pointer which will be reset to NULL on initialization errors to prevent
the usage of an invalid nat_net pointer.
As this check is only needed when nf_nat.o is built-in, guard it by
'#ifndef MODULE...'.
Fixes: cbc1dd5b659f ("netfilter: nf_nat: Fix possible memory leak in nf_nat_init()")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_nat_core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 2500e409757d0d..d29767646ffa54 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -1204,6 +1204,16 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
struct nf_hook_ops *nat_ops;
int i, ret;
+#ifndef MODULE
+ /* If nf_nat_core is built-in and nf_nat_init() fails, dependent
+ * modules like nft_chain_nat.ko may still call this function.
+ * However, nat_net would be invalid, likely pointing to some other
+ * per-net structure.
+ */
+ if (WARN_ON_ONCE(!nf_nat_hook))
+ return -EOPNOTSUPP;
+#endif
+
if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0775/1266] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (773 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0774/1266] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0776/1266] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
` (223 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alejandro Olivan Alvarez,
Fernando Fernandez Mancera, Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit c8b6f36f766991e3ebebec6596daee4b04dcbc49 ]
Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
was skipped") introduced a regression where packets for valid
connections are dropped when using connlimit for soft-limiting
scenarios.
The issue occurs when a new connection reuses a socket currently in
the TIME_WAIT state. In this scenario, the connection tracking entry
is evaluated as already confirmed. Previously, __nf_conncount_add()
assumed that if a connection was confirmed and did not originate from
the loopback interface, it should skip the addition and return -EEXIST.
Skipping the addition triggers a garbage collection run that cleans up
the TIME_WAIT connection. Consequently, the active connection count
drops to 0, which xt_connlimit mishandles, leading to the false rejection
of the perfectly valid new connection.
Fix this by replacing the interface check with protocol-agnostic state
checks. We now skip the tree insertion and preserve the lockless garbage
collection optimization only if the connection is IPS_ASSURED. This
allows early-confirmed setup packets (such as reused TIME_WAIT sockets
or locally generated SYN-ACKs) to be properly evaluated and counted
without falsely dropping. The goto check_connections path is maintained
to ensure these setup packets are deduplicated correctly.
This has been tested with slowhttptest and HTTP server configured
locally to ensure we are not breaking soft-limiting scenarios for local
or external connections. In addition, it was tested with a OVS zone
limit too.
Fixes: 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped")
Reported-by: Alejandro Olivan Alvarez <alejandro.olivan.alvarez@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/177349610461.3071718.4083978280323144323@eldamar.lan/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conncount.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index b9265a8cdb2bc4..79b0d9c8de56d9 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -179,17 +179,16 @@ static int __nf_conncount_add(struct net *net,
return -ENOENT;
if (ct && nf_ct_is_confirmed(ct)) {
- /* local connections are confirmed in postrouting so confirmation
- * might have happened before hitting connlimit
+ /* Connection is confirmed but might still be in the setup phase.
+ * Only skip the tracking if it is fully assured. This guarantees
+ * that setup packets or retransmissions are properly counted and
+ * deduplicated.
*/
- if (skb->skb_iif != LOOPBACK_IFINDEX) {
+ if (test_bit(IPS_ASSURED_BIT, &ct->status)) {
err = -EEXIST;
goto out_put;
}
- /* this is likely a local connection, skip optimization to avoid
- * adding duplicates from a 'packet train'
- */
goto check_connections;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0776/1266] netfilter: nft_synproxy: stop bypassing the priv->info snapshot
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (774 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0775/1266] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0777/1266] netfilter: nft_compat: ebtables emulation must reject non-bridge targets Greg Kroah-Hartman
` (222 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao,
Fernando Fernandez Mancera, Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 11d4bc4e26fb66040a5b5d95e9abf37deac2b1fc ]
nft_synproxy_eval_v4() and nft_synproxy_eval_v6() already take a
whole-object READ_ONCE() snapshot of the shared priv->info state before
building the SYNACK reply, but nft_synproxy_tcp_options() still masks
opts->options with priv->info.options from the live shared object.
When a named synproxy object is updated concurrently with SYN traffic,
the eval path can then mix mss and timestamp handling from the local
snapshot with an options mask taken from a newer configuration, so one
SYNACK no longer reflects a coherent synproxy configuration.
Use info->options so nft_synproxy_tcp_options() stays on the same local
snapshot that the eval path already copied from priv->info.
Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_synproxy.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 4d3e5a31b4125d..ad3e7d27f02e9d 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -23,14 +23,13 @@ static const struct nla_policy nft_synproxy_policy[NFTA_SYNPROXY_MAX + 1] = {
static void nft_synproxy_tcp_options(struct synproxy_options *opts,
const struct tcphdr *tcp,
struct synproxy_net *snet,
- struct nf_synproxy_info *info,
- const struct nft_synproxy *priv)
+ struct nf_synproxy_info *info)
{
this_cpu_inc(snet->stats->syn_received);
if (tcp->ece && tcp->cwr)
opts->options |= NF_SYNPROXY_OPT_ECN;
- opts->options &= priv->info.options;
+ opts->options &= info->options;
opts->mss_encode = opts->mss_option;
opts->mss_option = info->mss;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
@@ -55,7 +54,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
if (tcp->syn) {
/* Initial SYN from client */
- nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+ nft_synproxy_tcp_options(opts, tcp, snet, &info);
synproxy_send_client_synack(net, skb, tcp, opts);
consume_skb(skb);
regs->verdict.code = NF_STOLEN;
@@ -86,7 +85,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
if (tcp->syn) {
/* Initial SYN from client */
- nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+ nft_synproxy_tcp_options(opts, tcp, snet, &info);
synproxy_send_client_synack_ipv6(net, skb, tcp, opts);
consume_skb(skb);
regs->verdict.code = NF_STOLEN;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0777/1266] netfilter: nft_compat: ebtables emulation must reject non-bridge targets
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (775 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0776/1266] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0778/1266] NTB: epf: Make db_valid_mask cover only real doorbell bits Greg Kroah-Hartman
` (221 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ren Wei, Wyatt Feng, Yuan Tan,
Yifan Wu, Juefei Pu, Zhengchuan Liang, Xin Liu, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 9dbba7e694ec045f21ede2f892fb42b81b4e1692 ]
xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so
on. ebtables targets return incompatible verdicts: EBT_ACCEPT,
EBT_DROP, ... We cannot allow fallback to NFPROTO_UNSPEC.
ebtables doesn't permit this since
11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")
but that commit missed the nft_compat layer.
Reported-by: Ren Wei <n05ec@lzu.edu.cn>
Reported-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_compat.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 1e8142e64e8082..67a138b9be3a6b 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -389,6 +389,22 @@ static int nft_target_validate(const struct nft_ctx *ctx,
return 0;
}
+static int nft_target_bridge_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+{
+ struct xt_target *target = expr->ops->data;
+
+ /* Do not allow UNSPEC to stand-in for NFPROTO_BRIDGE
+ * targets: they are incompatible. ebtables targets return
+ * EBT_ACCEPT, DROP and so on which are not compatible with
+ * NF_ACCEPT, NF_DROP and so on.
+ */
+ if (target->family != NFPROTO_BRIDGE)
+ return -ENOENT;
+
+ return nft_target_validate(ctx, expr);
+}
+
static void __nft_match_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt,
@@ -916,14 +932,16 @@ nft_target_select_ops(const struct nft_ctx *ctx,
ops->init = nft_target_init;
ops->destroy = nft_target_destroy;
ops->dump = nft_target_dump;
- ops->validate = nft_target_validate;
ops->data = target;
ops->reduce = NFT_REDUCE_READONLY;
- if (family == NFPROTO_BRIDGE)
+ if (family == NFPROTO_BRIDGE) {
ops->eval = nft_target_eval_bridge;
- else
+ ops->validate = nft_target_bridge_validate;
+ } else {
ops->eval = nft_target_eval_xt;
+ ops->validate = nft_target_validate;
+ }
return ops;
err:
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0778/1266] NTB: epf: Make db_valid_mask cover only real doorbell bits
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (776 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0777/1266] netfilter: nft_compat: ebtables emulation must reject non-bridge targets Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0779/1266] NTB: epf: Report 0-based doorbell vector via ntb_db_event() Greg Kroah-Hartman
` (220 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Manivannan Sadhasivam,
Bjorn Helgaas, Frank Li, Dave Jiang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 6eb7e28f1f24a28234add38755687a7ed8bc2654 ]
ndev->db_count includes an unused doorbell slot due to the legacy extra
offset in the peer doorbell path. db_valid_mask must cover only the real
doorbell bits and exclude the unused slot.
Set db_valid_mask to BIT_ULL(db_count - 1) - 1.
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260513024923.451765-10-den@valinux.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index ba81311a27b430..db744750529121 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -560,7 +560,11 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
return ret;
}
- ndev->db_valid_mask = BIT_ULL(ndev->db_count) - 1;
+ /*
+ * ndev->db_count includes an extra skipped slot due to the legacy
+ * doorbell layout, hence -1.
+ */
+ ndev->db_valid_mask = BIT_ULL(ndev->db_count - 1) - 1;
ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0779/1266] NTB: epf: Report 0-based doorbell vector via ntb_db_event()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (777 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0778/1266] NTB: epf: Make db_valid_mask cover only real doorbell bits Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0780/1266] NTB: epf: Fix doorbell bitmask and IRQ vector handling Greg Kroah-Hartman
` (219 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Jiang, Koichiro Den,
Manivannan Sadhasivam, Bjorn Helgaas, Frank Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 3147f0964cecca15e349cbfbdd6a28eb6d50379d ]
ntb_db_event() expects the vector number to be relative to the first
doorbell vector starting at 0.
Vector 0 is reserved for link events in the EPF driver, so doorbells
start at vector 1. However, both supported peers (ntb_hw_epf with
pci-epf-ntb, and pci-epf-vntb) have historically skipped vector 1 and
started doorbells at vector 2.
Pass (irq_no - 2) to ntb_db_event() so doorbells are reported as 0..N-1.
If irq_no == 1 is ever observed, warn and ignore it, since the slot is
reserved in the legacy layout and reporting it as DB#0 would collide with
the real DB#0 slot.
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Suggested-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260513024923.451765-11-den@valinux.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index db744750529121..be5b1ef4aeff40 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -69,6 +69,12 @@ enum epf_ntb_bar {
NTB_BAR_NUM,
};
+enum epf_irq_slot {
+ EPF_IRQ_LINK = 0,
+ EPF_IRQ_RESERVED_DB, /* Historically skipped slot */
+ EPF_IRQ_DB_START,
+};
+
#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
struct ntb_epf_dev {
@@ -322,10 +328,14 @@ static irqreturn_t ntb_epf_vec_isr(int irq, void *dev)
irq_no = irq - ndev->irq_base;
ndev->db_val = irq_no + 1;
- if (irq_no == 0)
+ if (irq_no == EPF_IRQ_LINK) {
ntb_link_event(&ndev->ntb);
- else
- ntb_db_event(&ndev->ntb, irq_no);
+ } else if (irq_no == EPF_IRQ_RESERVED_DB) {
+ dev_warn_ratelimited(ndev->dev,
+ "Unexpected reserved doorbell slot IRQ received\n");
+ } else {
+ ntb_db_event(&ndev->ntb, irq_no - EPF_IRQ_DB_START);
+ }
return IRQ_HANDLED;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0780/1266] NTB: epf: Fix doorbell bitmask and IRQ vector handling
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (778 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0779/1266] NTB: epf: Report 0-based doorbell vector via ntb_db_event() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0781/1266] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
` (218 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Jiang, Koichiro Den,
Manivannan Sadhasivam, Bjorn Helgaas, Frank Li, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 4fdea8dbb62d746429498e07385a3ba0b0f6d1ab ]
The EPF driver currently stores the incoming doorbell as a vector number
(irq_no + 1) in db_val and db_clear() clears all bits unconditionally.
This breaks db_read()/db_clear() semantics when multiple doorbells are
used.
Store doorbells as a bitmask (BIT_ULL(vector)) and make
db_clear(db_bits) clear only the specified bits. Use atomic64 operations
as db_val is updated from interrupt context.
Once db_val is stored as a bitmask, the ISR's doorbell vector is used
not only for ntb_db_event(), but also as the bit index for BIT_ULL().
The existing ISR derives that vector by subtracting pci_irq_vector(pdev,
0) from the Linux IRQ number passed to the handler, but Linux IRQ
numbers are not guaranteed to be contiguous.
Pass per-vector context as request_irq() dev_id instead, so the ISR gets
the device vector directly.
Validate the doorbell vector before updating db_val or calling
ntb_db_event(), so an unexpected vector cannot create an invalid shift
or be reported to NTB clients.
While at it, read and validate mw_count before requesting interrupt
vectors. An unsupported memory-window count does not need IRQs, and
failing before ntb_epf_init_isr() keeps the probe error path simple.
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Suggested-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260513024923.451765-12-den@valinux.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/epf/ntb_hw_epf.c | 61 +++++++++++++++++++++------------
1 file changed, 39 insertions(+), 22 deletions(-)
diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index be5b1ef4aeff40..25c3f30de6517f 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -6,6 +6,7 @@
* Author: Kishon Vijay Abraham I <kishon@ti.com>
*/
+#include <linux/atomic.h>
#include <linux/delay.h>
#include <linux/module.h>
#include <linux/pci.h>
@@ -77,6 +78,13 @@ enum epf_irq_slot {
#define NTB_EPF_MAX_MW_COUNT (NTB_BAR_NUM - BAR_MW1)
+struct ntb_epf_dev;
+
+struct ntb_epf_irq_ctx {
+ struct ntb_epf_dev *ndev;
+ unsigned int irq_no;
+};
+
struct ntb_epf_dev {
struct ntb_dev ntb;
struct device *dev;
@@ -96,9 +104,9 @@ struct ntb_epf_dev {
unsigned int self_spad;
unsigned int peer_spad;
- int db_val;
+ atomic64_t db_val;
u64 db_valid_mask;
- int irq_base;
+ struct ntb_epf_irq_ctx irq_ctx[NTB_EPF_MAX_DB_COUNT + 1];
};
#define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
@@ -322,11 +330,10 @@ static int ntb_epf_link_disable(struct ntb_dev *ntb)
static irqreturn_t ntb_epf_vec_isr(int irq, void *dev)
{
- struct ntb_epf_dev *ndev = dev;
- int irq_no;
-
- irq_no = irq - ndev->irq_base;
- ndev->db_val = irq_no + 1;
+ struct ntb_epf_irq_ctx *ctx = dev;
+ struct ntb_epf_dev *ndev = ctx->ndev;
+ unsigned int db_vector;
+ unsigned int irq_no = ctx->irq_no;
if (irq_no == EPF_IRQ_LINK) {
ntb_link_event(&ndev->ntb);
@@ -334,7 +341,17 @@ static irqreturn_t ntb_epf_vec_isr(int irq, void *dev)
dev_warn_ratelimited(ndev->dev,
"Unexpected reserved doorbell slot IRQ received\n");
} else {
- ntb_db_event(&ndev->ntb, irq_no - EPF_IRQ_DB_START);
+ db_vector = irq_no - EPF_IRQ_DB_START;
+ if (ndev->db_count < NTB_EPF_MIN_DB_COUNT ||
+ db_vector >= ndev->db_count - 1) {
+ dev_warn_ratelimited(ndev->dev,
+ "Unexpected doorbell vector %u (db_count %u)\n",
+ db_vector, ndev->db_count);
+ return IRQ_HANDLED;
+ }
+
+ atomic64_or(BIT_ULL(db_vector), &ndev->db_val);
+ ntb_db_event(&ndev->ntb, db_vector);
}
return IRQ_HANDLED;
@@ -361,18 +378,18 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
argument &= ~MSIX_ENABLE;
}
- ndev->irq_base = pci_irq_vector(pdev, 0);
+ ndev->db_count = irq - 1;
for (i = 0; i < irq; i++) {
+ ndev->irq_ctx[i].ndev = ndev;
+ ndev->irq_ctx[i].irq_no = i;
ret = request_irq(pci_irq_vector(pdev, i), ntb_epf_vec_isr,
- 0, "ntb_epf", ndev);
+ 0, "ntb_epf", &ndev->irq_ctx[i]);
if (ret) {
dev_err(dev, "Failed to request irq\n");
goto err_free_irq;
}
}
- ndev->db_count = irq - 1;
-
ret = ntb_epf_send_command(ndev, CMD_CONFIGURE_DOORBELL,
argument | irq);
if (ret) {
@@ -384,7 +401,7 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
err_free_irq:
while (i--)
- free_irq(pci_irq_vector(pdev, i), ndev);
+ free_irq(pci_irq_vector(pdev, i), &ndev->irq_ctx[i]);
pci_free_irq_vectors(pdev);
return ret;
@@ -509,7 +526,7 @@ static u64 ntb_epf_db_read(struct ntb_dev *ntb)
{
struct ntb_epf_dev *ndev = ntb_ndev(ntb);
- return ndev->db_val;
+ return atomic64_read(&ndev->db_val);
}
static int ntb_epf_db_clear_mask(struct ntb_dev *ntb, u64 db_bits)
@@ -521,7 +538,7 @@ static int ntb_epf_db_clear(struct ntb_dev *ntb, u64 db_bits)
{
struct ntb_epf_dev *ndev = ntb_ndev(ntb);
- ndev->db_val = 0;
+ atomic64_and(~db_bits, &ndev->db_val);
return 0;
}
@@ -562,6 +579,12 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
struct device *dev = ndev->dev;
int ret;
+ ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
+ if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
+ dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
+ return -EINVAL;
+ }
+
/* One Link interrupt and rest doorbell interrupt */
ret = ntb_epf_init_isr(ndev, NTB_EPF_MIN_DB_COUNT + 1,
NTB_EPF_MAX_DB_COUNT + 1);
@@ -575,14 +598,8 @@ static int ntb_epf_init_dev(struct ntb_epf_dev *ndev)
* doorbell layout, hence -1.
*/
ndev->db_valid_mask = BIT_ULL(ndev->db_count - 1) - 1;
- ndev->mw_count = readl(ndev->ctrl_reg + NTB_EPF_MW_COUNT);
ndev->spad_count = readl(ndev->ctrl_reg + NTB_EPF_SPAD_COUNT);
- if (ndev->mw_count > NTB_EPF_MAX_MW_COUNT) {
- dev_err(dev, "Unsupported MW count: %u\n", ndev->mw_count);
- return -EINVAL;
- }
-
return 0;
}
@@ -677,7 +694,7 @@ static void ntb_epf_cleanup_isr(struct ntb_epf_dev *ndev)
ntb_epf_send_command(ndev, CMD_TEARDOWN_DOORBELL, ndev->db_count + 1);
for (i = 0; i < ndev->db_count + 1; i++)
- free_irq(pci_irq_vector(pdev, i), ndev);
+ free_irq(pci_irq_vector(pdev, i), &ndev->irq_ctx[i]);
pci_free_irq_vectors(pdev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0781/1266] alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (779 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0780/1266] NTB: epf: Fix doorbell bitmask and IRQ vector handling Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0782/1266] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
` (217 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm, Shivaprasad G Bhat,
Ilpo Järvinen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit 78a228f0aa0e9eba31955950c8a40a9945e2c8bb ]
Currently, Alpha's pci_mmap_resource() does not check
security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap
PCI BARs.
The generic version has had this check since commit eb627e17727e ("PCI:
Lock down BAR access when the kernel is locked down") to prevent DMA
attacks when the kernel is locked down.
Add the same check to Alpha's pci_mmap_resource().
Fixes: eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-12-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/pci-sysfs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 5808a66e2a81f7..80a5fd642e7f32 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -11,6 +11,7 @@
*/
#include <linux/sched.h>
+#include <linux/security.h>
#include <linux/stat.h>
#include <linux/slab.h>
#include <linux/pci.h>
@@ -71,7 +72,11 @@ static int pci_mmap_resource(struct kobject *kobj,
struct resource *res = attr->private;
enum pci_mmap_state mmap_type;
struct pci_bus_region bar;
- int i;
+ int i, ret;
+
+ ret = security_locked_down(LOCKDOWN_PCI_ACCESS);
+ if (ret)
+ return ret;
for (i = 0; i < PCI_STD_NUM_BARS; i++)
if (res == &pdev->resource[i])
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0782/1266] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (780 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0781/1266] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0783/1266] net, bpf: check master for NULL in xdp_master_redirect() Greg Kroah-Hartman
` (216 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm, Shivaprasad G Bhat,
Ilpo Järvinen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit 802a3b3f470b9bc1148f26e01fc9cbfeb4dfcb57 ]
Currently, __pci_mmap_fits() computes the BAR size using
"pci_resource_len() - 1", which wraps to a large value when the BAR length
is zero, causing the bounds check to incorrectly succeed.
Add an early return for empty resources.
Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-15-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/pci-sysfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 80a5fd642e7f32..22187531abb9a3 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -37,12 +37,16 @@ static int hose_mmap_page_range(struct pci_controller *hose,
static int __pci_mmap_fits(struct pci_dev *pdev, int num,
struct vm_area_struct *vma, int sparse)
{
+ resource_size_t len = pci_resource_len(pdev, num);
unsigned long nr, start, size;
int shift = sparse ? 5 : 0;
+ if (!len)
+ return 0;
+
nr = vma_pages(vma);
start = vma->vm_pgoff;
- size = ((pci_resource_len(pdev, num) - 1) >> (PAGE_SHIFT - shift)) + 1;
+ size = ((len - 1) >> (PAGE_SHIFT - shift)) + 1;
if (start < size && size - start >= nr)
return 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0783/1266] net, bpf: check master for NULL in xdp_master_redirect()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (781 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0782/1266] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0784/1266] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
` (215 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Jiayuan Chen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit e82d8cc4321c373dc46e741cd2dfdaa7921fddb7 ]
xdp_master_redirect() dereferences the result of
netdev_master_upper_dev_get_rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.
The reach guard only checks netif_is_bond_slave(). On bond slave release
bond_upper_dev_unlink() drops the upper-master adjacency before clearing
IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window
still passes netif_is_bond_slave() while master is already NULL, and
faults on master->flags at offset 0xb0:
BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)
Call Trace:
xdp_master_redirect (net/core/filter.c:4432)
bpf_prog_run_generic_xdp (include/net/xdp.h:700)
do_xdp_generic (net/core/dev.c:5608)
__netif_receive_skb_one_core (net/core/dev.c:6204)
process_backlog (net/core/dev.c:6319)
__napi_poll (net/core/dev.c:7729)
net_rx_action (net/core/dev.c:7792)
handle_softirqs (kernel/softirq.c:622)
__dev_queue_xmit (include/linux/bottom_half.h:33)
packet_sendmsg (net/packet/af_packet.c:3082)
__sys_sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt
The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.
Fixes: 879af96ffd72 ("net, core: Add support for XDP redirection to slave device")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260620201531.180123-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 5bbad21c7757c3..62d21a961e5ec2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4393,7 +4393,7 @@ u32 xdp_master_redirect(struct xdp_buff *xdp)
struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info);
master = netdev_master_upper_dev_get_rcu(xdp->rxq->dev);
- if (unlikely(!(master->flags & IFF_UP)))
+ if (unlikely(!master || !(master->flags & IFF_UP)))
return XDP_ABORTED;
slave = master->netdev_ops->ndo_xdp_get_xmit_slave(master, xdp);
if (slave && slave != xdp->rxq->dev) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0784/1266] net: dsa: sja1105: round up PTP perout pin duration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (782 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0783/1266] net, bpf: check master for NULL in xdp_master_redirect() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0785/1266] veth: fix NAPI leak in XDP enable error path Greg Kroah-Hartman
` (214 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksandrova Alyona, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrova Alyona <aga@itb.spb.ru>
[ Upstream commit aee5836273b07b439fb245fb43930664d8b78518 ]
pin_duration is converted from the user-provided period to SJA1105
clock ticks and is later passed as the cycle_time argument to
future_base_time().
Very small period values may become zero after the conversion,
which can lead to a division by zero in future_base_time().
Round zero pin_duration up to 1 tick so that the smallest unsupported
periods use the minimum non-zero hardware duration instead of passing
zero to future_base_time().
Fixes: 747e5eb31d59 ("net: dsa: sja1105: configure the PTP_CLK pin as EXT_TS or PER_OUT")
Signed-off-by: Aleksandrova Alyona <aga@itb.spb.ru>
Link: https://patch.msgid.link/20260618110508.53094-1-aga@itb.spb.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
index a7d41e7813982e..afb11690c21712 100644
--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
+++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
@@ -755,7 +755,7 @@ static int sja1105_per_out_enable(struct sja1105_private *priv,
* 2 edges on PTP_CLK. So check for truncation which happens
* at periods larger than around 68.7 seconds.
*/
- pin_duration = ns_to_sja1105_ticks(pin_duration / 2);
+ pin_duration = max_t(u64, ns_to_sja1105_ticks(pin_duration / 2), 1);
if (pin_duration > U32_MAX) {
rc = -ERANGE;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0785/1266] veth: fix NAPI leak in XDP enable error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (783 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0784/1266] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0786/1266] net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle Greg Kroah-Hartman
` (213 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Eric Dumazet,
Björn Töpel, Daniel Borkmann, Ilias Apalodimas,
Michael S. Tsirkin, Tariq Toukan, Pavan Chebbi, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6739027cb72da26890edd424c77080d187b2a92e ]
During XDP enablement in veth, if xdp_rxq_info_reg() or
xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.
However, the rollback loop:
for (i--; i >= start; i--) {
decrements the loop index 'i' before the first iteration. This
correctly skips unregistering the rxq for the failed index 'i' (as
registration failed or was already cleaned up), but it also
erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.
Since netif_napi_add() was already called for index 'i', this leaves
a dangling napi_struct in the device's napi_list. When the veth
device is later destroyed, the freed queue memory (which contains the
leaked NAPI structure) can be reused.
The subsequent device teardown iterates the NAPI list and
corrupts the reallocated memory, leading to UAF.
Fix this by explicitly deleting the NAPI association for the failed
index 'i' before rolling back the successfully configured queues.
Fixes: b02e5a0ebb17 ("xsk: Propagate napi_id to XDP socket Rx path")
Reported-by: Guenter Roeck <groeck@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Björn Töpel <bjorn.topel@intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260622111825.88337-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/veth.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2b3b0beb55c88b..d85a11e9477f04 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1159,6 +1159,8 @@ static int veth_enable_xdp_range(struct net_device *dev, int start, int end,
err_reg_mem:
xdp_rxq_info_unreg(&priv->rq[i].xdp_rxq);
err_rxq_reg:
+ if (!napi_already_on)
+ netif_napi_del(&priv->rq[i].xdp_napi);
for (i--; i >= start; i--) {
struct veth_rq *rq = &priv->rq[i];
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0786/1266] net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (784 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0785/1266] veth: fix NAPI leak in XDP enable error path Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0787/1266] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
` (212 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zero Day Initiative, Victor Nogueira,
Jamal Hadi Salim, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit a8a02897f2b479127db261de05cbf0c28b98d159 ]
tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the
defragmentation engine (e.g. act_ct on out-of-order fragments). When
that happens the skb is no longer owned by the caller and must not be
touched again.
tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the
switch and returned the skb to the caller as if classification had
passed. The only qdisc that wires up qevents today is RED, via three call sites
(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)
red_enqueue() was continuing to operate on an skb it no longer owns in this
case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10
tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order
fragments, e.g. a fragmented UDP stream)
Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress
and egress fast paths do: treat it as stolen and return NULL without
touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be
dropped/freed here, as it is no longer owned by us.
Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260620130749.226642-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 45124fd64d6b48..2c3af83c01c4f6 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -3971,6 +3971,9 @@ struct sk_buff *tcf_qevent_handle(struct tcf_qevent *qe, struct Qdisc *sch, stru
skb_do_redirect(skb);
*ret = __NET_XMIT_STOLEN;
return NULL;
+ case TC_ACT_CONSUMED:
+ *ret = __NET_XMIT_STOLEN;
+ return NULL;
}
return skb;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0787/1266] ipv6: fix error handling in disable_ipv6 sysctl
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (785 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0786/1266] net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0788/1266] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
` (211 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit c779441e5070e2268bdfe77f6e2e0de926c431e3 ]
When writing to the disable_ipv6 sysctl, if proc_dointvec() fails to
parse the input, it returns a negative error code. The current
implementation is overwriting that error for write operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: 56d417b12e57 ("IPv6: Add 'autoconf' and 'disable_ipv6' module parameters")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-2-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5f32793a29eafa..e8ca9f56658eaa 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6441,6 +6441,8 @@ static int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_disable_ipv6(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0788/1266] ipv6: fix error handling in ignore_routes_with_linkdown sysctl
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (786 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0787/1266] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0789/1266] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
` (210 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit cf4f2b14401f29ccac56393ca9e4b42a2505f540 ]
When writing to the ignore_routes_with_linkdown sysctl, if
proc_dointvec() fails to parse the input, it returns a negative error
code. The current implementation is overwriting that error for write
operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: 35103d11173b ("net: ipv6 sysctl option to ignore routes when nexthop link is down")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-3-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e8ca9f56658eaa..cd981fbbc60a19 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6639,6 +6639,8 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_fixup_linkdown(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0789/1266] ipv6: fix error handling in forwarding sysctl
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (787 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0788/1266] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0790/1266] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
` (209 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 058b9b19f9639fe1e1225a17c540f61b65bee6ad ]
When writing to the forwarding sysctl, if proc_dointvec() fails to parse
the input, it returns a negative error code. The current implementation
is overwriting that error for write operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure. In addition, adjust return code of
addrconf_fixup_forwarding() for successful operation.
Fixes: b325fddb7f86 ("ipv6: Fix sysctl unregistration deadlock")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-4-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cd981fbbc60a19..de50c77f087ff7 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -916,7 +916,7 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
if (newf)
rt6_purge_dflt_routers(net);
- return 1;
+ return 0;
}
static void addrconf_linkdown_change(struct net *net, __s32 newf)
@@ -6344,6 +6344,8 @@ static int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_fixup_forwarding(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0790/1266] ipv6: fix error handling in disable_policy sysctl
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (788 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0789/1266] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0791/1266] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
` (208 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 3e0e51c0ee1d08cc9d48dc17f3248d5b31cf8066 ]
When writing to the disable_policy sysctl, if proc_dointvec() fails to
parse the input, it returns a negative error code. The current
implementation is resetting the position argument even if an error
occurred during proc_dointvec() and not only during sysctl restart.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: df789fe75206 ("ipv6: Provide ipv6 version of "disable_policy" sysctl")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-5-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index de50c77f087ff7..83dc90a8990c92 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6738,6 +6738,8 @@ static int addrconf_sysctl_disable_policy(struct ctl_table *ctl, int write,
lctl = *ctl;
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write && (*valp != val))
ret = addrconf_disable_policy(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0791/1266] smb/client: preserve errors from smb2_set_sparse()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (789 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0790/1266] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0792/1266] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
` (207 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huiwen He, ChenXiaoSong,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 2a4b3d2db5c6fcdba889baf7b2ae5661b0beac89 ]
smb2_set_sparse() converts every FSCTL_SET_SPARSE failure to false and
marks sparse support as broken for the share. Callers therefore report
EOPNOTSUPP even for errors such as ENOSPC or EACCES, and later sparse
operations remain disabled until the share is unmounted.
Return the SMB2 ioctl error directly. Set broken_sparse_sup only for
EOPNOTSUPP, which indicates that the server does not support the request.
Update smb3_punch_hole() to propagate the error returned by
smb2_set_sparse().
Fixes: 3d1a3745d8ca ("Add sparse file support to SMB2/SMB3 mounts")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 44b3796318d42a..084804bab5cfc7 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -1967,8 +1967,9 @@ smb2_sync_write(const unsigned int xid, struct cifs_fid *pfid,
}
/* Set or clear the SPARSE_FILE attribute based on value passed in setsparse */
-static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
- struct cifsFileInfo *cfile, struct inode *inode, __u8 setsparse)
+static int smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifsFileInfo *cfile, struct inode *inode,
+ __u8 setsparse)
{
struct cifsInodeInfo *cifsi;
int rc;
@@ -1977,31 +1978,31 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
/* if file already sparse don't bother setting sparse again */
if ((cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) && setsparse)
- return true; /* already sparse */
+ return 0; /* already sparse */
if (!(cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) && !setsparse)
- return true; /* already not sparse */
+ return 0; /* already not sparse */
/*
* Can't check for sparse support on share the usual way via the
* FS attribute info (FILE_SUPPORTS_SPARSE_FILES) on the share
* since Samba server doesn't set the flag on the share, yet
* supports the set sparse FSCTL and returns sparse correctly
- * in the file attributes. If we fail setting sparse though we
- * mark that server does not support sparse files for this share
- * to avoid repeatedly sending the unsupported fsctl to server
- * if the file is repeatedly extended.
+ * in the file attributes. If the server returns EOPNOTSUPP, mark
+ * that sparse files are not supported on this share to avoid
+ * repeatedly sending the unsupported FSCTL.
*/
if (tcon->broken_sparse_sup)
- return false;
+ return -EOPNOTSUPP;
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
&setsparse, 1, CIFSMaxBufSize, NULL, NULL);
if (rc) {
- tcon->broken_sparse_sup = true;
+ if (rc == -EOPNOTSUPP)
+ tcon->broken_sparse_sup = true;
cifs_dbg(FYI, "set sparse rc = %d\n", rc);
- return false;
+ return rc;
}
if (setsparse)
@@ -2009,7 +2010,7 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
else
cifsi->cifsAttrs &= (~FILE_ATTRIBUTE_SPARSE_FILE);
- return true;
+ return 0;
}
static int
@@ -3322,10 +3323,9 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
inode_lock(inode);
/* Need to make file sparse, if not already, before freeing range. */
/* Consider adding equivalent for compressed since it could also work */
- if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) {
- rc = -EOPNOTSUPP;
+ rc = smb2_set_sparse(xid, tcon, cfile, inode, set_sparse);
+ if (rc)
goto out;
- }
filemap_invalidate_lock(inode->i_mapping);
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0792/1266] rtc: ds1307: Fix off-by-one issue with wday for rx8130
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (790 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0791/1266] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0793/1266] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
` (206 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nobuhiro Iwamatsu, Fredrik M Olsson,
Alexandre Belloni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredrik M Olsson <fredrik.m.olsson@axis.com>
[ Upstream commit 6882aab3c66112b33b251be95c09c8ead3e8d580 ]
The RTC represent each weekday with a individual bit set in the WDAY
register, where the 0th bit represent the first day of the week and the
6th bit represents the last day of the week. For each passed day the
chip performs a rotary-left-shift by one to advance the weekday by one.
The tm_wday field represent weekdays by a value in the range of 0-6.
The fls() function return the bit index of the last bit set. To handle
when there are no bits set it will return 0, and if the 0th bit is set
it will return 1, and if the 1st bit is set it will return 2, and so on.
In order to make the result of the fls() function fall into the expected
range of 0-6 (instead of 1-7) this patch subtracts one from the result
(which matches how the value is written in ds1307_set_time()).
Fixes: 204756f016726 ("rtc: ds1307: Fix wday settings for rx8130")
Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
Signed-off-by: Fredrik M Olsson <fredrik.m.olsson@axis.com>
Link: https://patch.msgid.link/20260520-ds1307-rx8901-add-v2-2-e069ea32e1db@axis.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-ds1307.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 26b63cd0929154..e7ba52cb541204 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -306,7 +306,7 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
t->tm_hour = bcd2bin(tmp);
/* rx8130 is bit position, not BCD */
if (ds1307->type == rx_8130)
- t->tm_wday = fls(regs[DS1307_REG_WDAY] & 0x7f);
+ t->tm_wday = fls(regs[DS1307_REG_WDAY] & 0x7f) - 1;
else
t->tm_wday = bcd2bin(regs[DS1307_REG_WDAY] & 0x07) - 1;
t->tm_mday = bcd2bin(regs[DS1307_REG_MDAY] & 0x3f);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0793/1266] rtc: cmos: unregister HPET IRQ handler on probe failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (791 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0792/1266] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0794/1266] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
` (205 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Alexandre Belloni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit a5bb580df018b5d1c5668f05f7979044fb19e23a ]
cmos_do_probe() registers cmos_interrupt() as the HPET RTC IRQ
handler before requesting the RTC IRQ and registering the RTC
device. If either request_irq() or devm_rtc_register_device()
fails afterwards, the error path leaves the HPET RTC IRQ handler
installed. This leaves a stale handler behind and make a later
hpet_register_irq_handler() fail with -EBUSY.
Track whether the HPET handler was registered successfully and
undo the registration on the probe error path. Also mask the HPET
RTC IRQ bits to match the normal shutdown cleanup.
Fixes: 9d8af78b0797 ("rtc: add HPET RTC emulation to RTC_DRV_CMOS")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260623100848.2127281-1-haoxiang_li2024@163.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-cmos.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 095de4e0e4f388..e06f3b9cab2c84 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -932,6 +932,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
unsigned char rtc_control;
unsigned address_space;
u32 flags = 0;
+ bool hpet_registered = false;
struct nvmem_config nvmem_cfg = {
.name = "cmos_nvram",
.word_size = 1,
@@ -1089,6 +1090,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
" failed in rtc_init().");
goto cleanup1;
}
+ hpet_registered = true;
} else
rtc_cmos_int_handler = cmos_interrupt;
@@ -1138,6 +1140,10 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
if (is_valid_irq(rtc_irq))
free_irq(rtc_irq, cmos_rtc.rtc);
cleanup1:
+ if (hpet_registered) {
+ hpet_mask_rtc_irq_bit(RTC_IRQMASK);
+ hpet_unregister_irq_handler(cmos_interrupt);
+ }
cmos_rtc.dev = NULL;
cleanup0:
if (RTC_IOMAPPED)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0794/1266] net: mvneta: re-enable percpu interrupt on resume
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (792 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0793/1266] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0795/1266] net: sungem: fix probe error cleanup Greg Kroah-Hartman
` (204 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yun Zhou, Sebastian Andrzej Siewior,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit fd398d6480987e4c84fff0aaab6b9d6642a93343 ]
On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu
IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls
disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules
NAPI poll, which calls enable_percpu_irq() on completion to unmask.
If suspend occurs while NAPI poll is pending (between
disable_percpu_irq in the ISR and enable_percpu_irq in poll
completion), the interrupt is never re-enabled:
1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule()
=> MPIC masked, percpu_enabled cpumask bit cleared
2. NAPI poll does not complete before suspend proceeds
(on PREEMPT_RT this is highly likely since softirqs run in
ksoftirqd which gets frozen; on non-RT it can happen when
softirq processing is deferred to ksoftirqd)
3. mvneta_stop_dev => napi_disable(): cancels the pending poll
without executing the completion path
4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC
(already masked, but records IRQS_SUSPENDED)
5. Resume: mpic_resume checks irq_percpu_is_enabled() => false
(bit was cleared in step 1) => skips unmask
6. mvneta_start_dev only restores device-level INTR_NEW_MASK,
does not touch the MPIC per-CPU mask
Result: MPIC per-CPU interrupt stays masked permanently. The NIC
generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never
receives them, causing complete loss of network connectivity.
Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path
to unconditionally unmask the MPIC per-CPU interrupt regardless of
pre-suspend state.
Fixes: 12bb03b436da ("net: mvneta: Handle per-cpu interrupts")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260622074350.1666290-1-yun.zhou@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvneta.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 2941721b65152e..eb7b13b66ea35b 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -5866,6 +5866,9 @@ static int mvneta_resume(struct device *device)
rtnl_unlock();
mvneta_set_rx_mode(dev);
+ if (!pp->neta_armada3700)
+ on_each_cpu(mvneta_percpu_enable, pp, true);
+
return 0;
}
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0795/1266] net: sungem: fix probe error cleanup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (793 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0794/1266] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0796/1266] net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove Greg Kroah-Hartman
` (203 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Simon Horman,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 36dea2f639249460d13f6ca66b2a9064187cd34d ]
gem_init_one() calls gem_remove_one() when register_netdev() fails.
gem_remove_one() unregisters and frees resources owned by the net_device,
including the DMA block, MMIO mapping, PCI regions, and the net_device
itself. gem_init_one() then falls through to its own cleanup labels and
frees the same resources again.
Keep the register_netdev() error path in gem_init_one(): clear drvdata so
PM/remove paths do not see a half-registered device, remove the NAPI
instance added during probe, and let the existing cleanup labels release
the resources once.
The issue was found by a local static-analysis checker for probe error
paths. The reported path was manually inspected before sending this fix.
Compile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed
because no sungem hardware is available.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260623025759.3468566-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sun/sungem.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index d3a2fbb14140e9..7fc18a465e64ae 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2986,10 +2986,10 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
dev->max_mtu = GEM_MAX_MTU;
/* Register with kernel */
- if (register_netdev(dev)) {
+ err = register_netdev(dev);
+ if (err) {
pr_err("Cannot register net device, aborting\n");
- err = -ENOMEM;
- goto err_out_free_consistent;
+ goto err_out_clear_drvdata;
}
/* Undo the get_cell with appropriate locking (we could use
@@ -3003,8 +3003,13 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
dev->dev_addr);
return 0;
+err_out_clear_drvdata:
+ pci_set_drvdata(pdev, NULL);
+ netif_napi_del(&gp->napi);
+
err_out_free_consistent:
- gem_remove_one(pdev);
+ dma_free_coherent(&pdev->dev, sizeof(struct gem_init_block),
+ gp->init_block, gp->gblock_dvma);
err_out_iounmap:
gem_put_cell(gp);
iounmap(gp->regs);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0796/1266] net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (794 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0795/1266] net: sungem: fix probe error cleanup Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0797/1266] ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count Greg Kroah-Hartman
` (202 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shitalkumar Gandhi, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
[ Upstream commit a9e29dcd8a84081177f693439d663ca9e216c9fa ]
mac->phy_node is acquired via of_parse_phandle() in spl2sw_probe() and
stored in the mac private data, transferring ownership of the
device_node reference to mac. On driver removal, spl2sw_phy_remove()
disconnects the PHY but never drops that reference, so each
probe-then-remove cycle leaks one of_node refcount per port permanently.
Drop the reference after phy_disconnect(). While at it, remove the
redundant inner "if (ndev)" check; comm->ndev[i] was just verified
non-NULL on the line above.
Compile-tested only; no SP7021 hardware available.
Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/f3bdd4c91f3e2269b4e256075f9dc70808b1b8e9.1782195965.git.shitalkumar.gandhi@cambiumnetworks.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sunplus/spl2sw_phy.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/sunplus/spl2sw_phy.c b/drivers/net/ethernet/sunplus/spl2sw_phy.c
index 6f899e48f51dfb..a4889c52e00e4c 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_phy.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_phy.c
@@ -79,12 +79,14 @@ int spl2sw_phy_connect(struct spl2sw_common *comm)
void spl2sw_phy_remove(struct spl2sw_common *comm)
{
struct net_device *ndev;
+ struct spl2sw_mac *mac;
int i;
for (i = 0; i < MAX_NETDEV_NUM; i++)
if (comm->ndev[i]) {
ndev = comm->ndev[i];
- if (ndev)
- phy_disconnect(ndev->phydev);
+ mac = netdev_priv(ndev);
+ phy_disconnect(ndev->phydev);
+ of_node_put(mac->phy_node);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0797/1266] ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (795 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0796/1266] net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0798/1266] dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback Greg Kroah-Hartman
` (201 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit cf6f56990ea21172e085f0588e5bbf2089ce8f58 ]
The back-end consumes data in units of the number of channels. When the
maxburst value is not evenly divisible by the channel count, the DMA
transfer length does not align with the FIFO frame boundary, causing
wrong data to be copied and audible noise at the end of the stream.
This is specific to eDMA: eDMA only responds to DMA requests from the
back-end, whereas SDMA handles requests from both the front-end and the
back-end and is not affected.
For eDMA, when the back-end maxburst is not evenly divisible by the
channel count, align it to the nearest valid boundary:
- If maxburst >= channel count, override to the channel count so each
transfer corresponds to exactly one audio frame.
- If maxburst < channel count, override to 1 to avoid partial-frame
transfers.
Retain the original maxburst for SDMA or when it already aligns with
the channel count.
Fixes: c05f10f28ef6 ("ASoC: fsl_asrc: Add support for imx8qm & imx8qxp")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20260625102416.424911-1-shengjiu.wang@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_asrc_dma.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index 05a7d1588d204b..91dd85153e83e1 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -275,6 +275,26 @@ static int fsl_asrc_dma_hw_params(struct snd_soc_component *component,
config_be.dst_addr_width = buswidth;
config_be.dst_maxburst = dma_params_be->maxburst;
+ /*
+ * For eDMA, the back-end may report a maxburst size that is not evenly
+ * divisible by the channel count. This causes the DMA transfer length
+ * to misalign with the FIFO boundary, resulting in wrong data and
+ * audible noise. Align maxburst to the nearest valid boundary:
+ * - If maxburst >= channel count, override to the channel count so
+ * each transfer equals exactly one audio frame.
+ * - If maxburst < channel count, override to 1 to avoid partial-frame
+ * transfers.
+ */
+ if (asrc->use_edma && (dma_params_be->maxburst % params_channels(params))) {
+ if (dma_params_be->maxburst >= params_channels(params)) {
+ config_be.src_maxburst = params_channels(params);
+ config_be.dst_maxburst = params_channels(params);
+ } else {
+ config_be.src_maxburst = 1;
+ config_be.dst_maxburst = 1;
+ }
+ }
+
memset(&audio_config, 0, sizeof(audio_config));
config_be.peripheral_config = &audio_config;
config_be.peripheral_size = sizeof(audio_config);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0798/1266] dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (796 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0797/1266] ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0799/1266] tracing: probes: fix typo in a log message Greg Kroah-Hartman
` (200 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Herring (Arm), Andrew Lunn,
Conor Dooley, Niklas Söderlund, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <robh@kernel.org>
[ Upstream commit 14eb1d2c03b38ce3427f299967f7a4d97ebff4c2 ]
Fix the Micrel PHY in the example which shouldn't have the
fallback "ethernet-phy-ieee802.3-c22" compatible:
Documentation/devicetree/bindings/net/renesas,ether.example.dtb: ethernet-phy@1 \
(ethernet-phy-id0022.1537): compatible: ['ethernet-phy-id0022.1537', 'ethernet-phy-ieee802.3-c22'] is too long
from schema $id: http://devicetree.org/schemas/net/micrel.yaml
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Fixes: 37a2fce09001 ("dt-bindings: sh_eth convert bindings to json-schema")
Link: https://patch.msgid.link/20260624150250.131966-2-robh@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/net/renesas,ether.yaml | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/Documentation/devicetree/bindings/net/renesas,ether.yaml b/Documentation/devicetree/bindings/net/renesas,ether.yaml
index 06b38c9bc6ec38..f1b0b03df83843 100644
--- a/Documentation/devicetree/bindings/net/renesas,ether.yaml
+++ b/Documentation/devicetree/bindings/net/renesas,ether.yaml
@@ -119,8 +119,7 @@ examples:
#size-cells = <0>;
phy1: ethernet-phy@1 {
- compatible = "ethernet-phy-id0022.1537",
- "ethernet-phy-ieee802.3-c22";
+ compatible = "ethernet-phy-id0022.1537";
reg = <1>;
interrupt-parent = <&irqc0>;
interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0799/1266] tracing: probes: fix typo in a log message
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (797 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0798/1266] dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0800/1266] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
` (199 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kaiser,
Masami Hiramatsu (Google), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit 72c8646956ffc8050bb8be5988a0f28fc37e1ac4 ]
Fix a typo ("Invalid $-variable") in a log message.
Link: https://lore.kernel.org/all/20260507081041.885781-4-martin@kaiser.cx/
Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_probe.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index ce5a0935cd45c0..9fc6b3a39435ce 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -496,7 +496,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(NO_RETVAL, "This function returns 'void' type"), \
C(BAD_STACK_NUM, "Invalid stack number"), \
C(BAD_ARG_NUM, "Invalid argument number"), \
- C(BAD_VAR, "Invalid $-valiable specified"), \
+ C(BAD_VAR, "Invalid $-variable specified"), \
C(BAD_REG_NAME, "Invalid register name"), \
C(BAD_MEM_ADDR, "Invalid memory address"), \
C(BAD_IMM, "Invalid immediate value"), \
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0800/1266] spi: sh-msiof: abort transfers when reset times out
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (798 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0799/1266] tracing: probes: fix typo in a log message Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0801/1266] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
` (198 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 6dbaa4d288432c697cea47028480481b8b29bd6a ]
sh_msiof_spi_reset_regs() asserts TX/RX reset and polls until the reset
bits clear, but the poll result is ignored. sh_msiof_transfer_one() can
therefore continue programming a transfer after the controller did not
leave reset.
Return the reset poll result from the helper and abort the transfer on
timeout, matching the existing transfer path's error-return style.
Fixes: fedd6940682a ("spi: sh-msiof: Add reset of registers before starting transfer")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623135834.55442-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sh-msiof.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 65c11909659c6b..6d0376b6e53234 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -242,7 +242,7 @@ static irqreturn_t sh_msiof_spi_irq(int irq, void *data)
return IRQ_HANDLED;
}
-static void sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
+static int sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
{
u32 mask = SICTR_TXRST | SICTR_RXRST;
u32 data;
@@ -251,8 +251,8 @@ static void sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
data |= mask;
sh_msiof_write(p, SICTR, data);
- readl_poll_timeout_atomic(p->mapbase + SICTR, data, !(data & mask), 1,
- 100);
+ return readl_poll_timeout_atomic(p->mapbase + SICTR, data,
+ !(data & mask), 1, 100);
}
static const u32 sh_msiof_spi_div_array[] = {
@@ -926,7 +926,9 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,
int ret;
/* reset registers */
- sh_msiof_spi_reset_regs(p);
+ ret = sh_msiof_spi_reset_regs(p);
+ if (ret)
+ return ret;
/* setup clocks (clock already enabled in chipselect()) */
if (!spi_controller_is_target(p->ctlr))
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0801/1266] gpio: mvebu: fail probe if gpiochip registration fails
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (799 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0800/1266] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0802/1266] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
` (197 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Bartosz Golaszewski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 479e91fc92416a4d54d2b3150aa1e4550d9cc759 ]
mvebu_gpio_probe() registers the GPIO chip with
devm_gpiochip_add_data() but ignores the return value. If registration
fails, probe continues and leaves later code operating on a GPIO chip
that was never published to gpiolib.
Return the registration error so the device fails probe cleanly.
Fixes: fefe7b092345 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131645.86884-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-mvebu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index ee184720de57c2..9ca659cff43883 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1232,7 +1232,10 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
BUG();
}
- devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+ err = devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+ if (err)
+ return dev_err_probe(&pdev->dev, err,
+ "failed to register gpiochip\n");
/* Some MVEBU SoCs have simple PWM support for GPIO lines */
if (IS_REACHABLE(CONFIG_PWM)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0802/1266] gpio: htc-egpio: use managed gpiochip registration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (800 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0801/1266] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0803/1266] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
` (196 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Bartosz Golaszewski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 17326db5f0ab4ec1901e75d052b5ebef486b467f ]
egpio_probe() registers each nested gpio_chip with gpiochip_add_data()
but ignores the return value. If one registration fails, probe still
returns success even though one of the chips was not published to
gpiolib.
Use devm_gpiochip_add_data() and fail probe if any chip registration
fails. This lets devres unwind already registered chips and prevents
the driver from publishing a partially initialized device.
Fixes: a1635b8fe59d ("[ARM] 4947/1: htc-egpio, a driver for GPIO/IRQ expanders with fixed input/output pins")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131828.94139-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-htc-egpio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-htc-egpio.c b/drivers/gpio/gpio-htc-egpio.c
index a40bd56673fe36..5f12ce9ac28caf 100644
--- a/drivers/gpio/gpio-htc-egpio.c
+++ b/drivers/gpio/gpio-htc-egpio.c
@@ -268,6 +268,7 @@ static int __init egpio_probe(struct platform_device *pdev)
struct gpio_chip *chip;
unsigned int irq, irq_end;
int i;
+ int ret;
/* Initialize ei data structure. */
ei = devm_kzalloc(&pdev->dev, sizeof(*ei), GFP_KERNEL);
@@ -331,7 +332,10 @@ static int __init egpio_probe(struct platform_device *pdev)
chip->base = pdata->chip[i].gpio_base;
chip->ngpio = pdata->chip[i].num_gpios;
- gpiochip_add_data(chip, &ei->chip[i]);
+ ret = devm_gpiochip_add_data(&pdev->dev, chip, &ei->chip[i]);
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret,
+ "failed to register gpiochip %d\n", i);
}
/* Set initial pin values */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0803/1266] seg6: validate SRH length before reading fixed fields
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (801 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0802/1266] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0804/1266] qede: fix out-of-bounds check for cqe->len_list[] Greg Kroah-Hartman
` (195 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuoqi Gui, Andrea Mayer,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ Upstream commit a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa ]
seg6_validate_srh() reads fixed SRH fields such as srh->type and
srh->hdrlen before checking that the supplied length covers the fixed
struct ipv6_sr_hdr fields.
The BPF SEG6 encap path reaches this with a BPF program-supplied pointer
and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and
END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the
length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6
encap header can therefore make the validator read srh->type at offset 2
beyond the caller-supplied buffer.
Reject lengths shorter than the fixed SRH at the top of
seg6_validate_srh(), before any field is read. This fixes the BPF helper
path and keeps the common validator robust.
Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Link: https://patch.msgid.link/20260623-f01-17-seg6-srh-len-v2-1-2edc40e9e3e1@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/seg6.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index a31521e270f785..5a50755ec69f08 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -31,6 +31,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced)
int max_last_entry;
int trailing;
+ if (len < sizeof(*srh))
+ return false;
+
if (srh->type != IPV6_SRCRT_TYPE_4)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0804/1266] qede: fix out-of-bounds check for cqe->len_list[]
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (802 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0803/1266] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0805/1266] net: enetc: check the number of BDs needed for xdp_frame Greg Kroah-Hartman
` (194 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matvey Kovalev, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matvey Kovalev <matvey.kovalev@ispras.ru>
[ Upstream commit f9ba47fce5932c15891c89c60e76dfaca919cb8d ]
Move index check before element access.
Fixes: 896f1a2493b5 ("net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()")
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Link: https://patch.msgid.link/20260623144602.3521-1-matvey.kovalev@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_fp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index 273dae622c4113..1de8611a27f238 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -961,7 +961,7 @@ static inline void qede_tpa_cont(struct qede_dev *edev,
{
int i;
- for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
+ for (i = 0; i < ARRAY_SIZE(cqe->len_list) && cqe->len_list[i]; i++)
qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
le16_to_cpu(cqe->len_list[i]));
@@ -986,7 +986,7 @@ static int qede_tpa_end(struct qede_dev *edev,
dma_unmap_page(rxq->dev, tpa_info->buffer.mapping,
PAGE_SIZE, rxq->data_direction);
- for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
+ for (i = 0; i < ARRAY_SIZE(cqe->len_list) && cqe->len_list[i]; i++)
qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
le16_to_cpu(cqe->len_list[i]));
if (unlikely(i > 1))
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0805/1266] net: enetc: check the number of BDs needed for xdp_frame
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (803 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0804/1266] qede: fix out-of-bounds check for cqe->len_list[] Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0806/1266] sctp: fix SCTP_RESET_STREAMS stream list length limit Greg Kroah-Hartman
` (193 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wei Fang, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit 555c5475e787802eeae0d2b91c2f66c330db2767 ]
The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the
number of fragments contained in xdp_frame may be greater than or equal
to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr
to be out of bounds.
Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20260626073244.2168214-1-wei.fang@oss.nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/enetc/enetc.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index e3ab6f4f8dbba7..3ee6995bc7d256 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -1425,6 +1425,7 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
{
struct enetc_tx_swbd xdp_redirect_arr[ENETC_MAX_SKB_FRAGS] = {0};
struct enetc_ndev_priv *priv = netdev_priv(ndev);
+ struct skb_shared_info *shinfo;
struct enetc_bdr *tx_ring;
int xdp_tx_bd_cnt, i, k;
int xdp_tx_frm_cnt = 0;
@@ -1440,6 +1441,12 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
prefetchw(ENETC_TXBD(*tx_ring, tx_ring->next_to_use));
for (k = 0; k < num_frames; k++) {
+ if (xdp_frame_has_frags(frames[k])) {
+ shinfo = xdp_get_shared_info_from_frame(frames[k]);
+ if (unlikely((shinfo->nr_frags + 1) > ENETC_MAX_SKB_FRAGS))
+ break;
+ }
+
xdp_tx_bd_cnt = enetc_xdp_frame_to_xdp_tx_swbd(tx_ring,
xdp_redirect_arr,
frames[k]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0806/1266] sctp: fix SCTP_RESET_STREAMS stream list length limit
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (804 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0805/1266] net: enetc: check the number of BDs needed for xdp_frame Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0807/1266] MIPS: DEC: Ensure RTC platform device deregistration upon failure Greg Kroah-Hartman
` (192 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Yousef Alhouseen,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit 2b9f5ef534184bd81b8a4772780626c40eed1fd5 ]
SCTP_RESET_STREAMS carries a flexible array of u16 stream IDs, but the
optlen clamps treat USHRT_MAX as a byte count and then multiply
sizeof(__u16) by the fixed header size.
That caps the copied and validated option buffer at about 64 KiB, which
rejects valid requests containing more than about half of the u16 stream
ID range.
Use struct_size_t() for the maximum struct sctp_reset_streams layout
instead, so the bound matches the flexible array described by
srs_number_streams.
Fixes: 5960cefab9df ("sctp: add a ceiling to optlen in some sockopts")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260625142354.2600-1-alhouseenyousef@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 890c587ebe2745..4cc73e7b3c2aae 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4110,8 +4110,9 @@ static int sctp_setsockopt_reset_streams(struct sock *sk,
if (optlen < sizeof(*params))
return -EINVAL;
/* srs_number_streams is u16, so optlen can't be bigger than this. */
- optlen = min_t(unsigned int, optlen, USHRT_MAX +
- sizeof(__u16) * sizeof(*params));
+ optlen = min_t(unsigned int, optlen,
+ struct_size_t(struct sctp_reset_streams, srs_stream_list,
+ USHRT_MAX));
if (params->srs_number_streams * sizeof(__u16) >
optlen - sizeof(*params))
@@ -4597,8 +4598,8 @@ static int sctp_setsockopt(struct sock *sk, int level, int optname,
if (optlen > 0) {
/* Trim it to the biggest size sctp sockopt may need if necessary */
optlen = min_t(unsigned int, optlen,
- PAGE_ALIGN(USHRT_MAX +
- sizeof(__u16) * sizeof(struct sctp_reset_streams)));
+ PAGE_ALIGN(struct_size_t(struct sctp_reset_streams,
+ srs_stream_list, USHRT_MAX)));
kopt = memdup_sockptr(optval, optlen);
if (IS_ERR(kopt))
return PTR_ERR(kopt);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0807/1266] MIPS: DEC: Ensure RTC platform device deregistration upon failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (805 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0806/1266] sctp: fix SCTP_RESET_STREAMS stream list length limit Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0808/1266] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
` (191 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit eacaf5ae747f7dead6cc268de17a7382d79031fc ]
Switch RTC platform device registration from platform_device_register()
to platform_add_devices() so as to make sure any failure will result in
automatic device unregistration.
Fixes: fae67ad43114 ("arch/mips/dec: switch DECstation systems to rtc-cmos")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/dec/platform.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/mips/dec/platform.c b/arch/mips/dec/platform.c
index 723ce16cbfc0cc..a005246a0ac5d2 100644
--- a/arch/mips/dec/platform.c
+++ b/arch/mips/dec/platform.c
@@ -38,6 +38,10 @@ static struct platform_device dec_rtc_device = {
.num_resources = ARRAY_SIZE(dec_rtc_resources),
};
+static struct platform_device *dec_rtc_devices[] __initdata = {
+ &dec_rtc_device,
+};
+
static struct resource dec_dz_resources[] = {
{ .name = "dz", .flags = IORESOURCE_MEM, },
{ .name = "dz", .flags = IORESOURCE_IRQ, },
@@ -137,7 +141,7 @@ static int __init dec_add_devices(void)
}
num_zs = i;
- ret1 = platform_device_register(&dec_rtc_device);
+ ret1 = platform_add_devices(dec_rtc_devices, 1);
ret2 = IS_ENABLED(CONFIG_32BIT) ?
platform_add_devices(dec_dz_devices, num_dz) : 0;
ret3 = platform_add_devices(dec_zs_devices, num_zs);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0808/1266] hwmon: adm1275: Prevent reading uninitialized stack
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (806 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0807/1266] MIPS: DEC: Ensure RTC platform device deregistration upon failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0809/1266] hwmon: (pmbus) Fix passing events to regulator core Greg Kroah-Hartman
` (190 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matti Vaittinen, Guenter Roeck,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <mazziesaccount@gmail.com>
[ Upstream commit 553f9517813912a5ab661af5504485d96824a61c ]
While adding support for the ROHM BD127X0 hot-swap controllers, sashiko
reported an error in device-name comparison, which can lead to reading
uninitialized stack memory.
Quoting Sashiko:
This is a pre-existing issue, but I noticed that just before this block in
adm1275_probe(), there might be an out-of-bounds stack read:
ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer);
if (ret < 0) { ... }
for (mid = adm1275_id; mid->name[0]; mid++) {
if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
break;
}
Since i2c_smbus_read_block_data() reads up to 32 bytes into the
uninitialized stack array block_buffer without appending a null
terminator, strncasecmp() could read past the valid bytes returned in ret.
For example, if the device returns a shorter string like "adm12", checking
it against "adm1275" up to the length of "adm1275" will continue reading
into uninitialized stack bounds.
Prevent reading uninitialized memory by zeroing the stack array.
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Fixes: 87102808d039 ("hwmon: (pmbus/adm1275) Validate device ID")
Link: https://lore.kernel.org/r/c8ad38e0cdb347261c6245de2b7965e747f28d22.1782458224.git.mazziesaccount@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/adm1275.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
index e2c61d6fa521b1..0fd1cec7b6cabc 100644
--- a/drivers/hwmon/pmbus/adm1275.c
+++ b/drivers/hwmon/pmbus/adm1275.c
@@ -508,7 +508,7 @@ static int adm1275_enable_vout_temp(struct adm1275_data *data,
static int adm1275_probe(struct i2c_client *client)
{
s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
- u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
+ u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1] = {0};
int config, device_config;
int ret;
struct pmbus_driver_info *info;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0809/1266] hwmon: (pmbus) Fix passing events to regulator core
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (807 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0808/1266] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0810/1266] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
` (189 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Guenter Roeck, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 9ef7dacd44216bf5ea05c8aef49eba4d145f4047 ]
Sashiko reports:
Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with
mutex") introduced a worker to batch regulator events over time using
atomic_or(). The delayed worker then passes the combined bitmask unmodified
to regulator_notifier_call_chain().
The core regulator subsystem's regulator_handle_critical() function
evaluates the event parameter using a strict switch statement. If
multiple distinct faults occur before the worker runs (e.g.,
REGULATOR_EVENT_UNDER_VOLTAGE | REGULATOR_EVENT_OVER_CURRENT), the combined
bitmask fails to match any case. This leaves the reason as NULL and
completely bypasses the critical hw_protection_trigger().
Fix the problem by passing events bit by bit to the regulator event
handler.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/pmbus_core.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index a61e2fb176da78..eafeabfd93d77c 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -3190,18 +3190,23 @@ static void pmbus_regulator_notify_worker(struct work_struct *work)
int i, j;
for (i = 0; i < data->info->pages; i++) {
- int event;
+ unsigned int event;
event = atomic_xchg(&data->regulator_events[i], 0);
if (!event)
continue;
for (j = 0; j < data->info->num_regulators; j++) {
- if (i == rdev_get_id(data->rdevs[j])) {
+ if (i != rdev_get_id(data->rdevs[j]))
+ continue;
+ while (event) {
+ unsigned int _event = BIT(__ffs(event));
+
regulator_notifier_call_chain(data->rdevs[j],
- event, NULL);
- break;
+ _event, NULL);
+ event &= ~_event;
}
+ break;
}
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0810/1266] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (808 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0809/1266] hwmon: (pmbus) Fix passing events to regulator core Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0811/1266] net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy Greg Kroah-Hartman
` (188 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a ]
genelink_rx_fixup() splits an aggregated RX frame into its individual
packets, using a per-packet length taken from device-supplied data. That
length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared
against how many bytes were actually received.
A malicious GeneLink (GL620A) device can therefore send a short URB whose
header claims packet_count > 1 and a first packet of up to 1514 bytes.
skb_put_data(gl_skb, packet->packet_data, size);
then copies past the end of the receive buffer and hands the adjacent slab
contents up the network stack, an out-of-bounds read that leaks kernel heap.
No privilege is required: the path runs in the usbnet RX softirq as soon as
the interface is up.
BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)
Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14
Call Trace:
...
__asan_memcpy (mm/kasan/shadow.c:105)
genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)
usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3405)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
run_ksoftirqd (kernel/softirq.c:1076)
...
skb_pull() already verifies that the requested length fits the buffer and
returns NULL otherwise. Move it ahead of the copy and check its result, so
a packet that overruns the received data is rejected before it is read.
Well-formed frames, whose packets are fully present, are unaffected.
Fixes: 47ee3051c856 ("[PATCH] USB: usbnet (5/9) module for genesys gl620a cables")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260627205353.4000788-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/gl620a.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index 0bfa37c1405918..09afd137b64e15 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -104,6 +104,9 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
return 0;
}
+ if (!skb_pull(skb, size + 4))
+ return 0;
+
// allocate the skb for the individual packet
gl_skb = alloc_skb(size, GFP_ATOMIC);
if (gl_skb) {
@@ -116,9 +119,6 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
// advance to the next packet
packet = (struct gl_packet *)&packet->packet_data[size];
count--;
-
- // shift the data pointer to the next gl_packet
- skb_pull(skb, size + 4);
}
// skip the packet length field 4 bytes
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0811/1266] net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (809 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0810/1266] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0812/1266] net: gianfar: dispose irq mappings on probe failure and device removal Greg Kroah-Hartman
` (187 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Wozniak, Maxime Chevallier,
Larysa Zaremba, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Wozniak <petr.wozniak@gmail.com>
[ Upstream commit 8f31efff9206f9f0adb853cad6916086aac4d5ef ]
sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(),
a plain (non-devm) allocation, and registers it. sfp_i2c_mdiobus_destroy()
only unregisters the bus and clears sfp->i2c_mii without calling
mdiobus_free(). As the only reference to the bus is then cleared, the
struct mii_bus is leaked.
This is hit whenever a copper/RollBall SFP module that instantiated an MDIO
bus is removed: sfp_sm_main() takes the global teardown path and calls
sfp_i2c_mdiobus_destroy(). sfp_cleanup(), on driver unbind, frees
sfp->i2c_mii directly, which is why the leak only triggered on module
hot-removal and not on unbind.
Free the bus in sfp_i2c_mdiobus_destroy() to match the allocation done in
sfp_i2c_mdiobus_create().
Fixes: e85b1347ace6 ("net: sfp: create/destroy I2C mdiobus before PHY probe/after PHY release")
Signed-off-by: Petr Wozniak <petr.wozniak@gmail.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
Link: https://patch.msgid.link/312bde8176fc429aa89524e3be250137f034ba84.1782581445.git.petr.wozniak@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/sfp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 165c624c985fd5..e352ceb2f7cba4 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -747,6 +747,7 @@ static int sfp_i2c_mdiobus_create(struct sfp *sfp)
static void sfp_i2c_mdiobus_destroy(struct sfp *sfp)
{
mdiobus_unregister(sfp->i2c_mii);
+ mdiobus_free(sfp->i2c_mii);
sfp->i2c_mii = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0812/1266] net: gianfar: dispose irq mappings on probe failure and device removal
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (810 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0811/1266] net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0813/1266] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF Greg Kroah-Hartman
` (186 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit dbf803bc4a8b0522c9a12560c20905a5952d1cb9 ]
irq_of_parse_and_map() creates irqdomain mappings that should be
balanced with irq_dispose_mapping(). The driver never called
irq_dispose_mapping(), leaking mappings on probe failure and
device removal.
Fix by adding irq_dispose_mapping() in free_gfar_dev() and
expanding its loop from priv->num_grps to MAXGROUPS so the
error path also catches partially-initialized groups. All
irqinfo pointers are pre-initialized to NULL in gfar_of_init(),
making the NULL-guarded walk in free_gfar_dev() safe for every
scenario.
gfar_parse_group() itself is left as a simple parse function
with no resource management; cleanup is centralized in the
caller's error path.
Assisted-by: opencode:big-pickle
Fixes: b31a1d8b4151 ("gianfar: Convert gianfar to an of_platform_driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260626225228.427392-1-rosenp@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/gianfar.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index e3dfbd7a42361e..4d7fdfe5522483 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -470,10 +470,13 @@ static void free_gfar_dev(struct gfar_private *priv)
{
int i, j;
- for (i = 0; i < priv->num_grps; i++)
+ for (i = 0; i < MAXGROUPS; i++)
for (j = 0; j < GFAR_NUM_IRQS; j++) {
- kfree(priv->gfargrp[i].irqinfo[j]);
- priv->gfargrp[i].irqinfo[j] = NULL;
+ if (priv->gfargrp[i].irqinfo[j]) {
+ irq_dispose_mapping(priv->gfargrp[i].irqinfo[j]->irq);
+ kfree(priv->gfargrp[i].irqinfo[j]);
+ priv->gfargrp[i].irqinfo[j] = NULL;
+ }
}
free_netdev(priv->ndev);
@@ -630,7 +633,7 @@ static phy_interface_t gfar_get_interface(struct net_device *dev)
static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
{
const char *model;
- int err = 0, i;
+ int err = 0, i, j;
phy_interface_t interface;
struct net_device *dev = NULL;
struct gfar_private *priv = NULL;
@@ -714,8 +717,11 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
priv->rx_list.count = 0;
mutex_init(&priv->rx_queue_access);
- for (i = 0; i < MAXGROUPS; i++)
+ for (i = 0; i < MAXGROUPS; i++) {
priv->gfargrp[i].regs = NULL;
+ for (j = 0; j < GFAR_NUM_IRQS; j++)
+ priv->gfargrp[i].irqinfo[j] = NULL;
+ }
/* Parse and initialize group specific information */
if (priv->mode == MQ_MG_MODE) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0813/1266] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (811 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0812/1266] net: gianfar: dispose irq mappings on probe failure and device removal Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0814/1266] bridge: stp: Fix a potential use-after-free when deleting a bridge Greg Kroah-Hartman
` (185 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zdi-disclosures, Victor Nogueira,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit e5b811fe793166aecc59b085c1b7c31262ef2316 ]
The teql master->slaves singly linked list is not protected against
multiple writes. It can be mod'ed concurently from teql_master_xmit(),
teql_dequeue(), teql_init() and teql_destroy() without holding any list
lock or RCU protection.
zdi-disclosures@trendmicro.com has demonstrated that the qdisc is freed
after an RCU grace period, but teql_master_xmit() running on another
CPU can still hold a stale pointer into the list, resulting in a
slab-use-after-free:
BUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0
Read of size 8 at addr ffff888013fb0440 by task poc/332
Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512)
The fix?
Add a per-master slaves_lock spinlock that serializes all mutations of
master->slaves and the NEXT_SLAVE() links in teql_destroy() and
teql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock
around those updates.
Annotate master->slaves and the per-slave ->next pointer with __rcu and
use the appropriate RCU accessors everywhere they are touched:
rcu_assign_pointer() on the writer side (under slaves_lock),
rcu_dereference_protected() for the writer-side loads (also under
slaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and
rtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(),
which run under RTNL.
Pair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list
traversal in teql_master_xmit(), so that readers either observe a fully
linked list or are deferred until the in-flight mutation completes. The two
early-return paths in teql_master_xmit() are updated to release the RCU-bh
read-side critical section before returning, since leaving it held would
disable BH on that CPU for good.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: zdi-disclosures@trendmicro.com
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260628111229.669751-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_teql.c | 125 +++++++++++++++++++++++++++++--------------
1 file changed, 86 insertions(+), 39 deletions(-)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index efcca269662139..a66d93979fb9d6 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -52,7 +52,8 @@
struct teql_master {
struct Qdisc_ops qops;
struct net_device *dev;
- struct Qdisc *slaves;
+ struct Qdisc __rcu *slaves;
+ spinlock_t slaves_lock; /* serializes writes to ->slaves */
struct list_head master_list;
unsigned long tx_bytes;
unsigned long tx_packets;
@@ -61,7 +62,7 @@ struct teql_master {
};
struct teql_sched_data {
- struct Qdisc *next;
+ struct Qdisc __rcu *next;
struct teql_master *m;
struct sk_buff_head q;
};
@@ -101,7 +102,9 @@ teql_dequeue(struct Qdisc *sch)
if (skb == NULL) {
struct net_device *m = qdisc_dev(q);
if (m) {
- dat->m->slaves = sch;
+ spin_lock_bh(&dat->m->slaves_lock);
+ rcu_assign_pointer(dat->m->slaves, sch);
+ spin_unlock_bh(&dat->m->slaves_lock);
netif_wake_queue(m);
}
} else {
@@ -132,34 +135,49 @@ teql_destroy(struct Qdisc *sch)
struct Qdisc *q, *prev;
struct teql_sched_data *dat = qdisc_priv(sch);
struct teql_master *master = dat->m;
+ struct netdev_queue *txq = NULL;
+ bool reset_master_queue = false;
if (!master)
return;
- prev = master->slaves;
+ spin_lock_bh(&master->slaves_lock);
+ prev = rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock));
if (prev) {
do {
- q = NEXT_SLAVE(prev);
- if (q == sch) {
- NEXT_SLAVE(prev) = NEXT_SLAVE(q);
- if (q == master->slaves) {
- master->slaves = NEXT_SLAVE(q);
- if (q == master->slaves) {
- struct netdev_queue *txq;
-
- txq = netdev_get_tx_queue(master->dev, 0);
- master->slaves = NULL;
-
- dev_reset_queue(master->dev,
- txq, NULL);
- }
- }
- skb_queue_purge(&dat->q);
- break;
+ struct Qdisc *head, *next;
+
+ q = rcu_dereference_protected(NEXT_SLAVE(prev),
+ lockdep_is_held(&master->slaves_lock));
+ if (q != sch) {
+ prev = q;
+ continue;
}
- } while ((prev = q) != master->slaves);
+ next = rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock));
+ rcu_assign_pointer(NEXT_SLAVE(prev), next);
+
+ head = rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock));
+ if (q == head) {
+ rcu_assign_pointer(master->slaves, next);
+ if (q == next) {
+ txq = netdev_get_tx_queue(master->dev, 0);
+ rcu_assign_pointer(master->slaves, NULL);
+ reset_master_queue = true;
+ }
+ }
+ skb_queue_purge(&dat->q);
+ break;
+ } while (prev != rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)));
}
+ spin_unlock_bh(&master->slaves_lock);
+
+ if (reset_master_queue)
+ dev_reset_queue(master->dev, txq, NULL);
}
static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
@@ -168,6 +186,7 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
struct net_device *dev = qdisc_dev(sch);
struct teql_master *m = (struct teql_master *)sch->ops;
struct teql_sched_data *q = qdisc_priv(sch);
+ struct Qdisc *first;
if (dev->hard_header_len > m->dev->hard_header_len)
return -EINVAL;
@@ -184,7 +203,9 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
skb_queue_head_init(&q->q);
- if (m->slaves) {
+ spin_lock_bh(&m->slaves_lock);
+ first = rcu_dereference_protected(m->slaves, lockdep_is_held(&m->slaves_lock));
+ if (first) {
if (m->dev->flags & IFF_UP) {
if ((m->dev->flags & IFF_POINTOPOINT &&
!(dev->flags & IFF_POINTOPOINT)) ||
@@ -192,8 +213,10 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
!(dev->flags & IFF_BROADCAST)) ||
(m->dev->flags & IFF_MULTICAST &&
!(dev->flags & IFF_MULTICAST)) ||
- dev->mtu < m->dev->mtu)
+ dev->mtu < m->dev->mtu) {
+ spin_unlock_bh(&m->slaves_lock);
return -EINVAL;
+ }
} else {
if (!(dev->flags&IFF_POINTOPOINT))
m->dev->flags &= ~IFF_POINTOPOINT;
@@ -204,14 +227,17 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
if (dev->mtu < m->dev->mtu)
m->dev->mtu = dev->mtu;
}
- q->next = NEXT_SLAVE(m->slaves);
- NEXT_SLAVE(m->slaves) = sch;
+ rcu_assign_pointer(q->next,
+ rcu_dereference_protected(NEXT_SLAVE(first),
+ lockdep_is_held(&m->slaves_lock)));
+ rcu_assign_pointer(NEXT_SLAVE(first), sch);
} else {
- q->next = sch;
- m->slaves = sch;
+ rcu_assign_pointer(q->next, sch);
+ rcu_assign_pointer(m->slaves, sch);
m->dev->mtu = dev->mtu;
m->dev->flags = (m->dev->flags&~FMASK)|(dev->flags&FMASK);
}
+ spin_unlock_bh(&m->slaves_lock);
return 0;
}
@@ -285,7 +311,9 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
int subq = skb_get_queue_mapping(skb);
struct sk_buff *skb_res = NULL;
- start = master->slaves;
+ rcu_read_lock_bh();
+
+ start = rcu_dereference_bh(master->slaves);
restart:
nores = 0;
@@ -317,10 +345,17 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
netdev_start_xmit(skb, slave, slave_txq, false) ==
NETDEV_TX_OK) {
__netif_tx_unlock(slave_txq);
- master->slaves = NEXT_SLAVE(q);
+ spin_lock_bh(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+ spin_unlock_bh(&master->slaves_lock);
netif_wake_queue(dev);
master->tx_packets++;
master->tx_bytes += length;
+ rcu_read_unlock_bh();
return NETDEV_TX_OK;
}
__netif_tx_unlock(slave_txq);
@@ -329,14 +364,21 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
busy = 1;
break;
case 1:
- master->slaves = NEXT_SLAVE(q);
+ spin_lock_bh(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+ spin_unlock_bh(&master->slaves_lock);
+ rcu_read_unlock_bh();
return NETDEV_TX_OK;
default:
nores = 1;
break;
}
__skb_pull(skb, skb_network_offset(skb));
- } while ((q = NEXT_SLAVE(q)) != start);
+ } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start);
if (nores && skb_res == NULL) {
skb_res = skb;
@@ -345,29 +387,32 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
if (busy) {
netif_stop_queue(dev);
+ rcu_read_unlock_bh();
return NETDEV_TX_BUSY;
}
master->tx_errors++;
drop:
master->tx_dropped++;
+ rcu_read_unlock_bh();
dev_kfree_skb(skb);
return NETDEV_TX_OK;
}
static int teql_master_open(struct net_device *dev)
{
- struct Qdisc *q;
+ struct Qdisc *q, *first;
struct teql_master *m = netdev_priv(dev);
int mtu = 0xFFFE;
unsigned int flags = IFF_NOARP | IFF_MULTICAST;
- if (m->slaves == NULL)
+ first = rtnl_dereference(m->slaves);
+ if (!first)
return -EUNATCH;
flags = FMASK;
- q = m->slaves;
+ q = first;
do {
struct net_device *slave = qdisc_dev(q);
@@ -389,7 +434,7 @@ static int teql_master_open(struct net_device *dev)
flags &= ~IFF_BROADCAST;
if (!(slave->flags&IFF_MULTICAST))
flags &= ~IFF_MULTICAST;
- } while ((q = NEXT_SLAVE(q)) != m->slaves);
+ } while ((q = rtnl_dereference(NEXT_SLAVE(q))) != first);
m->dev->mtu = mtu;
m->dev->flags = (m->dev->flags&~FMASK) | flags;
@@ -417,14 +462,15 @@ static void teql_master_stats64(struct net_device *dev,
static int teql_master_mtu(struct net_device *dev, int new_mtu)
{
struct teql_master *m = netdev_priv(dev);
- struct Qdisc *q;
+ struct Qdisc *q, *first;
- q = m->slaves;
+ first = rtnl_dereference(m->slaves);
+ q = first;
if (q) {
do {
if (new_mtu > qdisc_dev(q)->mtu)
return -EINVAL;
- } while ((q = NEXT_SLAVE(q)) != m->slaves);
+ } while ((q = rtnl_dereference(NEXT_SLAVE(q))) != first);
}
dev->mtu = new_mtu;
@@ -444,6 +490,7 @@ static __init void teql_master_setup(struct net_device *dev)
struct teql_master *master = netdev_priv(dev);
struct Qdisc_ops *ops = &master->qops;
+ spin_lock_init(&master->slaves_lock);
master->dev = dev;
ops->priv_size = sizeof(struct teql_sched_data);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0814/1266] bridge: stp: Fix a potential use-after-free when deleting a bridge
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (812 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0813/1266] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0815/1266] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
` (184 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Noam Rathaus, Neil Young,
Nikolay Aleksandrov, Ido Schimmel, Breno Leitao, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 2a00517db8de4be7df3d483b215c5544fb30a191 ]
The three STP timers are not supposed to be armed while the bridge is
administratively down. They are synchronously deactivated when the
bridge is put administratively down and the various call sites check for
'IFF_UP' before arming them.
This check is missing from br_topology_change_detection() and it is
possible to engineer a situation in which the topology change timer is
armed while the bridge is administratively down, resulting in a
use-after-free [1] when the bridge is deleted.
Fix by adding the missing check and for good measures synchronously
shutdown the three timers when the bridge is deleted.
[1]
ODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Noam Rathaus <noamr@ssd-disclosure.com>
Reported-by: Neil Young <contact@ssd-disclosure.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260629072117.497959-1-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_if.c | 3 +++
net/bridge/br_stp.c | 3 ++-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 6ffc81eedf0748..eee6ceb7cddab0 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -391,6 +391,9 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
br_fdb_delete_by_port(br, NULL, 0, 1);
+ timer_shutdown_sync(&br->hello_timer);
+ timer_shutdown_sync(&br->topology_change_timer);
+ timer_shutdown_sync(&br->tcn_timer);
cancel_delayed_work_sync(&br->gc_work);
br_sysfs_delbr(br->dev);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 7d27b2e6038fb7..4cfebf5fcdf54d 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -371,7 +371,8 @@ void br_topology_change_detection(struct net_bridge *br)
{
int isroot = br_is_root_bridge(br);
- if (br->stp_enabled != BR_KERNEL_STP)
+ if (br->stp_enabled != BR_KERNEL_STP ||
+ !(br->dev->flags & IFF_UP))
return;
br_info(br, "topology change detected, %s\n",
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0815/1266] tracing/events: Fix to check the simple_tsk_fn creation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (813 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0814/1266] bridge: stp: Fix a potential use-after-free when deleting a bridge Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0816/1266] tracing: eprobe: read the complete FILTER_PTR_STRING pointer Greg Kroah-Hartman
` (183 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[ Upstream commit cda1fbfc5313bb90daa271d45eea4a8d317a8544 ]
Sashiko pointed that this sample code does not correctly handle the
failure of thread creation because kthread_run() can return -errno.
Check the simple_tsk_fn is correctly initialized (created) or not.
Link: https://lore.kernel.org/all/178165817322.269421.3992299509400184196.stgit@devnote2/
Link: https://sashiko.dev/#/patchset/178092865666.163648.10457567771536160909.stgit%40devnote2
Fixes: 9cfe06f8cd5c ("tracing/events: add trace-events-sample")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/trace_events/trace-events-sample.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/samples/trace_events/trace-events-sample.c b/samples/trace_events/trace-events-sample.c
index ecc7db237f2eff..0b7a6efdb247a8 100644
--- a/samples/trace_events/trace-events-sample.c
+++ b/samples/trace_events/trace-events-sample.c
@@ -107,6 +107,10 @@ int foo_bar_reg(void)
* for consistency sake, we still take the thread_mutex.
*/
simple_tsk_fn = kthread_run(simple_thread_fn, NULL, "event-sample-fn");
+ if (IS_ERR_OR_NULL(simple_tsk_fn)) {
+ pr_err("Failed to create simple_thread_fn\n");
+ simple_tsk_fn = NULL;
+ }
out:
mutex_unlock(&thread_mutex);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0816/1266] tracing: eprobe: read the complete FILTER_PTR_STRING pointer
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (814 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0815/1266] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0817/1266] irqchip/gic-v3-its: Fix OF node reference leak Greg Kroah-Hartman
` (182 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kaiser,
Masami Hiramatsu (Google), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit 206b25c09080cc20fd4c2bea12d59df4b7ba2121 ]
For a char * element in an event, the FILTER_PTR_STRING filter type is
used. When the event occurs, a pointer is stored in the ringbuffer.
If an eprobe references such a char * element of a "base event", the
stored pointer is truncated when it's read from the ringbuffer.
$ cd /sys/kernel/tracing
$ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
$ echo 1 > tracing_on
$ echo 1 > events/eprobes/enable
$ sleep 1
$ echo 0 > events/eprobes/enable
$ cat trace
<idle>-0 ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
<idle>-0 ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)
The problem is in get_event_field
val = (unsigned long)(*(char *)addr);
addr points to the position in the ringbuffer where the pointer was
stored. The assignment reads only the lowest byte of the pointer.
Fix the cast to read the whole pointer. The output of the test above
is now
<idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
<idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"
Link: https://lore.kernel.org/all/20260620145339.3234726-1-martin@kaiser.cx/
Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_eprobe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
index f1f12ce5efb0ab..6330d25ac6536e 100644
--- a/kernel/trace/trace_eprobe.c
+++ b/kernel/trace/trace_eprobe.c
@@ -314,7 +314,7 @@ get_event_field(struct fetch_insn *code, void *rec)
val = (unsigned long)addr;
break;
case FILTER_PTR_STRING:
- val = (unsigned long)(*(char *)addr);
+ val = *(unsigned long *)addr;
break;
default:
WARN_ON_ONCE(1);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0817/1266] irqchip/gic-v3-its: Fix OF node reference leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (815 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0816/1266] tracing: eprobe: read the complete FILTER_PTR_STRING pointer Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0818/1266] irqchip/ts4800: Fix missing chained handler cleanup on remove Greg Kroah-Hartman
` (181 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Thomas Gleixner,
Zenghui Yu (Huawei), Marc Zyngier, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 2e1368a9d61bdf5502ddade004f223a5831c5b8c ]
of_get_cpu_node() returns a referenced device node. In
its_cpu_init_collection(), the Cavium 23144 workaround only uses the
node to compare the CPU NUMA node, but the reference is never dropped.
Use the device_node cleanup helper for the CPU node reference so it is
released when leaving the workaround block, including the NUMA mismatch
return path.
Fixes: fbf8f40e1658 ("irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum 23144")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v3-its.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 840108727b1311..d3ff3ab57d4db5 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3218,11 +3218,9 @@ static void its_cpu_init_collection(struct its_node *its)
/* avoid cross node collections and its mapping */
if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
- struct device_node *cpu_node;
+ struct device_node *cpu_node __free(device_node) = of_get_cpu_node(cpu, NULL);
- cpu_node = of_get_cpu_node(cpu, NULL);
- if (its->numa_node != NUMA_NO_NODE &&
- its->numa_node != of_node_to_nid(cpu_node))
+ if (its->numa_node != NUMA_NO_NODE && its->numa_node != of_node_to_nid(cpu_node))
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0818/1266] irqchip/ts4800: Fix missing chained handler cleanup on remove
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (816 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0817/1266] irqchip/gic-v3-its: Fix OF node reference leak Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0819/1266] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
` (180 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qingshuang Fu, Thomas Gleixner,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <fuqingshuang@kylinos.cn>
[ Upstream commit 98bf7e54cec07d514b3575c11896a8b12d50ecc4 ]
The driver installs a chained handler for the parent interrupt during probe
using irq_set_chained_handler_and_data(), but the remove function does not
clear this handler. This leaves a dangling handler that may be called when
the parent interrupt fires after the driver has been removed, potentially
accessing freed memory and causing a kernel crash.
Additionally, the parent_irq obtained via irq_of_parse_and_map() is not
stored, making it inaccessible in the remove function. Moreover, interrupt
mappings created during probe are not properly disposed.
Fix this by:
- Saving parent_irq in probe
- Clearing the chained handler with NULL in ts4800_ic_remove()
- Disposing all IRQ mappings before domain removal to prevent resource
leaks
Fixes: d01f8633d52e ("irqchip/ts4800: Add TS-4800 interrupt controller")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623015211.109382-1-fffsqian@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-ts4800.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/irqchip/irq-ts4800.c b/drivers/irqchip/irq-ts4800.c
index b2d61d4f6fe6f0..c218c588f37a90 100644
--- a/drivers/irqchip/irq-ts4800.c
+++ b/drivers/irqchip/irq-ts4800.c
@@ -28,6 +28,7 @@ struct ts4800_irq_data {
void __iomem *base;
struct platform_device *pdev;
struct irq_domain *domain;
+ unsigned int parent_irq;
};
static void ts4800_irq_mask(struct irq_data *d)
@@ -134,6 +135,7 @@ static int ts4800_ic_probe(struct platform_device *pdev)
irq_set_chained_handler_and_data(parent_irq,
ts4800_ic_chained_handle_irq, data);
+ data->parent_irq = parent_irq;
platform_set_drvdata(pdev, data);
return 0;
@@ -142,6 +144,14 @@ static int ts4800_ic_probe(struct platform_device *pdev)
static int ts4800_ic_remove(struct platform_device *pdev)
{
struct ts4800_irq_data *data = platform_get_drvdata(pdev);
+ unsigned int hwirq;
+
+ irq_set_chained_handler_and_data(data->parent_irq, NULL, NULL);
+
+ for (hwirq = 0; hwirq < 8; hwirq++)
+ irq_dispose_mapping(irq_find_mapping(data->domain, hwirq));
+
+ irq_dispose_mapping(data->parent_irq);
irq_domain_remove(data->domain);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0819/1266] virtio_net: disable cb when NAPI is busy-polled
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (817 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0818/1266] irqchip/ts4800: Fix missing chained handler cleanup on remove Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0820/1266] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
` (179 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin, Longjun Tang,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longjun Tang <tanglongjun@kylinos.cn>
[ Upstream commit 1eb8fc67ca41db71c90866ff76c990d85247daef ]
When busy-poll is active, napi_schedule_prep() returns false in
virtqueue_napi_schedule(), so virtqueue_disable_cb() is skipped.
The device may keep firing irqs until reaches virtqueue_napi_complete().
Under load (received == budget), it will lead to a large number
of spurious interrupts.
Fix it by disabling the callback at the virtnet_poll() entry.
This keeps the callback off while we poll and it is re-enabled by
virtqueue_napi_complete() when going idle.
Fixes: ceef438d613f ("virtio_net: remove custom busy_poll")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Longjun Tang <tanglongjun@kylinos.cn>
Link: https://patch.msgid.link/20260629024230.37325-1-lange_tang@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 8be173b76abe5b..fe0e647808cd7e 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2228,6 +2228,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
unsigned int received;
unsigned int xdp_xmit = 0;
+ if (budget)
+ virtqueue_disable_cb(rq->vq);
+
virtnet_poll_cleantx(rq, budget);
received = virtnet_receive(rq, budget, &xdp_xmit);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0820/1266] cxgb4: Fix decode strings dump for T6 adapters
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (818 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0819/1266] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0821/1266] net/sched: act_bpf: use rcu_dereference_bh() to read the filter Greg Kroah-Hartman
` (178 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gleb Markov, Potnuri Bharat Teja,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Markov <markov.gi@npc-ksb.ru>
[ Upstream commit 5d6dc22d62682d93f5f55f145ad792f2891de911 ]
Depending on the value of chip_version, the correct decode set is selected.
However, the subsequent matching with the t4 encoding type in the if-else
block results in a reassignment, which leads to the loss of support for
t6_decode as well as reinitializing of values t4_decode and t5_decode.
The component history shows that the if-else block previously used for
this purpose, as well as the execution order, was not affected by the
change.
Furthermore, it is suggested by the execution order that the scenario with
overwriting and loss of support will be implemented.
Delete the if-else block.
Fixes: 6df397539cb0 ("cxgb4: Update correct encoding of SGE Ingress DMA States for T6 adapter")
Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru>
Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com>
Link: https://patch.msgid.link/20260629130856.1168-1-markov.gi@npc-ksb.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 175bf9b1305888..1b8247bd9e9bf6 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -6737,14 +6737,6 @@ void t4_sge_decode_idma_state(struct adapter *adapter, int state)
return;
}
- if (is_t4(adapter->params.chip)) {
- sge_idma_decode = (const char **)t4_decode;
- sge_idma_decode_nstates = ARRAY_SIZE(t4_decode);
- } else {
- sge_idma_decode = (const char **)t5_decode;
- sge_idma_decode_nstates = ARRAY_SIZE(t5_decode);
- }
-
if (state < sge_idma_decode_nstates)
CH_WARN(adapter, "idma state %s\n", sge_idma_decode[state]);
else
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0821/1266] net/sched: act_bpf: use rcu_dereference_bh() to read the filter
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (819 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0820/1266] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0822/1266] ksmbd: reject undersized DACLs before parsing ACEs Greg Kroah-Hartman
` (177 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sechang Lim, Amery Hung,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sechang Lim <rhkrqnwk98@gmail.com>
[ Upstream commit adc49c7ba690c9b33b8392ec27397456b65d0893 ]
tcf_bpf_act() can run from the tc egress path, which holds only
rcu_read_lock_bh(), but reads prog->filter with rcu_dereference() and
trips lockdep:
WARNING: suspicious RCU usage
net/sched/act_bpf.c:47 suspicious rcu_dereference_check() usage!
1 lock held by syz.2.1588/12756:
#0: (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit net/core/dev.c:4792
tcf_bpf_act+0x6ae/0x940 net/sched/act_bpf.c:47
tcf_classify+0x6e4/0x1080 net/sched/cls_api.c:1860
sch_handle_egress net/core/dev.c:4545 [inline]
__dev_queue_xmit+0x2185/0x2c00 net/core/dev.c:4808
packet_sendmsg+0x3dfa/0x5120 net/packet/af_packet.c:3114
The other tc actions and cls_bpf already use rcu_dereference_bh() here.
Do the same.
Fixes: 1f211a1b929c ("net, sched: add clsact qdisc")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://patch.msgid.link/20260629154112.1164986-1-rhkrqnwk98@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_bpf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index a1c0e8a9fc8c2f..305c3c7d2d5fdd 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -44,7 +44,7 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb,
tcf_lastuse_update(&prog->tcf_tm);
bstats_update(this_cpu_ptr(prog->common.cpu_bstats), skb);
- filter = rcu_dereference(prog->filter);
+ filter = rcu_dereference_bh(prog->filter);
if (at_ingress) {
__skb_push(skb, skb->mac_len);
filter_res = bpf_prog_run_data_pointers(filter, skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0822/1266] ksmbd: reject undersized DACLs before parsing ACEs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (820 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0821/1266] net/sched: act_bpf: use rcu_dereference_bh() to read the filter Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0823/1266] smb: move some duplicate definitions to common/cifsglob.h Greg Kroah-Hartman
` (176 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haofeng Li, ChenXiaoSong,
Namjae Jeon, Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haofeng Li <lihaofeng@kylinos.cn>
[ Upstream commit 60908f7ebcd9b6cde74ad5711fab0f49c7970949 ]
parse_dacl() limits the attacker-controlled ACE count by comparing it
with the number of minimal ACEs that fit in the DACL size. The DACL size
field is 16 bits, but the expression subtracts sizeof(struct smb_acl).
Because sizeof() is unsigned, a DACL size smaller than the ACL header
underflows to a large size_t.
A malicious client can reach this with:
SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY)
-> smb2_set_info_sec()
-> set_info_sec()
-> parse_sec_desc()
-> parse_dacl()
-> init_acl_state(..., 0xffff)
-> init_acl_state(..., 0xffff)
-> kmalloc_objs(..., 0xffff)
Thus a malformed security descriptor can make num_aces pass the guard
and drive large temporary ACL state and pointer-array allocations.
Reject DACLs smaller than struct smb_acl before doing the subtraction,
so the ACE count check cannot be bypassed by the underflow.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/smbacl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index cd6c72fa1960c4..420d4e0733e5f1 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -374,6 +374,7 @@ static void parse_dacl(struct mnt_idmap *idmap,
{
int i, ret;
u16 num_aces = 0;
+ u16 dacl_size;
unsigned int acl_size;
char *acl_base;
struct smb_ace **ppace;
@@ -403,7 +404,11 @@ static void parse_dacl(struct mnt_idmap *idmap,
if (num_aces <= 0)
return;
- if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) /
+ dacl_size = le16_to_cpu(pdacl->size);
+ if (dacl_size < sizeof(struct smb_acl))
+ return;
+
+ if (num_aces > (dacl_size - sizeof(struct smb_acl)) /
(offsetof(struct smb_ace, sid) +
offsetof(struct smb_sid, sub_auth) + sizeof(__le16)))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0823/1266] smb: move some duplicate definitions to common/cifsglob.h
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (821 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 6.6 0822/1266] ksmbd: reject undersized DACLs before parsing ACEs Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0824/1266] ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Greg Kroah-Hartman
` (175 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChenXiaoSong, ZhangGuoDong,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <zhangguodong@kylinos.cn>
[ Upstream commit d877470b59910b5c50383d634dda3782386bba51 ]
In order to maintain the code more easily, move duplicate definitions to
new common header file.
Co-developed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 38637163501f ("ksmbd: fix use-after-free of fp->owner.name in durable handle owner check")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifsglob.h | 19 +------------------
fs/smb/common/cifsglob.h | 30 ++++++++++++++++++++++++++++++
fs/smb/server/smb_common.h | 14 +-------------
3 files changed, 32 insertions(+), 31 deletions(-)
create mode 100644 fs/smb/common/cifsglob.h
diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h
index 8e85332cb7abcc..97f70d437a7eb1 100644
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -25,6 +25,7 @@
#include "cifsacl.h"
#include <crypto/internal/hash.h>
#include <uapi/linux/cifs/cifs_mount.h>
+#include "../common/cifsglob.h"
#include "../common/smb2pdu.h"
#include "smb2pdu.h"
#include <linux/filelock.h>
@@ -669,12 +670,6 @@ get_rfc1002_length(void *buf)
return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
}
-static inline void
-inc_rfc1001_len(void *buf, int count)
-{
- be32_add_cpu((__be32 *)buf, count);
-}
-
struct TCP_Server_Info {
struct list_head tcp_ses_list;
struct list_head smb_ses_list;
@@ -982,8 +977,6 @@ compare_mid(__u16 mid, const struct smb_hdr *smb)
#define CIFS_MAX_RFC1002_WSIZE ((1<<17) - 1 - sizeof(WRITE_REQ) + 4)
#define CIFS_MAX_RFC1002_RSIZE ((1<<17) - 1 - sizeof(READ_RSP) + 4)
-#define CIFS_DEFAULT_IOSIZE (1024 * 1024)
-
/*
* Windows only supports a max of 60kb reads and 65535 byte writes. Default to
* those values when posix extensions aren't in force. In actuality here, we
@@ -2131,30 +2124,20 @@ extern mempool_t *cifs_req_poolp;
extern mempool_t *cifs_mid_poolp;
/* Operations for different SMB versions */
-#define SMB1_VERSION_STRING "1.0"
-#define SMB20_VERSION_STRING "2.0"
#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
extern struct smb_version_operations smb1_operations;
extern struct smb_version_values smb1_values;
extern struct smb_version_operations smb20_operations;
extern struct smb_version_values smb20_values;
#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-#define SMB21_VERSION_STRING "2.1"
extern struct smb_version_operations smb21_operations;
extern struct smb_version_values smb21_values;
-#define SMBDEFAULT_VERSION_STRING "default"
extern struct smb_version_values smbdefault_values;
-#define SMB3ANY_VERSION_STRING "3"
extern struct smb_version_values smb3any_values;
-#define SMB30_VERSION_STRING "3.0"
extern struct smb_version_operations smb30_operations;
extern struct smb_version_values smb30_values;
-#define SMB302_VERSION_STRING "3.02"
-#define ALT_SMB302_VERSION_STRING "3.0.2"
/*extern struct smb_version_operations smb302_operations;*/ /* not needed yet */
extern struct smb_version_values smb302_values;
-#define SMB311_VERSION_STRING "3.1.1"
-#define ALT_SMB311_VERSION_STRING "3.11"
extern struct smb_version_operations smb311_operations;
extern struct smb_version_values smb311_values;
diff --git a/fs/smb/common/cifsglob.h b/fs/smb/common/cifsglob.h
new file mode 100644
index 00000000000000..00fd215e3eb547
--- /dev/null
+++ b/fs/smb/common/cifsglob.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1 */
+/*
+ *
+ * Copyright (C) International Business Machines Corp., 2002,2008
+ * Author(s): Steve French (sfrench@us.ibm.com)
+ * Jeremy Allison (jra@samba.org)
+ *
+ */
+#ifndef _COMMON_CIFS_GLOB_H
+#define _COMMON_CIFS_GLOB_H
+
+static inline void inc_rfc1001_len(void *buf, int count)
+{
+ be32_add_cpu((__be32 *)buf, count);
+}
+
+#define SMB1_VERSION_STRING "1.0"
+#define SMB20_VERSION_STRING "2.0"
+#define SMB21_VERSION_STRING "2.1"
+#define SMBDEFAULT_VERSION_STRING "default"
+#define SMB3ANY_VERSION_STRING "3"
+#define SMB30_VERSION_STRING "3.0"
+#define SMB302_VERSION_STRING "3.02"
+#define ALT_SMB302_VERSION_STRING "3.0.2"
+#define SMB311_VERSION_STRING "3.1.1"
+#define ALT_SMB311_VERSION_STRING "3.11"
+
+#define CIFS_DEFAULT_IOSIZE (1024 * 1024)
+
+#endif /* _COMMON_CIFS_GLOB_H */
diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
index bc832fa9a82c87..3f274af060dab9 100644
--- a/fs/smb/server/smb_common.h
+++ b/fs/smb/server/smb_common.h
@@ -10,6 +10,7 @@
#include "glob.h"
#include "nterr.h"
+#include "../common/cifsglob.h"
#include "../common/smb2pdu.h"
#include "smb2pdu.h"
@@ -26,16 +27,8 @@
#define SMB311_PROT 6
#define BAD_PROT 0xFFFF
-#define SMB1_VERSION_STRING "1.0"
-#define SMB20_VERSION_STRING "2.0"
-#define SMB21_VERSION_STRING "2.1"
-#define SMB30_VERSION_STRING "3.0"
-#define SMB302_VERSION_STRING "3.02"
-#define SMB311_VERSION_STRING "3.1.1"
-
#define SMB_ECHO_INTERVAL (60 * HZ)
-#define CIFS_DEFAULT_IOSIZE (64 * 1024)
#define MAX_CIFS_SMALL_BUFFER_SIZE 448 /* big enough for most */
#define MAX_STREAM_PROT_LEN 0x00FFFFFF
@@ -462,9 +455,4 @@ static inline unsigned int get_rfc1002_len(void *buf)
{
return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
}
-
-static inline void inc_rfc1001_len(void *buf, int count)
-{
- be32_add_cpu((__be32 *)buf, count);
-}
#endif /* __SMB_COMMON_H__ */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0824/1266] ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (822 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0823/1266] smb: move some duplicate definitions to common/cifsglob.h Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0825/1266] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
` (174 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gil Portnoy, Namjae Jeon,
Steve French, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Portnoy <dddhkts1@gmail.com>
[ Upstream commit 38637163501fd9e2f684b8cd275d0db5d79f37c6 ]
Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same
persistent_id race the fp->owner.name compare-read in
ksmbd_vfs_compare_durable_owner() against the kfree() in
ksmbd_reopen_durable_fd()'s reopen-success path. fp->owner.name is a
standalone kstrdup() buffer whose lifetime is independent of the fp
refcount, and the two sites share no lock: the compare reads the buffer
while the reopen frees it, so the strcmp() can dereference freed memory.
Commit 7ce4fc40018d ("ksmbd: fix durable reconnect double-bind race in
ksmbd_reopen_durable_fd") made the fp->conn claim atomic under
global_ft.lock (closing the owner.name double-free and the ksmbd_file
write-UAF), but the compare-read versus reopen-free pair was left
unserialized.
BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80
Read of size 1 by task kworker
strcmp
ksmbd_vfs_compare_durable_owner
smb2_check_durable_oplock
smb2_open
Freed by task kworker:
kfree
ksmbd_reopen_durable_fd
smb2_open
Allocated by task kworker:
kstrdup
session_fd_check
smb2_session_logoff
The buggy address belongs to the cache kmalloc-8
Serialize both sides of the race with fp->f_lock. The global durable
file-table lock still protects the durable reconnect claim, but
fp->owner.name is per-open state and does not need to block unrelated
durable table lookups or reconnects. The teardown is left at its
existing location after the reopen-success point so that an __open_id()
rollback still retains owner.name for a later legitimate reconnect to
verify.
Fixes: 49110a8ce654 ("ksmbd: validate owner of durable handle on reconnect")
Assisted-by: Henry (Claude):claude-opus-4
Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
Co-developed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/vfs_cache.c | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index 52d1432e29526a..57f84fb59138f2 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -986,16 +986,21 @@ void ksmbd_stop_durable_scavenger(void)
static int ksmbd_vfs_copy_durable_owner(struct ksmbd_file *fp,
struct ksmbd_user *user)
{
+ char *name;
+
if (!user)
return -EINVAL;
/* Duplicate the user name to ensure identity persistence */
- fp->owner.name = kstrdup(user->name, GFP_KERNEL);
- if (!fp->owner.name)
+ name = kstrdup(user->name, GFP_KERNEL);
+ if (!name)
return -ENOMEM;
+ spin_lock(&fp->f_lock);
fp->owner.uid = user->uid;
fp->owner.gid = user->gid;
+ fp->owner.name = name;
+ spin_unlock(&fp->f_lock);
return 0;
}
@@ -1013,18 +1018,24 @@ static int ksmbd_vfs_copy_durable_owner(struct ksmbd_file *fp,
bool ksmbd_vfs_compare_durable_owner(struct ksmbd_file *fp,
struct ksmbd_user *user)
{
- if (!user || !fp->owner.name)
+ bool ret = false;
+
+ if (!user)
return false;
+ spin_lock(&fp->f_lock);
+ if (!fp->owner.name)
+ goto out;
+
/* Check if the UID and GID match first (fast path) */
if (fp->owner.uid != user->uid || fp->owner.gid != user->gid)
- return false;
+ goto out;
/* Validate the account name to ensure the same SecurityContext */
- if (strcmp(fp->owner.name, user->name))
- return false;
-
- return true;
+ ret = (strcmp(fp->owner.name, user->name) == 0);
+out:
+ spin_unlock(&fp->f_lock);
+ return ret;
}
static bool session_fd_check(struct ksmbd_tree_connect *tcon,
@@ -1178,9 +1189,11 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
}
up_write(&ci->m_lock);
+ spin_lock(&fp->f_lock);
fp->owner.uid = fp->owner.gid = 0;
kfree(fp->owner.name);
fp->owner.name = NULL;
+ spin_unlock(&fp->f_lock);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0825/1266] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (823 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0824/1266] ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0826/1266] pinctrl: meson: restore non-sleeping GPIO access Greg Kroah-Hartman
` (173 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy,
Bartosz Golaszewski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit 8d7e62d5e9b2d2ff146f472a9215d7e29c7e2307 ]
Out of memory situation on driver's probe is expected to be reported to
the driver's framework with a proper -ENOMEM error code.
Fixes: 35570ac6039e ("gpio: add GPIO driver for the Timberdale FPGA")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Link: https://patch.msgid.link/20260630145148.4081967-1-vz@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-timberdale.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index fad97979748653..c40fb5ec93e6bd 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -228,7 +228,7 @@ static int timbgpio_probe(struct platform_device *pdev)
tgpio = devm_kzalloc(dev, sizeof(*tgpio), GFP_KERNEL);
if (!tgpio)
- return -EINVAL;
+ return -ENOMEM;
tgpio->irq_base = pdata->irq_base;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0826/1266] pinctrl: meson: restore non-sleeping GPIO access
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (824 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0825/1266] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0827/1266] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
` (172 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viacheslav Bocharov, Linus Walleij,
Bartosz Golaszewski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Bocharov <v@baodeep.com>
[ Upstream commit 9777530157e7b82fd994327ff878c4245dadc931 ]
Commit 28f240683871 ("pinctrl: meson: mark the GPIO controller as
sleeping") set gpio_chip.can_sleep = true to work around
gpio-shared-proxy holding a spinlock across a sleeping pinctrl config
path. That locking bug is now fixed in the shared-proxy itself ("gpio:
shared-proxy: always serialize with a sleeping mutex"), so the
controller-wide workaround is no longer needed; the meson GPIO
controller does not sleep.
meson_gpio_get/set/direction_* access MMIO through regmap. The
regmap_mmio bus uses fast I/O (spinlock) locking, so these value
callbacks do not contain sleeping operations. Since gpio_chip.can_sleep
describes the get/set value path, restore can_sleep = false.
Marking the controller sleeping also broke atomic value consumers such
as w1-gpio (1-Wire bitbang): w1_io.c runs its read time slot under
local_irq_save() and uses the non-cansleep gpiod_set_value() /
gpiod_get_value(), which with can_sleep=true trigger WARN_ON(can_sleep)
in gpiolib on every transferred bit (from w1_gpio_write_bit() /
w1_gpio_read_bit() via w1_reset_bus() and w1_search()). The printk and
stack dump inside the IRQs-off, microsecond-scale time slot destroy the
bit timing, so reset/presence detection and ROM search fail: the bus
master registers but w1_master_slave_count stays at 0 and no devices
are found. Verified on an Amlogic A113X board (DS18B20 on GPIOA_14):
with can_sleep restored to false the warnings are gone and the sensor
is detected and read again.
This must not be applied or backported without the shared-proxy locking
fix above; otherwise the original Khadas VIM3 splat returns on boards
that genuinely share a meson GPIO.
Fixes: 28f240683871 ("pinctrl: meson: mark the GPIO controller as sleeping")
Link: https://lore.kernel.org/all/20260105150509.56537-1-bartosz.golaszewski@oss.qualcomm.com/
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Acked-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260625115718.1678991-3-v@baodeep.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 4f613f9082083f..5cc00fdc48d840 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -618,7 +618,7 @@ static int meson_gpiolib_register(struct meson_pinctrl *pc)
pc->chip.set = meson_gpio_set;
pc->chip.base = -1;
pc->chip.ngpio = pc->data->num_pins;
- pc->chip.can_sleep = true;
+ pc->chip.can_sleep = false;
ret = gpiochip_add_data(&pc->chip, pc);
if (ret) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0827/1266] net/sched: hhf: clear heavy-hitter state on reset
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (825 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0826/1266] pinctrl: meson: restore non-sleeping GPIO access Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0828/1266] fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid Greg Kroah-Hartman
` (171 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius, David S. Miller,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit a225f8c20712713406ae47024b8df42deacddd4a ]
HHF reset does not clear the classifier state used to identify heavy
hitters. Packets after reset can therefore be scheduled using flow
history from before the reset.
The reset operation should return the qdisc to an empty state.
Clear the heavy-hitter classifier tables when HHF is reset.
Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hhf.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 67b555c02f2c01..aca4795c4101f0 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -461,12 +461,39 @@ static struct sk_buff *hhf_dequeue(struct Qdisc *sch)
return skb;
}
+static void hhf_reset_classifier(struct hhf_sched_data *q)
+{
+ int i;
+
+ if (!q->hh_flows)
+ return;
+
+ for (i = 0; i < HH_FLOWS_CNT; i++) {
+ struct hh_flow_state *flow, *next;
+ struct list_head *head = &q->hh_flows[i];
+
+ list_for_each_entry_safe(flow, next, head, flowchain) {
+ list_del(&flow->flowchain);
+ kfree(flow);
+ }
+ }
+ WRITE_ONCE(q->hh_flows_current_cnt, 0);
+
+ for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+ if (q->hhf_valid_bits[i])
+ bitmap_zero(q->hhf_valid_bits[i], HHF_ARRAYS_LEN);
+ }
+ q->hhf_arrays_reset_timestamp = hhf_time_stamp();
+}
+
static void hhf_reset(struct Qdisc *sch)
{
+ struct hhf_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
while ((skb = hhf_dequeue(sch)) != NULL)
rtnl_kfree_skbs(skb, skb);
+ hhf_reset_classifier(q);
}
static void hhf_destroy(struct Qdisc *sch)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0828/1266] fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (826 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0827/1266] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0829/1266] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
` (170 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara,
Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 539dce1144651f7976fa418e618b0b574bf15eeb ]
vfs_tmpfile() never checked that the caller's fsuid and fsgid map into
the filesystem. On an idmapped mount whose idmapping does not cover the
caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode
through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return
INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1.
Every other creation path already refuses this: may_o_create() (O_CREAT)
and may_create_dentry() (mkdir, mknod, symlink, link) bail out with
-EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot
be created with an owner the filesystem cannot represent. An O_TMPFILE
is no exception: it is created I_LINKABLE and linkat(2) can splice it
into the namespace afterwards, so the same guarantee must hold.
Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a
non-idmapped mount the caller's fs{u,g}id always map in the superblock's
user namespace, so this is a no-op there and only takes effect on an
idmapped mount that does not map the caller. It applies to every
filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs,
ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer
tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().
Fixes: 8e5389132ab4 ("fs: introduce fsuidgid_has_mapping() helper")
Link: https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-1-754a94d81f83@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namei.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/namei.c b/fs/namei.c
index 02b0c273129824..861390e523b2a0 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3676,6 +3676,10 @@ static int vfs_tmpfile(struct mnt_idmap *idmap,
int error;
int open_flag = file->f_flags;
+ /* A tmpfile is I_LINKABLE, so guard its owner like may_o_create(). */
+ if (!fsuidgid_has_mapping(dir->i_sb, idmap))
+ return -EOVERFLOW;
+
/* we want directory to be writable */
error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
if (error)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0829/1266] afs: Fix error code in afs_extract_vl_addrs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (827 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0828/1266] fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0830/1266] afs: use kvfree() to free memory allocated by kvcalloc() Greg Kroah-Hartman
` (169 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, David Howells,
Marc Dionne, linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 4897cb71d4ab1f7e1a214adb1e4b80176702368d ]
The error codes on these paths are only set on the first iteration
through the loop. Set the correct error code on every iteration.
Fixes: 0a5143f2f89c ("afs: Implement VL server rotation")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-3-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/vl_list.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/afs/vl_list.c b/fs/afs/vl_list.c
index acc48216136aed..631ee7e0629dc1 100644
--- a/fs/afs/vl_list.c
+++ b/fs/afs/vl_list.c
@@ -88,7 +88,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
{
struct afs_addr_list *alist;
const u8 *b = *_b;
- int ret = -EINVAL;
+ int ret;
alist = afs_alloc_addrlist(nr_addrs, VL_SERVICE, port);
if (!alist)
@@ -106,6 +106,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
case DNS_ADDRESS_IS_IPV4:
if (end - b < 4) {
_leave(" = -EINVAL [short inet]");
+ ret = -EINVAL;
goto error;
}
memcpy(x, b, 4);
@@ -116,6 +117,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
case DNS_ADDRESS_IS_IPV6:
if (end - b < 16) {
_leave(" = -EINVAL [short inet6]");
+ ret = -EINVAL;
goto error;
}
memcpy(x, b, 16);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0830/1266] afs: use kvfree() to free memory allocated by kvcalloc()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (828 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0829/1266] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0831/1266] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
` (168 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, David Howells,
Marc Dionne, linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit cb39654926f8e7a08ecc1dcb3941628855275940 ]
op->more_files is allocated with kvcalloc() but released via
afs_put_operation(), which uses kfree() internally. This mismach prevents
the resource from being released properly and may lead to undefined
behavior.
Fix this by using kvfree() to free op->more_files to match its allocation
method.
Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-8-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/fs_operation.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c
index 7a3803ce3a2297..4316cce855cd7c 100644
--- a/fs/afs/fs_operation.c
+++ b/fs/afs/fs_operation.c
@@ -240,7 +240,7 @@ int afs_put_operation(struct afs_operation *op)
for (i = 0; i < op->nr_files - 2; i++)
if (op->more_files[i].put_vnode)
iput(&op->more_files[i].vnode->netfs.inode);
- kfree(op->more_files);
+ kvfree(op->more_files);
}
afs_end_cursor(&op->ac);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0831/1266] afs: Fix callback service message parsers to pass through -EAGAIN
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (829 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0830/1266] afs: use kvfree() to free memory allocated by kvcalloc() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0832/1266] afs: Fix vllist leak Greg Kroah-Hartman
` (167 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 0f36469d7ce98b362934113c550d08bb0c784231 ]
The AFS filesystem client uses an rxrpc server to listen for callback
notifications. Each callback call type handler has a delivery function
that parses the incoming request stream, and this should return -EAGAIN the
last packet hasn't yet been seen, but all currently queued received data is
consumed. afs_extract_data() does this, but the -EAGAIN return is switched
to 0 inadvertantly
Fix callback service message parsers to pass through -EAGAIN
Fixes: d001648ec7cf ("rxrpc: Don't expose skbs to in-kernel users [ver #2]")
Closes: https://sashiko.dev/#/patchset/20260609081738.770127-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-14-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/cmservice.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index d4ddb20d673208..69877bf9a42ebc 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -390,7 +390,6 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
ret = afs_extract_data(call, false);
switch (ret) {
case 0: break;
- case -EAGAIN: return 0;
default: return ret;
}
@@ -503,7 +502,6 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
ret = afs_extract_data(call, false);
switch (ret) {
case 0: break;
- case -EAGAIN: return 0;
default: return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0832/1266] afs: Fix vllist leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (830 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0831/1266] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0833/1266] afs: Fix the volume AFS_VOLUME_RM_TREE is set on Greg Kroah-Hartman
` (166 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit fc10c0ecf06f2981af5d04357612b00051e03e9e ]
Fix a leak of the new vllist in afs_update_cell() in the event that it is an
empty list (nr_servers == 0), in which case the old list isn't displaced
unless the old list is also empty.
Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup")
Closes: https://sashiko.dev/#/patchset/20260609081738.770127-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-18-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/cell.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 7c0dce8eecadd1..93f695936fefca 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -474,6 +474,8 @@ static int afs_update_cell(struct afs_cell *cell)
rcu_assign_pointer(cell->vl_servers, vllist);
cell->dns_source = vllist->source;
old = p;
+ } else {
+ old = vllist;
}
write_unlock(&cell->vl_servers_lock);
afs_put_vlserverlist(cell->net, old);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0833/1266] afs: Fix the volume AFS_VOLUME_RM_TREE is set on
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (831 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0832/1266] afs: Fix vllist leak Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0834/1266] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
` (165 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 56b4e4b26f84411d880f968a539207b0a8889c8c ]
Fix afs_insert_volume_into_cell() to set AFS_VOLUME_RM_TREE on the volume
replaced, not the new volume, as it's now removed from the cell's volume
tree. This will cause the old volume to be removed from the tree twice and
the new volume never to be removed.
Fixes: 9a6b294ab496 ("afs: Fix use-after-free due to get/remove race in volume tree")
Closes: https://sashiko.dev/#/patchset/20260618074903.2374756-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-21-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/volume.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 0f64b97581272e..3f2e088fb27d98 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -37,7 +37,7 @@ static struct afs_volume *afs_insert_volume_into_cell(struct afs_cell *cell,
goto found;
}
- set_bit(AFS_VOLUME_RM_TREE, &volume->flags);
+ set_bit(AFS_VOLUME_RM_TREE, &p->flags);
rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0834/1266] afs: Fix unchecked-length string display in debug statement
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (832 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0833/1266] afs: Fix the volume AFS_VOLUME_RM_TREE is set on Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0835/1266] minix: avoid overflow in bitmap block count calculation Greg Kroah-Hartman
` (164 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 903d37c97228258da71e092f8b4ab260ce81497d ]
Fix afs_extract_vlserver_list() to limit the length of the displayed
string in a debug statement().
Fixes: 0a5143f2f89c ("afs: Implement VL server rotation")
Closes: https://sashiko.dev/#/patchset/20260618074903.2374756-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-22-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/vl_list.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/afs/vl_list.c b/fs/afs/vl_list.c
index 631ee7e0629dc1..2761ac3ab0076f 100644
--- a/fs/afs/vl_list.c
+++ b/fs/afs/vl_list.c
@@ -192,6 +192,8 @@ struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *cell,
b += sizeof(*hdr);
while (end - b >= sizeof(bs)) {
+ int nlen;
+
bs.name_len = afs_extract_le16(&b);
bs.priority = afs_extract_le16(&b);
bs.weight = afs_extract_le16(&b);
@@ -201,10 +203,12 @@ struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *cell,
bs.protocol = *b++;
bs.nr_addrs = *b++;
+ nlen = min3(bs.name_len, end - b, 255);
+
_debug("extract %u %u %u %u %u %u %*.*s",
bs.name_len, bs.priority, bs.weight,
bs.port, bs.protocol, bs.nr_addrs,
- bs.name_len, bs.name_len, b);
+ bs.name_len, nlen, b);
if (end - b < bs.name_len)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0835/1266] minix: avoid overflow in bitmap block count calculation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (833 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0834/1266] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0836/1266] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
` (163 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jan Kara,
Christian Brauner (Amutable), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit fb3e566cafc38fe3ba35e6843a2d529a3748870c ]
minix_check_superblock() uses minix_blocks_needed() to verify that the
on-disk imap and zmap block counts are large enough for the advertised
inode and zone counts.
The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.
A Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the
addition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap
block count look valid, after which minix_fill_super() can dereference
s_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.
Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is
near UINT_MAX makes minix_check_superblock() accept a zero bitmap-block
count and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking
the kernel.
The divisor is the bitmap capacity in bits, blocksize * 8, which is
always a power of two: minix_fill_super() obtains the block size through
sb_set_blocksize(), and blk_validate_block_size() rejects any size that
is not a power of two. Use DIV_ROUND_UP_POW2(), which divides before
adding the round-up term and so cannot overflow for a power-of-two
divisor.
Fixes: 8c97a6ddc956 ("minix: Add required sanity checking to minix_check_superblock()")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618143922.3066874-1-michael.bommarito@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/minix/minix.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d493507c064f67..aee0ff9e5623d4 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -91,7 +91,7 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
{
- return DIV_ROUND_UP(bits, blocksize * 8);
+ return DIV_ROUND_UP_POW2(bits, blocksize * 8);
}
#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0836/1266] ata: sata_gemini: unwind clocks on IDE pinctrl errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (834 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0835/1266] minix: avoid overflow in bitmap block count calculation Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0837/1266] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
` (162 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Niklas Cassel, Linus Walleij, Damien Le Moal, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit c0ace4130e813acbabdfaa28d4e94a849c2ffdd7 ]
gemini_sata_bridge_init() prepares and enables both SATA PCLKs, then
disables them again while keeping the clocks prepared for later bridge
start and stop operations. If gemini_setup_ide_pins() fails after that,
gemini_sata_probe() returns directly and skips the existing
out_unprep_clk unwind path.
Route the IDE pinctrl failure through out_unprep_clk so the clocks
prepared by gemini_sata_bridge_init() are unprepared before probe
fails.
Fixes: d872ced29d5f ("ata: sata_gemini: Introduce explicit IDE pin control")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/sata_gemini.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c
index 4c270999ba3ccd..22a30c1d88863a 100644
--- a/drivers/ata/sata_gemini.c
+++ b/drivers/ata/sata_gemini.c
@@ -385,7 +385,7 @@ static int gemini_sata_probe(struct platform_device *pdev)
if (sg->ide_pins) {
ret = gemini_setup_ide_pins(dev);
if (ret)
- return ret;
+ goto out_unprep_clk;
}
dev_info(dev, "set up the Gemini IDE/SATA nexus\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0837/1266] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (835 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0836/1266] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0838/1266] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
` (161 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgiy Osokin, Jiri Kosina,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgiy Osokin <g.osokin@auroraos.dev>
[ Upstream commit 0021eb09041f021c079be1022934a280f7f176c0 ]
In picolcd_send_and_wait(), an integer overflow of the signed loop counter
'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
If the loop executes more than INT_MAX times, 'k' becomes negative,
making the condition 'k < size' true even when 'size' is 0.
Change the type of 'k' to 'unsigned int' to prevent the overflow and
eliminate the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
[jkosina@suse.com: extended hash length]
Fixes: fabdbf2fd22fa17 ("HID: picoLCD: split driver code")
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-picolcd_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index bbda231a7ce303..ee0977a8e42e0d 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -72,7 +72,8 @@ struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
struct picolcd_pending *work;
struct hid_report *report = picolcd_out_report(report_id, hdev);
unsigned long flags;
- int i, j, k;
+ int i, j;
+ unsigned int k;
if (!report || !data)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0838/1266] HID: core: Fix OOB read in hid_get_report for numbered reports
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (836 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0837/1266] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0839/1266] arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) Greg Kroah-Hartman
` (160 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Jiri Kosina, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
[ Upstream commit af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 ]
When a caller passes a size of 0 to hid_report_raw_event() for a
numbered report, the function originally called hid_get_report() before
performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered
is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the
call to hid_get_report(), ensuring that size is at least 1 before
dereferencing the data pointer.
Fixes: 2c85c61d1332 ("HID: pass the buffer size to hid_report_raw_event")
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2de4d831c526a8..b3bcc0fdede7ff 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1998,6 +1998,13 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
u8 *cdata = data;
int ret = 0;
+ if (report_enum->numbered && (size < 1 || bufsize < 1)) {
+ hid_warn_ratelimited(hid,
+ "Event data for numbered report is too short (%d vs %zu)\n",
+ size, bufsize);
+ return -EINVAL;
+ }
+
report = hid_get_report(report_enum, data);
if (!report)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0839/1266] arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (837 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0838/1266] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0840/1266] arm64/mm: convert set_pte_at() to set_ptes(..., 1) Greg Kroah-Hartman
` (159 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryan Roberts, John Hubbard,
Mark Rutland, Catalin Marinas, Alistair Popple, Andrey Ryabinin,
Ard Biesheuvel, Barry Song, Borislav Petkov (AMD), Dave Hansen,
David Hildenbrand, H. Peter Anvin, Ingo Molnar, James Morse,
Kefeng Wang, Marc Zyngier, Matthew Wilcox (Oracle),
Thomas Gleixner, Will Deacon, Yang Shi, Zi Yan, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <ryan.roberts@arm.com>
[ Upstream commit 532736558e8ef2865eae1d84b52dda4422cac810 ]
There are a number of places in the arch code that read a pte by using the
READ_ONCE() macro. Refactor these call sites to instead use the
ptep_get() helper, which itself is a READ_ONCE(). Generated code should
be the same.
This will benefit us when we shortly introduce the transparent contpte
support. In this case, ptep_get() will become more complex so we now have
all the code abstracted through it.
Link: https://lkml.kernel.org/r/20240215103205.2607016-8-ryan.roberts@arm.com
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Tested-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Barry Song <21cnbao@gmail.com>
Cc: Borislav Petkov (AMD) <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morse <james.morse@arm.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <shy828301@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: ff4c5a0de1f2 ("arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 12 +++++++++---
arch/arm64/kernel/efi.c | 2 +-
arch/arm64/mm/fault.c | 4 ++--
arch/arm64/mm/hugetlbpage.c | 6 +++---
arch/arm64/mm/kasan_init.c | 2 +-
arch/arm64/mm/mmu.c | 12 ++++++------
arch/arm64/mm/pageattr.c | 4 ++--
arch/arm64/mm/trans_pgd.c | 2 +-
8 files changed, 25 insertions(+), 19 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 7350243a6a28d1..67a2c9eeede964 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -281,6 +281,12 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
}
}
+#define ptep_get ptep_get
+static inline pte_t ptep_get(pte_t *ptep)
+{
+ return READ_ONCE(*ptep);
+}
+
extern void __sync_icache_dcache(pte_t pteval);
bool pgattr_change_is_safe(u64 old, u64 new);
@@ -308,7 +314,7 @@ static inline void __check_safe_pte_update(struct mm_struct *mm, pte_t *ptep,
if (!IS_ENABLED(CONFIG_DEBUG_VM))
return;
- old_pte = READ_ONCE(*ptep);
+ old_pte = ptep_get(ptep);
if (!pte_valid(old_pte) || !pte_valid(pte))
return;
@@ -897,7 +903,7 @@ static inline int __ptep_test_and_clear_young(pte_t *ptep)
{
pte_t old_pte, pte;
- pte = READ_ONCE(*ptep);
+ pte = ptep_get(ptep);
do {
old_pte = pte;
pte = pte_mkold(pte);
@@ -979,7 +985,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
{
pte_t old_pte, pte;
- pte = READ_ONCE(*ptep);
+ pte = ptep_get(ptep);
do {
old_pte = pte;
pte = pte_wrprotect(pte);
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 2b478ca356b00f..e72d62416b1a08 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -107,7 +107,7 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
{
struct set_perm_data *spd = data;
const efi_memory_desc_t *md = spd->md;
- pte_t pte = READ_ONCE(*ptep);
+ pte_t pte = ptep_get(ptep);
if (md->attribute & EFI_MEMORY_RO)
pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 893b9485b840a4..7bcdc99ed57148 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -191,7 +191,7 @@ static void show_pte(unsigned long addr)
if (!ptep)
break;
- pte = READ_ONCE(*ptep);
+ pte = ptep_get(ptep);
pr_cont(", pte=%016llx", pte_val(pte));
pte_unmap(ptep);
} while(0);
@@ -214,7 +214,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
pte_t entry, int dirty)
{
pteval_t old_pteval, pteval;
- pte_t pte = READ_ONCE(*ptep);
+ pte_t pte = ptep_get(ptep);
if (pte_same(pte, entry))
return 0;
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 06efc3a1652eb5..a5a56e30c254b0 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -479,7 +479,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
size_t pgsize;
pte_t pte;
- if (!pte_cont(READ_ONCE(*ptep))) {
+ if (!pte_cont(ptep_get(ptep))) {
ptep_set_wrprotect(mm, addr, ptep);
return;
}
@@ -504,7 +504,7 @@ pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
size_t pgsize;
int ncontig;
- if (!pte_cont(READ_ONCE(*ptep)))
+ if (!pte_cont(ptep_get(ptep)))
return ptep_clear_flush(vma, addr, ptep);
ncontig = find_num_contig(mm, addr, ptep, &pgsize);
@@ -552,7 +552,7 @@ pte_t huge_ptep_modify_prot_start(struct vm_area_struct *vma, unsigned long addr
* when the permission changes from executable to non-executable
* in cases where cpu is affected with errata #2645198.
*/
- if (pte_user_exec(READ_ONCE(*ptep)))
+ if (pte_user_exec(ptep_get(ptep)))
return huge_ptep_clear_flush(vma, addr, ptep);
}
return huge_ptep_get_and_clear(vma->vm_mm, addr, ptep, psize);
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index f17d066e85eb85..1b96e0ad666100 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -113,7 +113,7 @@ static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
memset(__va(page_phys), KASAN_SHADOW_INIT, PAGE_SIZE);
next = addr + PAGE_SIZE;
set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
- } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
+ } while (ptep++, addr = next, addr != end && pte_none(ptep_get(ptep)));
}
static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 8c5cbf4c858d90..fcc9b965aa7e68 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -165,7 +165,7 @@ static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end,
phys_addr_t phys, pgprot_t prot)
{
do {
- pte_t old_pte = READ_ONCE(*ptep);
+ pte_t old_pte = ptep_get(ptep);
/*
* Required barriers to make this visible to the table walker
@@ -178,7 +178,7 @@ static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end,
* only allow updates to the permission attributes.
*/
BUG_ON(!pgattr_change_is_safe(pte_val(old_pte),
- READ_ONCE(pte_val(*ptep))));
+ pte_val(ptep_get(ptep))));
phys += PAGE_SIZE;
} while (ptep++, addr += PAGE_SIZE, addr != end);
@@ -864,7 +864,7 @@ static void unmap_hotplug_pte_range(pmd_t *pmdp, unsigned long addr,
do {
ptep = pte_offset_kernel(pmdp, addr);
- pte = READ_ONCE(*ptep);
+ pte = ptep_get(ptep);
if (pte_none(pte))
continue;
@@ -1001,7 +1001,7 @@ static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
do {
ptep = pte_offset_kernel(pmdp, addr);
- pte = READ_ONCE(*ptep);
+ pte = ptep_get(ptep);
/*
* This is just a sanity check here which verifies that
@@ -1020,7 +1020,7 @@ static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
*/
ptep = pte_offset_kernel(pmdp, 0UL);
for (i = 0; i < PTRS_PER_PTE; i++) {
- if (!pte_none(READ_ONCE(ptep[i])))
+ if (!pte_none(ptep_get(&ptep[i])))
return;
}
@@ -1495,7 +1495,7 @@ pte_t ptep_modify_prot_start(struct vm_area_struct *vma, unsigned long addr, pte
* when the permission changes from executable to non-executable
* in cases where cpu is affected with errata #2645198.
*/
- if (pte_user_exec(READ_ONCE(*ptep)))
+ if (pte_user_exec(ptep_get(ptep)))
return ptep_clear_flush(vma, addr, ptep);
}
return ptep_get_and_clear(vma->vm_mm, addr, ptep);
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index 0a62f458c5cb02..e0e35bd942222a 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -36,7 +36,7 @@ bool can_set_direct_map(void)
static int change_page_range(pte_t *ptep, unsigned long addr, void *data)
{
struct page_change_data *cdata = data;
- pte_t pte = READ_ONCE(*ptep);
+ pte_t pte = ptep_get(ptep);
pte = clear_pte_bit(pte, cdata->clear_mask);
pte = set_pte_bit(pte, cdata->set_mask);
@@ -242,5 +242,5 @@ bool kernel_page_present(struct page *page)
return true;
ptep = pte_offset_kernel(pmdp, addr);
- return pte_valid(READ_ONCE(*ptep));
+ return pte_valid(ptep_get(ptep));
}
diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c
index 7b14df3c64776f..f71ab4704cce7c 100644
--- a/arch/arm64/mm/trans_pgd.c
+++ b/arch/arm64/mm/trans_pgd.c
@@ -33,7 +33,7 @@ static void *trans_alloc(struct trans_pgd_info *info)
static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr)
{
- pte_t pte = READ_ONCE(*src_ptep);
+ pte_t pte = ptep_get(src_ptep);
if (pte_valid(pte)) {
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0840/1266] arm64/mm: convert set_pte_at() to set_ptes(..., 1)
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (838 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0839/1266] arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0841/1266] arm64/mm: convert ptep_clear() to ptep_get_and_clear() Greg Kroah-Hartman
` (158 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryan Roberts, John Hubbard,
Mark Rutland, Catalin Marinas, Alistair Popple, Andrey Ryabinin,
Ard Biesheuvel, Barry Song, Borislav Petkov (AMD), Dave Hansen,
David Hildenbrand, H. Peter Anvin, Ingo Molnar, James Morse,
Kefeng Wang, Marc Zyngier, Matthew Wilcox (Oracle),
Thomas Gleixner, Will Deacon, Yang Shi, Zi Yan, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <ryan.roberts@arm.com>
[ Upstream commit 659e193027910a5d3083e34b488ab459d2ef5082 ]
Since set_ptes() was introduced, set_pte_at() has been implemented as a
generic macro around set_ptes(..., 1). So this change should continue to
generate the same code. However, making this change prepares us for the
transparent contpte support. It means we can reroute set_ptes() to
__set_ptes(). Since set_pte_at() is a generic macro, there will be no
equivalent __set_pte_at() to reroute to.
Note that a couple of calls to set_pte_at() remain in the arch code. This
is intentional, since those call sites are acting on behalf of core-mm and
should continue to call into the public set_ptes() rather than the
arch-private __set_ptes().
Link: https://lkml.kernel.org/r/20240215103205.2607016-9-ryan.roberts@arm.com
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Tested-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Barry Song <21cnbao@gmail.com>
Cc: Borislav Petkov (AMD) <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morse <james.morse@arm.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <shy828301@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: ff4c5a0de1f2 ("arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 2 +-
arch/arm64/kernel/mte.c | 2 +-
arch/arm64/kvm/guest.c | 2 +-
arch/arm64/mm/fault.c | 2 +-
arch/arm64/mm/hugetlbpage.c | 10 +++++-----
5 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 67a2c9eeede964..3ae4239c88d1ff 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -1077,7 +1077,7 @@ static inline void arch_swap_restore(swp_entry_t entry, struct folio *folio)
#endif /* CONFIG_ARM64_MTE */
/*
- * On AArch64, the cache coherency is handled via the set_pte_at() function.
+ * On AArch64, the cache coherency is handled via the set_ptes() function.
*/
static inline void update_mmu_cache_range(struct vm_fault *vmf,
struct vm_area_struct *vma, unsigned long addr, pte_t *ptep,
diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
index 84ea9c50c076f0..92e0ab252d6298 100644
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -67,7 +67,7 @@ int memcmp_pages(struct page *page1, struct page *page2)
/*
* If the page content is identical but at least one of the pages is
* tagged, return non-zero to avoid KSM merging. If only one of the
- * pages is tagged, set_pte_at() may zero or change the tags of the
+ * pages is tagged, set_ptes() may zero or change the tags of the
* other page via mte_sync_tags().
*/
if (page_mte_tagged(page1) || page_mte_tagged(page2))
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index efe82cc86bd1f3..ce238ef9e11335 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -1073,7 +1073,7 @@ int kvm_vm_ioctl_mte_copy_tags(struct kvm *kvm,
} else {
/*
* Only locking to serialise with a concurrent
- * set_pte_at() in the VMM but still overriding the
+ * set_ptes() in the VMM but still overriding the
* tags, hence ignoring the return value.
*/
try_page_mte_tagging(page);
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 7bcdc99ed57148..586bcf2a3db1b7 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -205,7 +205,7 @@ static void show_pte(unsigned long addr)
*
* It needs to cope with hardware update of the accessed/dirty state by other
* agents in the system and can safely skip the __sync_icache_dcache() call as,
- * like set_pte_at(), the PTE is never changed from no-exec to exec here.
+ * like set_ptes(), the PTE is never changed from no-exec to exec here.
*
* Returns whether or not the PTE actually changed.
*/
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index a5a56e30c254b0..398310ce919614 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -246,12 +246,12 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
if (!pte_present(pte)) {
for (i = 0; i < ncontig; i++, ptep++, addr += pgsize)
- set_pte_at(mm, addr, ptep, pte);
+ set_ptes(mm, addr, ptep, pte, 1);
return;
}
if (!pte_cont(pte)) {
- set_pte_at(mm, addr, ptep, pte);
+ set_ptes(mm, addr, ptep, pte, 1);
return;
}
@@ -262,7 +262,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
clear_flush(mm, addr, ptep, pgsize, ncontig);
for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
- set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
+ set_ptes(mm, addr, ptep, pfn_pte(pfn, hugeprot), 1);
}
pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
@@ -465,7 +465,7 @@ int huge_ptep_set_access_flags(struct vm_area_struct *vma,
hugeprot = pte_pgprot(pte);
for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
- set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
+ set_ptes(mm, addr, ptep, pfn_pte(pfn, hugeprot), 1);
return 1;
}
@@ -494,7 +494,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
pfn = pte_pfn(pte);
for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
- set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
+ set_ptes(mm, addr, ptep, pfn_pte(pfn, hugeprot), 1);
}
pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0841/1266] arm64/mm: convert ptep_clear() to ptep_get_and_clear()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (839 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0840/1266] arm64/mm: convert set_pte_at() to set_ptes(..., 1) Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0842/1266] arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() Greg Kroah-Hartman
` (157 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryan Roberts, John Hubbard,
Mark Rutland, Catalin Marinas, Alistair Popple, Andrey Ryabinin,
Ard Biesheuvel, Barry Song, Borislav Petkov (AMD), Dave Hansen,
David Hildenbrand, H. Peter Anvin, Ingo Molnar, James Morse,
Kefeng Wang, Marc Zyngier, Matthew Wilcox (Oracle),
Thomas Gleixner, Will Deacon, Yang Shi, Zi Yan, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <ryan.roberts@arm.com>
[ Upstream commit cbb0294fdd72a5f63ec59fad5c0a98d63bd572fc ]
ptep_clear() is a generic wrapper around the arch-implemented
ptep_get_and_clear(). We are about to convert ptep_get_and_clear() into a
public version and private version (__ptep_get_and_clear()) to support the
transparent contpte work. We won't have a private version of ptep_clear()
so let's convert it to directly call ptep_get_and_clear().
Link: https://lkml.kernel.org/r/20240215103205.2607016-10-ryan.roberts@arm.com
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Tested-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Barry Song <21cnbao@gmail.com>
Cc: Borislav Petkov (AMD) <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morse <james.morse@arm.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <shy828301@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: ff4c5a0de1f2 ("arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/hugetlbpage.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 398310ce919614..688d11b1cabdb4 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -228,7 +228,7 @@ static void clear_flush(struct mm_struct *mm,
unsigned long i, saddr = addr;
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
- ptep_clear(mm, addr, ptep);
+ ptep_get_and_clear(mm, addr, ptep);
flush_tlb_range(&vma, saddr, addr);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0842/1266] arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (840 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0841/1266] arm64/mm: convert ptep_clear() to ptep_get_and_clear() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0843/1266] selftests/hid: ensure we can compile the tests on kernels pre-6.3 Greg Kroah-Hartman
` (156 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Catalin Marinas, Will Deacon,
Ryan Roberts, David Hildenbrand, linux-arm-kernel, linux-kernel,
Ben Hutchings, Anshuman Khandual, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit ff4c5a0de1f2ef7737a8688a86e19301e567020d ]
Commit 48478b9f7913 ("arm64/mm: Enable batched TLB flush in
unmap_hotplug_range") inadvertently introduced redundant TLB
invalidation when clearing a block entry, resulting in unnecessary
broadcast invalidation on CPUs without support for range-based
invalidation.
Re-introduce the old behaviour, along with some expanded comments to
help people working in this area next time around.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Closes: https://lore.kernel.org/all/b0d5836032ce3135bfc473f6bff791306d086925.camel@decadent.org.uk/
Fixes: 48478b9f7913 ("arm64/mm: Enable batched TLB flush in unmap_hotplug_range()")
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
[will: Reword comments and commit message]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/mmu.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index fcc9b965aa7e68..e075792d722575 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -901,7 +901,13 @@ static void unmap_hotplug_pmd_range(pud_t *pudp, unsigned long addr,
if (free_mapped) {
/* CONT blocks are not supported in the vmemmap */
WARN_ON(pmd_cont(pmd));
- flush_tlb_kernel_range(addr, addr + PMD_SIZE);
+ /*
+ * Invalidating a block entry requires just
+ * a single overlapping TLB invalidation,
+ * so limit the range of the flush to a single
+ * page.
+ */
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
}
@@ -931,7 +937,8 @@ static void unmap_hotplug_pud_range(p4d_t *p4dp, unsigned long addr,
if (pud_sect(pud)) {
pud_clear(pudp);
if (free_mapped) {
- flush_tlb_kernel_range(addr, addr + PUD_SIZE);
+ /* See comment in unmap_hotplug_pmd_range(). */
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0843/1266] selftests/hid: ensure we can compile the tests on kernels pre-6.3
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (841 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0842/1266] arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0844/1266] selftests/hid: do not manually call headers_install Greg Kroah-Hartman
` (155 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Stitt, Benjamin Tissoires,
Sasha Levin, Nick Desaulniers
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
[ Upstream commit ae7487d112cf9f310d32f27d5956f53d9f143fea ]
For the hid-bpf tests to compile, we need to have the definition of
struct hid_bpf_ctx. This definition is an internal one from the kernel
and it is supposed to be defined in the generated vmlinux.h.
This vmlinux.h header is generated based on the currently running kernel
or if the kernel was already compiled in the tree. If you just compile
the selftests without compiling the kernel beforehand and you are running
on a 6.2 kernel, you'll end up with a vmlinux.h without the hid_bpf_ctx
definition.
Use the clever trick from tools/testing/selftests/bpf/progs/bpf_iter.h
to force the definition of that symbol in case we don't find it in the
BTF and also add __attribute__((preserve_access_index)) to further
support CO-RE functionality for these tests.
Signed-off-by: Justin Stitt <justinstitt@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com> # Build
Tested-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20230825-wip-selftests-v3-1-639963c54109@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Stable-dep-of: eebbef7c468a ("selftests/hid: Cover hid_bpf_get_data() size overflow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/hid/progs/hid.c | 3 -
.../selftests/hid/progs/hid_bpf_helpers.h | 77 +++++++++++++++++++
2 files changed, 77 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/hid/progs/hid.c b/tools/testing/selftests/hid/progs/hid.c
index 88c593f753b529..1e558826b809e1 100644
--- a/tools/testing/selftests/hid/progs/hid.c
+++ b/tools/testing/selftests/hid/progs/hid.c
@@ -1,8 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2022 Red hat */
-#include "vmlinux.h"
-#include <bpf/bpf_helpers.h>
-#include <bpf/bpf_tracing.h>
#include "hid_bpf_helpers.h"
char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
index 4fff31dbe0e74b..65e657ac11985d 100644
--- a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
+++ b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
@@ -5,6 +5,83 @@
#ifndef __HID_BPF_HELPERS_H
#define __HID_BPF_HELPERS_H
+/* "undefine" structs and enums in vmlinux.h, because we "override" them below */
+#define hid_bpf_ctx hid_bpf_ctx___not_used
+#define hid_report_type hid_report_type___not_used
+#define hid_class_request hid_class_request___not_used
+#define hid_bpf_attach_flags hid_bpf_attach_flags___not_used
+#define HID_INPUT_REPORT HID_INPUT_REPORT___not_used
+#define HID_OUTPUT_REPORT HID_OUTPUT_REPORT___not_used
+#define HID_FEATURE_REPORT HID_FEATURE_REPORT___not_used
+#define HID_REPORT_TYPES HID_REPORT_TYPES___not_used
+#define HID_REQ_GET_REPORT HID_REQ_GET_REPORT___not_used
+#define HID_REQ_GET_IDLE HID_REQ_GET_IDLE___not_used
+#define HID_REQ_GET_PROTOCOL HID_REQ_GET_PROTOCOL___not_used
+#define HID_REQ_SET_REPORT HID_REQ_SET_REPORT___not_used
+#define HID_REQ_SET_IDLE HID_REQ_SET_IDLE___not_used
+#define HID_REQ_SET_PROTOCOL HID_REQ_SET_PROTOCOL___not_used
+#define HID_BPF_FLAG_NONE HID_BPF_FLAG_NONE___not_used
+#define HID_BPF_FLAG_INSERT_HEAD HID_BPF_FLAG_INSERT_HEAD___not_used
+#define HID_BPF_FLAG_MAX HID_BPF_FLAG_MAX___not_used
+
+#include "vmlinux.h"
+
+#undef hid_bpf_ctx
+#undef hid_report_type
+#undef hid_class_request
+#undef hid_bpf_attach_flags
+#undef HID_INPUT_REPORT
+#undef HID_OUTPUT_REPORT
+#undef HID_FEATURE_REPORT
+#undef HID_REPORT_TYPES
+#undef HID_REQ_GET_REPORT
+#undef HID_REQ_GET_IDLE
+#undef HID_REQ_GET_PROTOCOL
+#undef HID_REQ_SET_REPORT
+#undef HID_REQ_SET_IDLE
+#undef HID_REQ_SET_PROTOCOL
+#undef HID_BPF_FLAG_NONE
+#undef HID_BPF_FLAG_INSERT_HEAD
+#undef HID_BPF_FLAG_MAX
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <linux/const.h>
+
+enum hid_report_type {
+ HID_INPUT_REPORT = 0,
+ HID_OUTPUT_REPORT = 1,
+ HID_FEATURE_REPORT = 2,
+
+ HID_REPORT_TYPES,
+};
+
+struct hid_bpf_ctx {
+ __u32 index;
+ const struct hid_device *hid;
+ __u32 allocated_size;
+ enum hid_report_type report_type;
+ union {
+ __s32 retval;
+ __s32 size;
+ };
+} __attribute__((preserve_access_index));
+
+enum hid_class_request {
+ HID_REQ_GET_REPORT = 0x01,
+ HID_REQ_GET_IDLE = 0x02,
+ HID_REQ_GET_PROTOCOL = 0x03,
+ HID_REQ_SET_REPORT = 0x09,
+ HID_REQ_SET_IDLE = 0x0A,
+ HID_REQ_SET_PROTOCOL = 0x0B,
+};
+
+enum hid_bpf_attach_flags {
+ HID_BPF_FLAG_NONE = 0,
+ HID_BPF_FLAG_INSERT_HEAD = _BITUL(0),
+ HID_BPF_FLAG_MAX,
+};
+
/* following are kfuncs exported by HID for HID-BPF */
extern __u8 *hid_bpf_get_data(struct hid_bpf_ctx *ctx,
unsigned int offset,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0844/1266] selftests/hid: do not manually call headers_install
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (842 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0843/1266] selftests/hid: ensure we can compile the tests on kernels pre-6.3 Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0845/1266] selftests/hid: force using our compiled libbpf headers Greg Kroah-Hartman
` (154 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuah Khan, Justin Stitt,
Benjamin Tissoires, Sasha Levin, Nick Desaulniers
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
[ Upstream commit 89d024a7ba02b6b969f89ac057442b5d3bcb4272 ]
"make headers" is a requirement before calling make on the selftests
dir, so we should not have to manually install those headers
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com> # Build
Tested-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20230825-wip-selftests-v3-2-639963c54109@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Stable-dep-of: eebbef7c468a ("selftests/hid: Cover hid_bpf_get_data() size overflow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/hid/Makefile | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/hid/Makefile b/tools/testing/selftests/hid/Makefile
index 2e75fb30f3a5e0..dc4f4cc35e5ad5 100644
--- a/tools/testing/selftests/hid/Makefile
+++ b/tools/testing/selftests/hid/Makefile
@@ -24,7 +24,7 @@ CXX ?= $(CROSS_COMPILE)g++
HOSTPKG_CONFIG := pkg-config
-CFLAGS += -g -O0 -rdynamic -Wall -Werror -I$(KHDR_INCLUDES) -I$(OUTPUT)
+CFLAGS += -g -O0 -rdynamic -Wall -Werror -I$(OUTPUT)
LDLIBS += -lelf -lz -lrt -lpthread
# Silence some warnings when compiled with clang
@@ -68,7 +68,6 @@ BPFTOOLDIR := $(TOOLSDIR)/bpf/bpftool
SCRATCH_DIR := $(OUTPUT)/tools
BUILD_DIR := $(SCRATCH_DIR)/build
INCLUDE_DIR := $(SCRATCH_DIR)/include
-KHDR_INCLUDES := $(SCRATCH_DIR)/uapi/include
BPFOBJ := $(BUILD_DIR)/libbpf/libbpf.a
ifneq ($(CROSS_COMPILE),)
HOST_BUILD_DIR := $(BUILD_DIR)/host
@@ -154,9 +153,6 @@ else
$(Q)cp "$(VMLINUX_H)" $@
endif
-$(KHDR_INCLUDES)/linux/hid.h: $(top_srcdir)/include/uapi/linux/hid.h
- $(MAKE) -C $(top_srcdir) INSTALL_HDR_PATH=$(SCRATCH_DIR)/uapi headers_install
-
$(RESOLVE_BTFIDS): $(HOST_BPFOBJ) | $(HOST_BUILD_DIR)/resolve_btfids \
$(TOOLSDIR)/bpf/resolve_btfids/main.c \
$(TOOLSDIR)/lib/rbtree.c \
@@ -234,7 +230,7 @@ $(BPF_SKELS): %.skel.h: %.bpf.o $(BPFTOOL) | $(OUTPUT)
$(Q)$(BPFTOOL) gen object $(<:.o=.linked1.o) $<
$(Q)$(BPFTOOL) gen skeleton $(<:.o=.linked1.o) name $(notdir $(<:.bpf.o=)) > $@
-$(OUTPUT)/%.o: %.c $(BPF_SKELS) $(KHDR_INCLUDES)/linux/hid.h
+$(OUTPUT)/%.o: %.c $(BPF_SKELS)
$(call msg,CC,,$@)
$(Q)$(CC) $(CFLAGS) -c $(filter %.c,$^) $(LDLIBS) -o $@
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0845/1266] selftests/hid: force using our compiled libbpf headers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (843 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0844/1266] selftests/hid: do not manually call headers_install Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0846/1266] selftests/hid: convert the hid_bpf selftests with struct_ops Greg Kroah-Hartman
` (153 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Stitt, Benjamin Tissoires,
Sasha Levin, Nick Desaulniers
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
[ Upstream commit 91939636cac4585e5c99a15c8b9023e0dcabb4e5 ]
Turns out that we were relying on the globally installed headers, not
the ones we freshly compiled.
Add a manual include in CFLAGS to sort this out.
Tested-by: Nick Desaulniers <ndesaulniers@google.com> # Build
Tested-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20230825-wip-selftests-v3-3-639963c54109@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Stable-dep-of: eebbef7c468a ("selftests/hid: Cover hid_bpf_get_data() size overflow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/hid/Makefile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/hid/Makefile b/tools/testing/selftests/hid/Makefile
index dc4f4cc35e5ad5..748e0c79a27dad 100644
--- a/tools/testing/selftests/hid/Makefile
+++ b/tools/testing/selftests/hid/Makefile
@@ -25,6 +25,8 @@ CXX ?= $(CROSS_COMPILE)g++
HOSTPKG_CONFIG := pkg-config
CFLAGS += -g -O0 -rdynamic -Wall -Werror -I$(OUTPUT)
+CFLAGS += -I$(OUTPUT)/tools/include
+
LDLIBS += -lelf -lz -lrt -lpthread
# Silence some warnings when compiled with clang
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0846/1266] selftests/hid: convert the hid_bpf selftests with struct_ops
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (844 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0845/1266] selftests/hid: force using our compiled libbpf headers Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0847/1266] selftests/hid: Cover hid_bpf_get_data() size overflow Greg Kroah-Hartman
` (152 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
[ Upstream commit d7696738d66b4f1379fe77eef61cd1047d7f0773 ]
We drop the need for the attach() bpf syscall, but we need to set up
the hid_id field before calling __load().
The .bpf.c part is mechanical: we create one struct_ops per HID-BPF
program, as all the tests are for one program at a time.
Link: https://lore.kernel.org/r/20240608-hid_bpf_struct_ops-v3-4-6ac6ade58329@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Stable-dep-of: eebbef7c468a ("selftests/hid: Cover hid_bpf_get_data() size overflow")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/hid/hid_bpf.c | 59 +++++++-------
tools/testing/selftests/hid/progs/hid.c | 76 +++++++++++++------
.../selftests/hid/progs/hid_bpf_helpers.h | 19 +----
3 files changed, 89 insertions(+), 65 deletions(-)
diff --git a/tools/testing/selftests/hid/hid_bpf.c b/tools/testing/selftests/hid/hid_bpf.c
index 2cf96f818f2578..06591bbda0d87b 100644
--- a/tools/testing/selftests/hid/hid_bpf.c
+++ b/tools/testing/selftests/hid/hid_bpf.c
@@ -444,7 +444,7 @@ FIXTURE(hid_bpf) {
int hid_id;
pthread_t tid;
struct hid *skel;
- int hid_links[3]; /* max number of programs loaded in a single test */
+ struct bpf_link *hid_links[3]; /* max number of programs loaded in a single test */
};
static void detach_bpf(FIXTURE_DATA(hid_bpf) * self)
{
@@ -456,7 +456,7 @@ static void detach_bpf(FIXTURE_DATA(hid_bpf) * self)
for (i = 0; i < ARRAY_SIZE(self->hid_links); i++) {
if (self->hid_links[i])
- close(self->hid_links[i]);
+ bpf_link__destroy(self->hid_links[i]);
}
hid__destroy(self->skel);
@@ -511,14 +511,7 @@ static void load_programs(const struct test_program programs[],
FIXTURE_DATA(hid_bpf) * self,
const FIXTURE_VARIANT(hid_bpf) * variant)
{
- int attach_fd, err = -EINVAL;
- struct attach_prog_args args = {
- .retval = -1,
- };
- DECLARE_LIBBPF_OPTS(bpf_test_run_opts, tattr,
- .ctx_in = &args,
- .ctx_size_in = sizeof(args),
- );
+ int err = -EINVAL;
ASSERT_LE(progs_count, ARRAY_SIZE(self->hid_links))
TH_LOG("too many programs are to be loaded");
@@ -529,35 +522,41 @@ static void load_programs(const struct test_program programs[],
for (int i = 0; i < progs_count; i++) {
struct bpf_program *prog;
+ struct bpf_map *map;
+ int *ops_hid_id;
prog = bpf_object__find_program_by_name(*self->skel->skeleton->obj,
programs[i].name);
ASSERT_OK_PTR(prog) TH_LOG("can not find program by name '%s'", programs[i].name);
bpf_program__set_autoload(prog, true);
+
+ map = bpf_object__find_map_by_name(*self->skel->skeleton->obj,
+ programs[i].name + 4);
+ ASSERT_OK_PTR(map) TH_LOG("can not find struct_ops by name '%s'",
+ programs[i].name + 4);
+
+ /* hid_id is the first field of struct hid_bpf_ops */
+ ops_hid_id = bpf_map__initial_value(map, NULL);
+ ASSERT_OK_PTR(ops_hid_id) TH_LOG("unable to retrieve struct_ops data");
+
+ *ops_hid_id = self->hid_id;
}
err = hid__load(self->skel);
ASSERT_OK(err) TH_LOG("hid_skel_load failed: %d", err);
- attach_fd = bpf_program__fd(self->skel->progs.attach_prog);
- ASSERT_GE(attach_fd, 0) TH_LOG("locate attach_prog: %d", attach_fd);
-
for (int i = 0; i < progs_count; i++) {
- struct bpf_program *prog;
+ struct bpf_map *map;
- prog = bpf_object__find_program_by_name(*self->skel->skeleton->obj,
- programs[i].name);
- ASSERT_OK_PTR(prog) TH_LOG("can not find program by name '%s'", programs[i].name);
-
- args.prog_fd = bpf_program__fd(prog);
- args.hid = self->hid_id;
- args.insert_head = programs[i].insert_head;
- err = bpf_prog_test_run_opts(attach_fd, &tattr);
- ASSERT_GE(args.retval, 0)
- TH_LOG("attach_hid(%s): %d", programs[i].name, args.retval);
+ map = bpf_object__find_map_by_name(*self->skel->skeleton->obj,
+ programs[i].name + 4);
+ ASSERT_OK_PTR(map) TH_LOG("can not find struct_ops by name '%s'",
+ programs[i].name + 4);
- self->hid_links[i] = args.retval;
+ self->hid_links[i] = bpf_map__attach_struct_ops(map);
+ ASSERT_OK_PTR(self->hid_links[i]) TH_LOG("failed to attach struct ops '%s'",
+ programs[i].name + 4);
}
self->hidraw_fd = open_hidraw(self->dev_id);
@@ -632,13 +631,17 @@ TEST_F(hid_bpf, test_attach_detach)
{ .name = "hid_first_event" },
{ .name = "hid_second_event" },
};
+ struct bpf_link *link;
__u8 buf[10] = {0};
- int err, link;
+ int err, link_fd;
LOAD_PROGRAMS(progs);
link = self->hid_links[0];
- ASSERT_GT(link, 0) TH_LOG("HID-BPF link not created");
+ ASSERT_OK_PTR(link) TH_LOG("HID-BPF link not created");
+
+ link_fd = bpf_link__fd(link);
+ ASSERT_GE(link_fd, 0) TH_LOG("HID-BPF link FD not valid");
/* inject one event */
buf[0] = 1;
@@ -657,7 +660,7 @@ TEST_F(hid_bpf, test_attach_detach)
/* pin the first program and immediately unpin it */
#define PIN_PATH "/sys/fs/bpf/hid_first_event"
- err = bpf_obj_pin(link, PIN_PATH);
+ err = bpf_obj_pin(link_fd, PIN_PATH);
ASSERT_OK(err) TH_LOG("error while calling bpf_obj_pin");
remove(PIN_PATH);
#undef PIN_PATH
diff --git a/tools/testing/selftests/hid/progs/hid.c b/tools/testing/selftests/hid/progs/hid.c
index 1e558826b809e1..fb3d506f92c9ff 100644
--- a/tools/testing/selftests/hid/progs/hid.c
+++ b/tools/testing/selftests/hid/progs/hid.c
@@ -14,8 +14,8 @@ struct attach_prog_args {
__u64 callback_check = 52;
__u64 callback2_check = 52;
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_first_event, struct hid_bpf_ctx *hid_ctx)
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_first_event, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *rw_data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 3 /* size */);
@@ -29,8 +29,14 @@ int BPF_PROG(hid_first_event, struct hid_bpf_ctx *hid_ctx)
return hid_ctx->size;
}
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_second_event, struct hid_bpf_ctx *hid_ctx)
+SEC(".struct_ops.link")
+struct hid_bpf_ops first_event = {
+ .hid_device_event = (void *)hid_first_event,
+ .hid_id = 2,
+};
+
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_second_event, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *rw_data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 4 /* size */);
@@ -42,8 +48,13 @@ int BPF_PROG(hid_second_event, struct hid_bpf_ctx *hid_ctx)
return hid_ctx->size;
}
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_change_report_id, struct hid_bpf_ctx *hid_ctx)
+SEC(".struct_ops.link")
+struct hid_bpf_ops second_event = {
+ .hid_device_event = (void *)hid_second_event,
+};
+
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_change_report_id, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *rw_data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 3 /* size */);
@@ -55,15 +66,10 @@ int BPF_PROG(hid_change_report_id, struct hid_bpf_ctx *hid_ctx)
return 9;
}
-SEC("syscall")
-int attach_prog(struct attach_prog_args *ctx)
-{
- ctx->retval = hid_bpf_attach_prog(ctx->hid,
- ctx->prog_fd,
- ctx->insert_head ? HID_BPF_FLAG_INSERT_HEAD :
- HID_BPF_FLAG_NONE);
- return 0;
-}
+SEC(".struct_ops.link")
+struct hid_bpf_ops change_report_id = {
+ .hid_device_event = (void *)hid_change_report_id,
+};
struct hid_hw_request_syscall_args {
/* data needs to come at offset 0 so we can use it in calls */
@@ -135,7 +141,12 @@ static const __u8 rdesc[] = {
0xc0, /* END_COLLECTION */
};
-SEC("?fmod_ret/hid_bpf_rdesc_fixup")
+/*
+ * the following program is marked as sleepable (struct_ops.s).
+ * This is not strictly mandatory but is a nice test for
+ * sleepable struct_ops
+ */
+SEC("?struct_ops.s/hid_rdesc_fixup")
int BPF_PROG(hid_rdesc_fixup, struct hid_bpf_ctx *hid_ctx)
{
__u8 *data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 4096 /* size */);
@@ -154,8 +165,13 @@ int BPF_PROG(hid_rdesc_fixup, struct hid_bpf_ctx *hid_ctx)
return sizeof(rdesc) + 73;
}
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_test_insert1, struct hid_bpf_ctx *hid_ctx)
+SEC(".struct_ops.link")
+struct hid_bpf_ops rdesc_fixup = {
+ .hid_rdesc_fixup = (void *)hid_rdesc_fixup,
+};
+
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_test_insert1, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 4 /* size */);
@@ -171,8 +187,14 @@ int BPF_PROG(hid_test_insert1, struct hid_bpf_ctx *hid_ctx)
return 0;
}
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_test_insert2, struct hid_bpf_ctx *hid_ctx)
+SEC(".struct_ops.link")
+struct hid_bpf_ops test_insert1 = {
+ .hid_device_event = (void *)hid_test_insert1,
+ .flags = BPF_F_BEFORE,
+};
+
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_test_insert2, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 4 /* size */);
@@ -188,8 +210,13 @@ int BPF_PROG(hid_test_insert2, struct hid_bpf_ctx *hid_ctx)
return 0;
}
-SEC("?fmod_ret/hid_bpf_device_event")
-int BPF_PROG(hid_test_insert3, struct hid_bpf_ctx *hid_ctx)
+SEC(".struct_ops.link")
+struct hid_bpf_ops test_insert2 = {
+ .hid_device_event = (void *)hid_test_insert2,
+};
+
+SEC("?struct_ops/hid_device_event")
+int BPF_PROG(hid_test_insert3, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
__u8 *data = hid_bpf_get_data(hid_ctx, 0 /* offset */, 4 /* size */);
@@ -204,3 +231,8 @@ int BPF_PROG(hid_test_insert3, struct hid_bpf_ctx *hid_ctx)
return 0;
}
+
+SEC(".struct_ops.link")
+struct hid_bpf_ops test_insert3 = {
+ .hid_device_event = (void *)hid_test_insert3,
+};
diff --git a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
index 65e657ac11985d..fe57613c50f879 100644
--- a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
+++ b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h
@@ -20,9 +20,6 @@
#define HID_REQ_SET_REPORT HID_REQ_SET_REPORT___not_used
#define HID_REQ_SET_IDLE HID_REQ_SET_IDLE___not_used
#define HID_REQ_SET_PROTOCOL HID_REQ_SET_PROTOCOL___not_used
-#define HID_BPF_FLAG_NONE HID_BPF_FLAG_NONE___not_used
-#define HID_BPF_FLAG_INSERT_HEAD HID_BPF_FLAG_INSERT_HEAD___not_used
-#define HID_BPF_FLAG_MAX HID_BPF_FLAG_MAX___not_used
#include "vmlinux.h"
@@ -40,9 +37,6 @@
#undef HID_REQ_SET_REPORT
#undef HID_REQ_SET_IDLE
#undef HID_REQ_SET_PROTOCOL
-#undef HID_BPF_FLAG_NONE
-#undef HID_BPF_FLAG_INSERT_HEAD
-#undef HID_BPF_FLAG_MAX
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
@@ -57,10 +51,8 @@ enum hid_report_type {
};
struct hid_bpf_ctx {
- __u32 index;
- const struct hid_device *hid;
+ struct hid_device *hid;
__u32 allocated_size;
- enum hid_report_type report_type;
union {
__s32 retval;
__s32 size;
@@ -76,17 +68,14 @@ enum hid_class_request {
HID_REQ_SET_PROTOCOL = 0x0B,
};
-enum hid_bpf_attach_flags {
- HID_BPF_FLAG_NONE = 0,
- HID_BPF_FLAG_INSERT_HEAD = _BITUL(0),
- HID_BPF_FLAG_MAX,
-};
+#ifndef BPF_F_BEFORE
+#define BPF_F_BEFORE (1U << 3)
+#endif
/* following are kfuncs exported by HID for HID-BPF */
extern __u8 *hid_bpf_get_data(struct hid_bpf_ctx *ctx,
unsigned int offset,
const size_t __sz) __ksym;
-extern int hid_bpf_attach_prog(unsigned int hid_id, int prog_fd, u32 flags) __ksym;
extern struct hid_bpf_ctx *hid_bpf_allocate_context(unsigned int hid_id) __ksym;
extern void hid_bpf_release_context(struct hid_bpf_ctx *ctx) __ksym;
extern int hid_bpf_hw_request(struct hid_bpf_ctx *ctx,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0847/1266] selftests/hid: Cover hid_bpf_get_data() size overflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (845 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0846/1266] selftests/hid: convert the hid_bpf selftests with struct_ops Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0848/1266] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
` (151 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiyang Chen, Benjamin Tissoires,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
[ Upstream commit eebbef7c468a5cb58c4772849ee5066441166cf0 ]
Add a HID-BPF regression check for hid_bpf_get_data() requests whose
size would overflow when added to the offset.
The new rdesc fixup callback asks for offset 2 and size ~0ULL, then
records whether the helper returns NULL. A vulnerable kernel returns a
non-NULL pointer because the runtime check wraps the addition. A fixed
kernel rejects the request. The callback records the helper result
without dereferencing any returned pointer.
The callback reports the helper result through BSS and returns 0
intentionally. hid_rdesc_fixup return values are consumed as report
descriptor fixup results, so a positive test-result value would be
interpreted as a replacement report descriptor size.
Also add KHDR_INCLUDES to the HID selftest build so hid_bpf.c sees the
current kernel UAPI HID definitions on systems whose installed headers do
not provide enum hid_report_type.
Fixes: 658ee5a64fcf ("HID: bpf: allocate data memory for device_event BPF programs")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/hid/Makefile | 2 +-
tools/testing/selftests/hid/hid_bpf.c | 11 +++++++++++
tools/testing/selftests/hid/progs/hid.c | 15 +++++++++++++++
3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/hid/Makefile b/tools/testing/selftests/hid/Makefile
index 748e0c79a27dad..a96489f398ea61 100644
--- a/tools/testing/selftests/hid/Makefile
+++ b/tools/testing/selftests/hid/Makefile
@@ -24,7 +24,7 @@ CXX ?= $(CROSS_COMPILE)g++
HOSTPKG_CONFIG := pkg-config
-CFLAGS += -g -O0 -rdynamic -Wall -Werror -I$(OUTPUT)
+CFLAGS += -g -O0 -rdynamic -Wall -Werror -I$(OUTPUT) $(KHDR_INCLUDES)
CFLAGS += -I$(OUTPUT)/tools/include
LDLIBS += -lelf -lz -lrt -lpthread
diff --git a/tools/testing/selftests/hid/hid_bpf.c b/tools/testing/selftests/hid/hid_bpf.c
index 06591bbda0d87b..17c37e91bf0908 100644
--- a/tools/testing/selftests/hid/hid_bpf.c
+++ b/tools/testing/selftests/hid/hid_bpf.c
@@ -842,6 +842,17 @@ TEST_F(hid_bpf, test_rdesc_fixup)
ASSERT_EQ(rpt_desc.value[4], 0x42);
}
+TEST_F(hid_bpf, test_rdesc_fixup_get_data_overflow)
+{
+ const struct test_program progs[] = {
+ { .name = "hid_rdesc_fixup_get_data_overflow" },
+ };
+
+ LOAD_PROGRAMS(progs);
+
+ ASSERT_EQ(self->skel->bss->get_data_overflow_check, 1);
+}
+
static int libbpf_print_fn(enum libbpf_print_level level,
const char *format, va_list args)
{
diff --git a/tools/testing/selftests/hid/progs/hid.c b/tools/testing/selftests/hid/progs/hid.c
index fb3d506f92c9ff..0fa675c8508a0f 100644
--- a/tools/testing/selftests/hid/progs/hid.c
+++ b/tools/testing/selftests/hid/progs/hid.c
@@ -13,6 +13,7 @@ struct attach_prog_args {
__u64 callback_check = 52;
__u64 callback2_check = 52;
+__u64 get_data_overflow_check;
SEC("?struct_ops/hid_device_event")
int BPF_PROG(hid_first_event, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
@@ -170,6 +171,20 @@ struct hid_bpf_ops rdesc_fixup = {
.hid_rdesc_fixup = (void *)hid_rdesc_fixup,
};
+SEC("?struct_ops.s/hid_rdesc_fixup")
+int BPF_PROG(hid_rdesc_fixup_get_data_overflow, struct hid_bpf_ctx *hid_ctx)
+{
+ if (!hid_bpf_get_data(hid_ctx, 2 /* offset */, ~0ULL /* size */))
+ get_data_overflow_check = 1;
+
+ return 0;
+}
+
+SEC(".struct_ops.link")
+struct hid_bpf_ops rdesc_fixup_get_data_overflow = {
+ .hid_rdesc_fixup = (void *)hid_rdesc_fixup_get_data_overflow,
+};
+
SEC("?struct_ops/hid_device_event")
int BPF_PROG(hid_test_insert1, struct hid_bpf_ctx *hid_ctx, enum hid_report_type type)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0848/1266] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (846 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0847/1266] selftests/hid: Cover hid_bpf_get_data() size overflow Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0849/1266] gue: validate REMCSUM private option length Greg Kroah-Hartman
` (150 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 03f384bc0cb8d4a1301d4f5b0baef2d980258383 ]
For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...
Reject the frame when packet_len >= skb->len before reading.
Fixes: 904813cd8a0b ("[PATCH] USB: usbnet (4/9) module for net1080 cables")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260630045121.1565324-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/net1080.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index b0c0c9dd6a028d..8a66549cefa7df 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -381,7 +381,7 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
skb_trim(skb, skb->len - sizeof *trailer);
if ((packet_len & 0x01) == 0) {
- if (skb->data [packet_len] != PAD_BYTE) {
+ if (packet_len >= skb->len || skb->data[packet_len] != PAD_BYTE) {
dev->net->stats.rx_frame_errors++;
netdev_dbg(dev->net, "bad pad\n");
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0849/1266] gue: validate REMCSUM private option length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (847 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0848/1266] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0850/1266] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
` (149 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qihang, Eric Dumazet,
David S. Miller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang <q.h.hack.winter@gmail.com>
[ Upstream commit d335dcc6f521571d57117b8deeebc940836e5450 ]
GUE private flags can indicate that remote checksum offload metadata is
present. The private flags field itself is accounted for by
guehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even
when GUE_PFLAG_REMCSUM is set.
This lets a packet with only the private flags field pass
validate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum()
read the missing REMCSUM start/offset fields from the following bytes.
Account for GUE_PLEN_REMCSUM when GUE_PFLAG_REMCSUM is present so that
malformed packets are rejected during option validation.
Fixes: c1aa8347e73e ("gue: Protocol constants for remote checksum offload")
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/gue.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/gue.h b/include/net/gue.h
index dfca298bec9ccd..caefd6da86939b 100644
--- a/include/net/gue.h
+++ b/include/net/gue.h
@@ -80,7 +80,7 @@ static inline size_t guehdr_flags_len(__be16 flags)
static inline size_t guehdr_priv_flags_len(__be32 flags)
{
- return 0;
+ return (flags & GUE_PFLAG_REMCSUM) ? GUE_PLEN_REMCSUM : 0;
}
/* Validate standard and private flags. Returns non-zero (meaning invalid)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0850/1266] netfilter: xt_u32: reject invalid shift counts
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (848 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0849/1266] gue: validate REMCSUM private option length Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0851/1266] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
` (148 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
[ Upstream commit 64cdf7d30ac18e43df6c48004435febb965809a8 ]
u32_match_it() executes rule-supplied shift operands on a 32-bit
value. A malformed u32 rule can provide a shift count of 32 or more,
triggering an undefined shift out-of-bounds during packet evaluation.
Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in
u32_mt_checkentry() and reject malformed rules before they reach the
packet path.
Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_u32.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 117d4615d6684c..ec1a21e3b6e2c3 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -100,7 +100,7 @@ static int u32_mt_checkentry(const struct xt_mtchk_param *par)
{
const struct xt_u32 *data = par->matchinfo;
const struct xt_u32_test *ct;
- unsigned int i;
+ unsigned int i, j;
if (data->ntests > ARRAY_SIZE(data->tests))
return -EINVAL;
@@ -111,6 +111,16 @@ static int u32_mt_checkentry(const struct xt_mtchk_param *par)
if (ct->nnums > ARRAY_SIZE(ct->location) ||
ct->nvalues > ARRAY_SIZE(ct->value))
return -EINVAL;
+
+ for (j = 1; j < ct->nnums; ++j) {
+ switch (ct->location[j].nextop) {
+ case XT_U32_LEFTSH:
+ case XT_U32_RIGHTSH:
+ if (ct->location[j].number >= 32)
+ return -EINVAL;
+ break;
+ }
+ }
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0851/1266] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (849 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0850/1266] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0852/1266] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
` (147 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Feng Wu, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Wu <wufengwufengwufeng@gmail.com>
[ Upstream commit 444853cd438201007da5359821adcc2995655ab1 ]
On links faster than ~34 Gbps, where byte rate may exceed 2^32-1
(~ 4.3 GBps), the comparison result becomes incorrect because the
truncated value no longer reflects the actual estimator rate.
Fix by changing the local variables to u64.
Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
Signed-off-by: Feng Wu <wufengwufengwufeng@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_rateest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index b1d736c15fcbe5..7c05b63425784e 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -16,7 +16,7 @@ xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_rateest_match_info *info = par->matchinfo;
struct gnet_stats_rate_est64 sample = {0};
- u_int32_t bps1, bps2, pps1, pps2;
+ u64 bps1, bps2, pps1, pps2;
bool ret = true;
gen_estimator_read(&info->est1->rate_est, &sample);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0852/1266] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (850 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0851/1266] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0853/1266] netfilter: xt_connmark: reject invalid shift parameters Greg Kroah-Hartman
` (146 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhixing Chen, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhixing Chen <running910@gmail.com>
[ Upstream commit 43ccc20b5a733226417832cf16ef45322e594990 ]
The ah, hbh and rt matches check that the fixed extension header is
present, then use the header length field to derive the advertised
extension header length for matching.
For the ah match, add the missing advertised-length check. For hbh
and rt, update the existing advertised-length checks. In all three
cases, set hotdrop to true before returning false when the advertised
extension header length exceeds the available skb data.
Returning false treats the packet as a rule mismatch. Set hotdrop to
true and drop malformed packets so they cannot bypass rules intended
to drop packets with these IPv6 extension headers.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhixing Chen <running910@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/netfilter/ip6t_ah.c | 5 +++++
net/ipv6/netfilter/ip6t_hbh.c | 1 +
net/ipv6/netfilter/ip6t_rt.c | 3 ++-
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 70da2f2ce064ca..1258783ed87629 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -56,6 +56,11 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
}
hdrlen = ipv6_authlen(ah);
+ if (skb->len - ptr < hdrlen) {
+ /* Packet smaller than its length field */
+ par->hotdrop = true;
+ return false;
+ }
pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
pr_debug("RES %04X ", ah->reserved);
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 450dd53846a2f7..6d1a5d2026a678 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -75,6 +75,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
hdrlen = ipv6_optlen(oh);
if (skb->len - ptr < hdrlen) {
/* Packet smaller than it's length field */
+ par->hotdrop = true;
return false;
}
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 5561bd9cea8185..278b52752f3645 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -56,7 +56,8 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
hdrlen = ipv6_optlen(rh);
if (skb->len - ptr < hdrlen) {
- /* Pcket smaller than its length field */
+ /* Packet smaller than its length field */
+ par->hotdrop = true;
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0853/1266] netfilter: xt_connmark: reject invalid shift parameters
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (851 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0852/1266] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0854/1266] net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation Greg Kroah-Hartman
` (145 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Zhengchuan Liang, Xin Liu,
Wyatt Feng, Ren Wei, Phil Sutter, Florian Westphal, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
[ Upstream commit 1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc ]
Revision 2 of the CONNMARK target accepts user-controlled shift
parameters and applies them to 32-bit mark values in
connmark_tg_shift().
A shift_bits value of 32 or more triggers an undefined-shift bug when
the rule is evaluated. Invalid shift_dir values are also accepted and
silently fall back to the left-shift path.
Reject invalid revision-2 shift parameters in connmark_tg_check() so
malformed rules fail at installation time, before they can reach the
packet path.
Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_connmark.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 4277084de2e70c..2cf27f7d59b95f 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -112,6 +112,16 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
return ret;
}
+static int connmark_tg_check_v2(const struct xt_tgchk_param *par)
+{
+ const struct xt_connmark_tginfo2 *info = par->targinfo;
+
+ if (info->shift_dir > D_SHIFT_RIGHT || info->shift_bits >= 32)
+ return -EINVAL;
+
+ return connmark_tg_check(par);
+}
+
static void connmark_tg_destroy(const struct xt_tgdtor_param *par)
{
nf_ct_netns_put(par->net, par->family);
@@ -162,7 +172,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
.name = "CONNMARK",
.revision = 2,
.family = NFPROTO_IPV4,
- .checkentry = connmark_tg_check,
+ .checkentry = connmark_tg_check_v2,
.target = connmark_tg_v2,
.targetsize = sizeof(struct xt_connmark_tginfo2),
.destroy = connmark_tg_destroy,
@@ -183,7 +193,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = {
.name = "CONNMARK",
.revision = 2,
.family = NFPROTO_IPV6,
- .checkentry = connmark_tg_check,
+ .checkentry = connmark_tg_check_v2,
.target = connmark_tg_v2,
.targetsize = sizeof(struct xt_connmark_tginfo2),
.destroy = connmark_tg_destroy,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0854/1266] net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (852 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0853/1266] netfilter: xt_connmark: reject invalid shift parameters Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0855/1266] net/mlx5e: Fix HV VHCA stats agent registration race Greg Kroah-Hartman
` (144 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Liu, Eran Ben Elisha,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Liu <feliu@nvidia.com>
[ Upstream commit 25f6b929c7e379cbea7cb8caa67b49b2d1efae17 ]
mlx5e_hv_vhca_stats_create() is called from mlx5e_nic_enable(),
before mlx5e_open(). At that point priv->stats_nch is still zero,
because it is only ever incremented in mlx5e_channel_stats_alloc(),
which is reached only from mlx5e_open_channel().
mlx5e_hv_vhca_stats_buf_size() therefore returns 0, and
kvzalloc(0, GFP_KERNEL) returns ZERO_SIZE_PTR ((void *)16) rather
than NULL. The "if (!buf)" guard does not catch this, and
mlx5e_hv_vhca_stats_create() completes "successfully" with
priv->stats_agent.buf set to ZERO_SIZE_PTR.
Once channels are opened (priv->stats_nch > 0) and the hypervisor
enables stats reporting, mlx5e_hv_vhca_stats_work() recomputes
buf_len using the new non-zero stats_nch and calls
memset(buf, 0, buf_len) on ZERO_SIZE_PTR, faulting at address 0x10.
Allocate the buffer based on priv->max_nch, which is set in
mlx5e_priv_init() and is the upper bound on stats_nch:
- Add a separate helper mlx5e_hv_vhca_stats_buf_max_size() that
returns sizeof(per_ring_stats) * max(max_nch, stats_nch), and
use it for the kvzalloc() in mlx5e_hv_vhca_stats_create().
- Keep mlx5e_hv_vhca_stats_buf_size() (which returns based on
stats_nch) for the worker's active payload size, so the wire
format (block->rings = stats_nch) and the amount of data filled
by mlx5e_hv_vhca_fill_stats() are unchanged.
The max(max_nch, stats_nch) guard handles the rare case where
mlx5e_attach_netdev() recomputes max_nch downward across a
detach/resume cycle while priv->stats_nch persists (mlx5e_detach_netdev
does not call mlx5e_priv_cleanup, so stats_nch is only reset when
the netdev is destroyed). Without the guard, the worker could compute
buf_len from stats_nch and overrun the smaller buffer allocated based
on the reduced max_nch.
Allocating a non-zero buffer also makes the kvzalloc() failure path in
mlx5e_hv_vhca_stats_create() reachable for the first time: it returns
early without (re)creating the agent. Clear
priv->stats_agent.{agent,buf} in mlx5e_hv_vhca_stats_destroy() after
freeing them, so that if a later create() bails out on this path, a
subsequent teardown does not double-free the stale agent/buffer left
from a previous enable/disable cycle.
This mirrors the existing mlx5e pattern of preallocating arrays of
size max_nch (e.g. priv->channel_stats) and lazily populating
entries up to stats_nch on demand.
Fixes: fa691d0c9c08 ("net/mlx5e: Allocate per-channel stats dynamically at first usage")
Signed-off-by: Feng Liu <feliu@nvidia.com>
Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260630115151.729219-2-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
index b4f3bd7d346e43..41a662d47be6f4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
@@ -54,6 +54,12 @@ static int mlx5e_hv_vhca_stats_buf_size(struct mlx5e_priv *priv)
priv->stats_nch);
}
+static int mlx5e_hv_vhca_stats_buf_max_size(struct mlx5e_priv *priv)
+{
+ return (sizeof(struct mlx5e_hv_vhca_per_ring_stats) *
+ max(priv->max_nch, priv->stats_nch));
+}
+
static void mlx5e_hv_vhca_stats_work(struct work_struct *work)
{
struct mlx5e_hv_vhca_stats_agent *sagent;
@@ -122,7 +128,7 @@ static void mlx5e_hv_vhca_stats_cleanup(struct mlx5_hv_vhca_agent *agent)
void mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv)
{
- int buf_len = mlx5e_hv_vhca_stats_buf_size(priv);
+ int buf_len = mlx5e_hv_vhca_stats_buf_max_size(priv);
struct mlx5_hv_vhca_agent *agent;
priv->stats_agent.buf = kvzalloc(buf_len, GFP_KERNEL);
@@ -155,5 +161,7 @@ void mlx5e_hv_vhca_stats_destroy(struct mlx5e_priv *priv)
return;
mlx5_hv_vhca_agent_destroy(priv->stats_agent.agent);
+ priv->stats_agent.agent = NULL;
kvfree(priv->stats_agent.buf);
+ priv->stats_agent.buf = NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0855/1266] net/mlx5e: Fix HV VHCA stats agent registration race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (853 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0854/1266] net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0856/1266] net: microchip: vcap: fix races on the shared Super VCAP block Greg Kroah-Hartman
` (143 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Liu, Eran Ben Elisha,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Liu <feliu@nvidia.com>
[ Upstream commit 89b25b5f46f488ea3b29b3444864c76944c9075b ]
mlx5e_hv_vhca_stats_create() registers the stats agent through
mlx5_hv_vhca_agent_create(). The helper publishes the agent in
hv_vhca->agents[type] under agents_lock and immediately schedules an
asynchronous control invalidation on the HV VHCA workqueue before
returning to mlx5e.
The asynchronous invalidation invokes the control agent's invalidate
callback, which reads the hypervisor control block and forwards the
command to mlx5e_hv_vhca_stats_control(). That callback may either:
- call cancel_delayed_work_sync(&priv->stats_agent.work), or
- call queue_delayed_work(priv->wq, &sagent->work, sagent->delay).
However, the delayed_work and priv->stats_agent.agent are only
initialized after mlx5_hv_vhca_agent_create() returns to mlx5e:
agent = mlx5_hv_vhca_agent_create(...); /* publish + invalidate */
...
priv->stats_agent.agent = agent; /* too late */
INIT_DELAYED_WORK(&priv->stats_agent.work, ...); /* too late */
If the asynchronous control path runs before the two assignments
above, it can:
- Operate on an uninitialized delayed_work whose timer.function is
NULL. queue_delayed_work() calls add_timer() unconditionally, so
when the timer expires the timer softirq invokes a NULL function
pointer.
- Re-initialize the timer later through INIT_DELAYED_WORK() while
the timer is already enqueued in the timer wheel, corrupting the
hlist (entry.pprev cleared while the previous bucket node still
points at this entry).
- When the worker eventually runs, mlx5e_hv_vhca_stats_work() reads
sagent->agent (NULL) and dereferences it inside
mlx5_hv_vhca_agent_write().
Fix this by:
- Initializing priv->stats_agent.work before invoking
mlx5_hv_vhca_agent_create(), so the work is always in a valid
state when the control callback observes it.
- Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter
to mlx5_hv_vhca_agent_create(). The helper writes the agent
pointer to *ctx_update before publishing into hv_vhca->agents[]
and triggering the agents_update flow, so any callback
subsequently invoked from that flow already sees a valid
priv->stats_agent.agent. This avoids having the control
callback participate in agent initialization.
While at it, access priv->stats_agent.agent with
READ_ONCE()/WRITE_ONCE() for the cross-CPU access with the worker, and
clear priv->stats_agent.buf on the agent_create() failure path.
Fixes: cef35af34d6d ("net/mlx5e: Add mlx5e HV VHCA stats agent")
Signed-off-by: Feng Liu <feliu@nvidia.com>
Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260630115151.729219-3-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/hv_vhca_stats.c | 21 +++++++++++--------
.../ethernet/mellanox/mlx5/core/lib/hv_vhca.c | 8 +++++--
.../ethernet/mellanox/mlx5/core/lib/hv_vhca.h | 6 ++++--
3 files changed, 22 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
index 41a662d47be6f4..1856d211339f2a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
@@ -73,7 +73,7 @@ static void mlx5e_hv_vhca_stats_work(struct work_struct *work)
sagent = container_of(dwork, struct mlx5e_hv_vhca_stats_agent, work);
priv = container_of(sagent, struct mlx5e_priv, stats_agent);
buf_len = mlx5e_hv_vhca_stats_buf_size(priv);
- agent = sagent->agent;
+ agent = READ_ONCE(sagent->agent);
buf = sagent->buf;
memset(buf, 0, buf_len);
@@ -135,11 +135,14 @@ void mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv)
if (!priv->stats_agent.buf)
return;
+ INIT_DELAYED_WORK(&priv->stats_agent.work, mlx5e_hv_vhca_stats_work);
+
agent = mlx5_hv_vhca_agent_create(priv->mdev->hv_vhca,
MLX5_HV_VHCA_AGENT_STATS,
mlx5e_hv_vhca_stats_control, NULL,
mlx5e_hv_vhca_stats_cleanup,
- priv);
+ priv,
+ &priv->stats_agent.agent);
if (IS_ERR_OR_NULL(agent)) {
if (IS_ERR(agent))
@@ -148,20 +151,20 @@ void mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv)
PTR_ERR(agent));
kvfree(priv->stats_agent.buf);
- return;
+ priv->stats_agent.buf = NULL;
}
-
- priv->stats_agent.agent = agent;
- INIT_DELAYED_WORK(&priv->stats_agent.work, mlx5e_hv_vhca_stats_work);
}
void mlx5e_hv_vhca_stats_destroy(struct mlx5e_priv *priv)
{
- if (IS_ERR_OR_NULL(priv->stats_agent.agent))
+ struct mlx5_hv_vhca_agent *agent;
+
+ agent = READ_ONCE(priv->stats_agent.agent);
+ if (IS_ERR_OR_NULL(agent))
return;
- mlx5_hv_vhca_agent_destroy(priv->stats_agent.agent);
- priv->stats_agent.agent = NULL;
+ mlx5_hv_vhca_agent_destroy(agent);
+ WRITE_ONCE(priv->stats_agent.agent, NULL);
kvfree(priv->stats_agent.buf);
priv->stats_agent.buf = NULL;
}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c
index 30564d9b00e9f7..779342ebc843e0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c
@@ -190,7 +190,7 @@ mlx5_hv_vhca_control_agent_create(struct mlx5_hv_vhca *hv_vhca)
return mlx5_hv_vhca_agent_create(hv_vhca, MLX5_HV_VHCA_AGENT_CONTROL,
NULL,
mlx5_hv_vhca_control_agent_invalidate,
- NULL, NULL);
+ NULL, NULL, NULL);
}
static void mlx5_hv_vhca_control_agent_destroy(struct mlx5_hv_vhca_agent *agent)
@@ -256,7 +256,8 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca,
void (*invalidate)(struct mlx5_hv_vhca_agent*,
u64 block_mask),
void (*cleaup)(struct mlx5_hv_vhca_agent *agent),
- void *priv)
+ void *priv,
+ struct mlx5_hv_vhca_agent **ctx_update)
{
struct mlx5_hv_vhca_agent *agent;
@@ -284,6 +285,9 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca,
agent->invalidate = invalidate;
agent->cleanup = cleaup;
+ if (ctx_update)
+ WRITE_ONCE(*ctx_update, agent);
+
mutex_lock(&hv_vhca->agents_lock);
hv_vhca->agents[type] = agent;
mutex_unlock(&hv_vhca->agents_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h
index f240ffe5116c5b..8b3974cf0ee49a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h
@@ -43,7 +43,8 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca,
void (*invalidate)(struct mlx5_hv_vhca_agent*,
u64 block_mask),
void (*cleanup)(struct mlx5_hv_vhca_agent *agent),
- void *context);
+ void *context,
+ struct mlx5_hv_vhca_agent **ctx_update);
void mlx5_hv_vhca_agent_destroy(struct mlx5_hv_vhca_agent *agent);
int mlx5_hv_vhca_agent_write(struct mlx5_hv_vhca_agent *agent,
@@ -84,7 +85,8 @@ mlx5_hv_vhca_agent_create(struct mlx5_hv_vhca *hv_vhca,
void (*invalidate)(struct mlx5_hv_vhca_agent*,
u64 block_mask),
void (*cleanup)(struct mlx5_hv_vhca_agent *agent),
- void *context)
+ void *context,
+ struct mlx5_hv_vhca_agent **ctx_update)
{
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0856/1266] net: microchip: vcap: fix races on the shared Super VCAP block
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (854 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0855/1266] net/mlx5e: Fix HV VHCA stats agent registration race Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0857/1266] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
` (142 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Emil Schulz Østergaard,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>
[ Upstream commit d7a8d500d7e42837bd8dce40cb52c97c6e8706a9 ]
The VCAP instances on a chip are not independent, yet they are locked
independently. On sparx5 and lan969x the IS0 and IS2 instances are
backed by the same Super VCAP hardware block and share its cache and
command registers: every access drives the shared VCAP_SUPER_CTRL
register and moves data through the shared cache registers.
Accessing one instance therefore races with accessing another. The
per-instance admin->lock cannot prevent this, as each instance takes a
different lock.
The locking issue is mostly disguised by the fact that the core usage of
the vcap api runs under rtnl. However, the full rule dump in debugfs
decodes rules straight from hardware (a READ command followed by a cache
read) and runs outside rtnl, so it races a concurrent tc-flower rule
write to another Super VCAP instance.
Besides corrupting the dump, the read repopulates the shared cache
between the writers cache fill and its write command, so the writer
commits the wrong data and corrupts the hardware entry.
Introduce vcap_lock() and vcap_unlock() helpers and route every rule
lock site in the VCAP API and its debugfs code through them. Replace the
per-instance admin->lock with a single mutex in struct vcap_control that
serializes access to all instances. The helpers reach it through a new
admin->vctrl back-pointer, and the clients initialise and destroy the
control lock instead of a per-instance one.
No path holds more than one instance lock, so collapsing them onto a
single mutex cannot self-deadlock.
Fixes: 71c9de995260 ("net: microchip: sparx5: Add VCAP locking to protect rules")
Signed-off-by: Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>
Link: https://patch.msgid.link/20260630-microchip_fix_vcap_locking-v1-1-f60a4596734d@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../microchip/lan966x/lan966x_vcap_impl.c | 5 +-
.../microchip/sparx5/sparx5_vcap_impl.c | 5 +-
.../net/ethernet/microchip/vcap/vcap_api.c | 72 +++++++++++--------
.../net/ethernet/microchip/vcap/vcap_api.h | 3 +-
.../microchip/vcap/vcap_api_debugfs.c | 8 +--
.../microchip/vcap/vcap_api_debugfs_kunit.c | 3 +-
.../ethernet/microchip/vcap/vcap_api_kunit.c | 3 +-
.../microchip/vcap/vcap_api_private.h | 3 +
8 files changed, 60 insertions(+), 42 deletions(-)
diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c b/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c
index c266f903ea8a6f..ea17afdf9a9a64 100644
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c
@@ -601,7 +601,6 @@ static void lan966x_vcap_admin_free(struct vcap_admin *admin)
kfree(admin->cache.keystream);
kfree(admin->cache.maskstream);
kfree(admin->cache.actionstream);
- mutex_destroy(&admin->lock);
kfree(admin);
}
@@ -615,7 +614,7 @@ lan966x_vcap_admin_alloc(struct lan966x *lan966x, struct vcap_control *ctrl,
if (!admin)
return ERR_PTR(-ENOMEM);
- mutex_init(&admin->lock);
+ admin->vctrl = ctrl;
INIT_LIST_HEAD(&admin->list);
INIT_LIST_HEAD(&admin->rules);
INIT_LIST_HEAD(&admin->enabled);
@@ -721,6 +720,7 @@ int lan966x_vcap_init(struct lan966x *lan966x)
ctrl->ops = &lan966x_vcap_ops;
INIT_LIST_HEAD(&ctrl->list);
+ mutex_init(&ctrl->lock);
for (int i = 0; i < ARRAY_SIZE(lan966x_vcap_inst_cfg); ++i) {
cfg = &lan966x_vcap_inst_cfg[i];
@@ -780,5 +780,6 @@ void lan966x_vcap_deinit(struct lan966x *lan966x)
lan966x_vcap_admin_free(admin);
}
+ mutex_destroy(&ctrl->lock);
kfree(ctrl);
}
diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_vcap_impl.c b/drivers/net/ethernet/microchip/sparx5/sparx5_vcap_impl.c
index 187efa1fc904f5..1403cb343f214f 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_vcap_impl.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_vcap_impl.c
@@ -1941,7 +1941,6 @@ static void sparx5_vcap_admin_free(struct vcap_admin *admin)
{
if (!admin)
return;
- mutex_destroy(&admin->lock);
kfree(admin->cache.keystream);
kfree(admin->cache.maskstream);
kfree(admin->cache.actionstream);
@@ -1961,7 +1960,7 @@ sparx5_vcap_admin_alloc(struct sparx5 *sparx5, struct vcap_control *ctrl,
INIT_LIST_HEAD(&admin->list);
INIT_LIST_HEAD(&admin->rules);
INIT_LIST_HEAD(&admin->enabled);
- mutex_init(&admin->lock);
+ admin->vctrl = ctrl;
admin->vtype = cfg->vtype;
admin->vinst = cfg->vinst;
admin->ingress = cfg->ingress;
@@ -2069,6 +2068,7 @@ int sparx5_vcap_init(struct sparx5 *sparx5)
ctrl->ops = &sparx5_vcap_ops;
INIT_LIST_HEAD(&ctrl->list);
+ mutex_init(&ctrl->lock);
for (idx = 0; idx < ARRAY_SIZE(sparx5_vcap_inst_cfg); ++idx) {
cfg = &sparx5_vcap_inst_cfg[idx];
admin = sparx5_vcap_admin_alloc(sparx5, ctrl, cfg);
@@ -2107,5 +2107,6 @@ void sparx5_vcap_destroy(struct sparx5 *sparx5)
list_del(&admin->list);
sparx5_vcap_admin_free(admin);
}
+ mutex_destroy(&ctrl->lock);
kfree(ctrl);
}
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api.c b/drivers/net/ethernet/microchip/vcap/vcap_api.c
index ef980e4e5bc2fa..07437c94d474f1 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api.c
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api.c
@@ -934,6 +934,16 @@ static bool vcap_rule_exists(struct vcap_control *vctrl, u32 id)
return false;
}
+void vcap_lock(struct vcap_admin *admin)
+{
+ mutex_lock(&admin->vctrl->lock);
+}
+
+void vcap_unlock(struct vcap_admin *admin)
+{
+ mutex_unlock(&admin->vctrl->lock);
+}
+
/* Find a rule with a provided rule id return a locked vcap */
static struct vcap_rule_internal *
vcap_get_locked_rule(struct vcap_control *vctrl, u32 id)
@@ -943,11 +953,11 @@ vcap_get_locked_rule(struct vcap_control *vctrl, u32 id)
/* Look for the rule id in all vcaps */
list_for_each_entry(admin, &vctrl->list, list) {
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry(ri, &admin->rules, list)
if (ri->data.id == id)
return ri;
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
}
return NULL;
}
@@ -961,14 +971,14 @@ int vcap_lookup_rule_by_cookie(struct vcap_control *vctrl, u64 cookie)
/* Look for the rule id in all vcaps */
list_for_each_entry(admin, &vctrl->list, list) {
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry(ri, &admin->rules, list) {
if (ri->data.cookie == cookie) {
id = ri->data.id;
break;
}
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
if (id)
return id;
}
@@ -985,11 +995,11 @@ int vcap_admin_rule_count(struct vcap_admin *admin, int cid)
int count = 0;
list_for_each_entry(elem, &admin->rules, list) {
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
if (elem->data.vcap_chain_id >= min_cid &&
elem->data.vcap_chain_id < max_cid)
++count;
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
}
return count;
}
@@ -2266,7 +2276,7 @@ int vcap_add_rule(struct vcap_rule *rule)
if (ret)
return ret;
/* Insert the new rule in the list of vcap rules */
- mutex_lock(&ri->admin->lock);
+ vcap_lock(ri->admin);
vcap_rule_set_state(ri);
ret = vcap_insert_rule(ri, &move);
@@ -2302,7 +2312,7 @@ int vcap_add_rule(struct vcap_rule *rule)
goto out;
}
out:
- mutex_unlock(&ri->admin->lock);
+ vcap_unlock(ri->admin);
return ret;
}
EXPORT_SYMBOL_GPL(vcap_add_rule);
@@ -2330,7 +2340,7 @@ struct vcap_rule *vcap_alloc_rule(struct vcap_control *vctrl,
if (vctrl->vcaps[admin->vtype].rows == 0)
return ERR_PTR(-EINVAL);
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
/* Check if a rule with this id already exists */
if (vcap_rule_exists(vctrl, id)) {
err = -EINVAL;
@@ -2369,13 +2379,13 @@ struct vcap_rule *vcap_alloc_rule(struct vcap_control *vctrl,
goto out_free;
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
return (struct vcap_rule *)ri;
out_free:
kfree(ri);
out_unlock:
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
return ERR_PTR(err);
}
@@ -2446,7 +2456,7 @@ struct vcap_rule *vcap_get_rule(struct vcap_control *vctrl, u32 id)
return ERR_PTR(-ENOENT);
rule = vcap_decode_rule(elem);
- mutex_unlock(&elem->admin->lock);
+ vcap_unlock(elem->admin);
return rule;
}
EXPORT_SYMBOL_GPL(vcap_get_rule);
@@ -2483,7 +2493,7 @@ int vcap_mod_rule(struct vcap_rule *rule)
err = vcap_write_counter(ri, &ctr);
out:
- mutex_unlock(&ri->admin->lock);
+ vcap_unlock(ri->admin);
return err;
}
EXPORT_SYMBOL_GPL(vcap_mod_rule);
@@ -2570,7 +2580,7 @@ int vcap_del_rule(struct vcap_control *vctrl, struct net_device *ndev, u32 id)
admin->last_used_addr = elem->addr;
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
return err;
}
EXPORT_SYMBOL_GPL(vcap_del_rule);
@@ -2585,7 +2595,7 @@ int vcap_del_rules(struct vcap_control *vctrl, struct vcap_admin *admin)
if (ret)
return ret;
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry_safe(ri, next_ri, &admin->rules, list) {
vctrl->ops->init(ri->ndev, admin, ri->addr, ri->size);
list_del(&ri->list);
@@ -2598,7 +2608,7 @@ int vcap_del_rules(struct vcap_control *vctrl, struct vcap_admin *admin)
list_del(&eport->list);
kfree(eport);
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
return 0;
}
@@ -3004,7 +3014,7 @@ static int vcap_enable_rules(struct vcap_control *vctrl,
continue;
/* Found the admin, now find the offloadable rules */
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry(ri, &admin->rules, list) {
/* Is the rule in the lookup defined by the chain */
if (!(ri->data.vcap_chain_id >= chain &&
@@ -3022,7 +3032,7 @@ static int vcap_enable_rules(struct vcap_control *vctrl,
if (err)
break;
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
if (err)
break;
}
@@ -3062,7 +3072,7 @@ static int vcap_disable_rules(struct vcap_control *vctrl,
continue;
/* Found the admin, now find the rules on the chain */
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry(ri, &admin->rules, list) {
if (ri->data.vcap_chain_id != chain)
continue;
@@ -3077,7 +3087,7 @@ static int vcap_disable_rules(struct vcap_control *vctrl,
if (err)
break;
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
if (err)
break;
}
@@ -3121,9 +3131,9 @@ static int vcap_enable(struct vcap_control *vctrl, struct net_device *ndev,
eport->cookie = cookie;
eport->src_cid = src_cid;
eport->dst_cid = dst_cid;
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_add_tail(&eport->list, &admin->enabled);
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
if (vcap_path_exist(vctrl, ndev, src_cid)) {
/* Enable chained lookups */
@@ -3173,9 +3183,9 @@ static int vcap_disable(struct vcap_control *vctrl, struct net_device *ndev,
dst_cid = vcap_get_next_chain(vctrl, ndev, dst_cid);
}
- mutex_lock(&found->lock);
+ vcap_lock(found);
list_del(&eport->list);
- mutex_unlock(&found->lock);
+ vcap_unlock(found);
kfree(eport);
return 0;
}
@@ -3258,9 +3268,9 @@ int vcap_rule_set_counter(struct vcap_rule *rule, struct vcap_counter *ctr)
return -EINVAL;
}
- mutex_lock(&ri->admin->lock);
+ vcap_lock(ri->admin);
err = vcap_write_counter(ri, ctr);
- mutex_unlock(&ri->admin->lock);
+ vcap_unlock(ri->admin);
return err;
}
@@ -3279,9 +3289,9 @@ int vcap_rule_get_counter(struct vcap_rule *rule, struct vcap_counter *ctr)
return -EINVAL;
}
- mutex_lock(&ri->admin->lock);
+ vcap_lock(ri->admin);
err = vcap_read_counter(ri, ctr);
- mutex_unlock(&ri->admin->lock);
+ vcap_unlock(ri->admin);
return err;
}
@@ -3383,7 +3393,7 @@ int vcap_get_rule_count_by_cookie(struct vcap_control *vctrl,
/* Iterate all rules in each VCAP instance */
list_for_each_entry(admin, &vctrl->list, list) {
- mutex_lock(&admin->lock);
+ vcap_lock(admin);
list_for_each_entry(ri, &admin->rules, list) {
if (ri->data.cookie != cookie)
continue;
@@ -3400,12 +3410,12 @@ int vcap_get_rule_count_by_cookie(struct vcap_control *vctrl,
if (err)
goto unlock;
}
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
}
return err;
unlock:
- mutex_unlock(&admin->lock);
+ vcap_unlock(admin);
return err;
}
EXPORT_SYMBOL_GPL(vcap_get_rule_count_by_cookie);
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api.h b/drivers/net/ethernet/microchip/vcap/vcap_api.h
index 9eccfa633c1afb..944da1997a5518 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api.h
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api.h
@@ -164,7 +164,7 @@ struct vcap_admin {
struct list_head list; /* for insertion in vcap_control */
struct list_head rules; /* list of rules */
struct list_head enabled; /* list of enabled ports */
- struct mutex lock; /* control access to rules */
+ struct vcap_control *vctrl; /* the control instance owning this vcap */
enum vcap_type vtype; /* type of vcap */
int vinst; /* instance number within the same type */
int first_cid; /* first chain id in this vcap */
@@ -275,6 +275,7 @@ struct vcap_control {
const struct vcap_info *vcaps; /* client supplied vcap models */
const struct vcap_statistics *stats; /* client supplied vcap stats */
struct list_head list; /* list of vcap instances */
+ struct mutex lock; /* serialize access to all vcap instances */
};
#endif /* __VCAP_API__ */
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c b/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c
index c2c3397c5898d1..78e2d85bb503ec 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs.c
@@ -410,9 +410,9 @@ static int vcap_debugfs_show(struct seq_file *m, void *unused)
};
int ret;
- mutex_lock(&info->admin->lock);
+ vcap_lock(info->admin);
ret = vcap_show_admin(info->vctrl, info->admin, &out);
- mutex_unlock(&info->admin->lock);
+ vcap_unlock(info->admin);
return ret;
}
DEFINE_SHOW_ATTRIBUTE(vcap_debugfs);
@@ -427,9 +427,9 @@ static int vcap_raw_debugfs_show(struct seq_file *m, void *unused)
};
int ret;
- mutex_lock(&info->admin->lock);
+ vcap_lock(info->admin);
ret = vcap_show_admin_raw(info->vctrl, info->admin, &out);
- mutex_unlock(&info->admin->lock);
+ vcap_unlock(info->admin);
return ret;
}
DEFINE_SHOW_ATTRIBUTE(vcap_raw_debugfs);
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs_kunit.c b/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs_kunit.c
index b23c11b0647c9e..5511933ef0639e 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs_kunit.c
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api_debugfs_kunit.c
@@ -243,10 +243,11 @@ static void vcap_test_api_init(struct vcap_admin *admin)
{
/* Initialize the shared objects */
INIT_LIST_HEAD(&test_vctrl.list);
+ mutex_init(&test_vctrl.lock);
INIT_LIST_HEAD(&admin->list);
INIT_LIST_HEAD(&admin->rules);
INIT_LIST_HEAD(&admin->enabled);
- mutex_init(&admin->lock);
+ admin->vctrl = &test_vctrl;
list_add_tail(&admin->list, &test_vctrl.list);
memset(test_updateaddr, 0, sizeof(test_updateaddr));
test_updateaddridx = 0;
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
index 88744ae6529354..d0569307de13f4 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
@@ -233,10 +233,11 @@ static void vcap_test_api_init(struct vcap_admin *admin)
{
/* Initialize the shared objects */
INIT_LIST_HEAD(&test_vctrl.list);
+ mutex_init(&test_vctrl.lock);
INIT_LIST_HEAD(&admin->list);
INIT_LIST_HEAD(&admin->rules);
INIT_LIST_HEAD(&admin->enabled);
- mutex_init(&admin->lock);
+ admin->vctrl = &test_vctrl;
list_add_tail(&admin->list, &test_vctrl.list);
memset(test_updateaddr, 0, sizeof(test_updateaddr));
test_updateaddridx = 0;
diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_private.h b/drivers/net/ethernet/microchip/vcap/vcap_api_private.h
index df81d9ff502b31..80663f911bd2e7 100644
--- a/drivers/net/ethernet/microchip/vcap/vcap_api_private.h
+++ b/drivers/net/ethernet/microchip/vcap/vcap_api_private.h
@@ -50,6 +50,9 @@ struct vcap_stream_iter {
/* Check that the control has a valid set of callbacks */
int vcap_api_check(struct vcap_control *ctrl);
+/* Serialize access to the vcap instances of a control */
+void vcap_lock(struct vcap_admin *admin);
+void vcap_unlock(struct vcap_admin *admin);
/* Erase the VCAP cache area used or encoding and decoding */
void vcap_erase_cache(struct vcap_rule_internal *ri);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0857/1266] qede: fix off-by-one in BD ring consumption on build_skb failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (855 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0856/1266] net: microchip: vcap: fix races on the shared Super VCAP block Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0858/1266] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
` (141 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shigeru Yoshida, Jamie Bainbridge,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f ]
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.
Fixes: 8a8633978b84 ("qede: Add build_skb() support.")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Link: https://patch.msgid.link/20260630164623.3152625-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index 1de8611a27f238..51affa97aab401 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -765,6 +765,9 @@ qede_tpa_rx_build_skb(struct qede_dev *edev,
struct sk_buff *skb;
skb = qede_build_skb(rxq, bd, len, pad);
+ if (unlikely(!skb))
+ return NULL;
+
bd->page_offset += rxq->rx_buf_seg_size;
if (bd->page_offset == PAGE_SIZE) {
@@ -812,6 +815,8 @@ qede_rx_build_skb(struct qede_dev *edev,
}
skb = qede_build_skb(rxq, bd, len, pad);
+ if (unlikely(!skb))
+ return NULL;
if (unlikely(qede_realloc_rx_buffer(rxq, bd))) {
/* Incr page ref count to reuse on allocation failure so
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0858/1266] net: qualcomm: rmnet: validate MAP frame length before ingress parsing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (856 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0857/1266] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0859/1266] net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload Greg Kroah-Hartman
` (140 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi,
Subash Abhinov Kasiviswanathan, Xiang Mei, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit f0f1887a9e30712a1df03e152dce6fb91344b1f3 ]
When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
netif_receive_skb (net/core/dev.c:6460)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2001)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Suggested-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260630174110.2003121-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +-
.../net/ethernet/qualcomm/rmnet/rmnet_map.h | 1 +
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 72 ++++++++++---------
3 files changed, 45 insertions(+), 33 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 9f3479500f85a1..d055a2628d8c9d 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -126,7 +126,10 @@ rmnet_map_ingress_handler(struct sk_buff *skb,
consume_skb(skb);
} else {
- __rmnet_map_ingress_handler(skb, port);
+ if (rmnet_map_validate_packet_len(skb, port))
+ __rmnet_map_ingress_handler(skb, port);
+ else
+ kfree_skb(skb);
}
}
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index b70284095568ce..60ca8b780c88ad 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -59,5 +59,6 @@ void rmnet_map_tx_aggregate_init(struct rmnet_port *port);
void rmnet_map_tx_aggregate_exit(struct rmnet_port *port);
void rmnet_map_update_ul_agg_config(struct rmnet_port *port, u32 size,
u32 count, u32 time);
+u32 rmnet_map_validate_packet_len(struct sk_buff *skb, struct rmnet_port *port);
#endif /* _RMNET_MAP_H_ */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index a5e3d1a88305ec..8471157a431beb 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -333,54 +333,62 @@ struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
return map_header;
}
-/* Deaggregates a single packet
- * A whole new buffer is allocated for each portion of an aggregated frame.
- * Caller should keep calling deaggregate() on the source skb until 0 is
- * returned, indicating that there are no more packets to deaggregate. Caller
- * is responsible for freeing the original skb.
- */
-struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
- struct rmnet_port *port)
+u32 rmnet_map_validate_packet_len(struct sk_buff *skb, struct rmnet_port *port)
{
struct rmnet_map_v5_csum_header *next_hdr = NULL;
struct rmnet_map_header *maph;
void *data = skb->data;
- struct sk_buff *skbn;
- u8 nexthdr_type;
u32 packet_len;
- if (skb->len == 0)
- return NULL;
+ if (skb->len < sizeof(*maph))
+ return 0;
maph = (struct rmnet_map_header *)skb->data;
+
+ /* Some hardware can send us empty frames. Catch them */
+ if (!maph->pkt_len)
+ return 0;
+
packet_len = ntohs(maph->pkt_len) + sizeof(*maph);
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
packet_len += sizeof(struct rmnet_map_dl_csum_trailer);
- } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) {
- if (!(maph->flags & MAP_CMD_FLAG)) {
- packet_len += sizeof(*next_hdr);
- if (maph->flags & MAP_NEXT_HEADER_FLAG)
- next_hdr = data + sizeof(*maph);
- else
- /* Mapv5 data pkt without csum hdr is invalid */
- return NULL;
- }
+ } else if ((port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) &&
+ !(maph->flags & MAP_CMD_FLAG)) {
+ /* Mapv5 data pkt without csum hdr is invalid */
+ if (!(maph->flags & MAP_NEXT_HEADER_FLAG))
+ return 0;
+
+ packet_len += sizeof(*next_hdr);
+ next_hdr = data + sizeof(*maph);
}
- if (((int)skb->len - (int)packet_len) < 0)
- return NULL;
+ if (skb->len < packet_len)
+ return 0;
- /* Some hardware can send us empty frames. Catch them */
- if (!maph->pkt_len)
- return NULL;
+ if (next_hdr &&
+ u8_get_bits(next_hdr->header_info, MAPV5_HDRINFO_HDR_TYPE_FMASK) !=
+ RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
+ return 0;
- if (next_hdr) {
- nexthdr_type = u8_get_bits(next_hdr->header_info,
- MAPV5_HDRINFO_HDR_TYPE_FMASK);
- if (nexthdr_type != RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
- return NULL;
- }
+ return packet_len;
+}
+
+/* Deaggregates a single packet
+ * A whole new buffer is allocated for each portion of an aggregated frame.
+ * Caller should keep calling deaggregate() on the source skb until 0 is
+ * returned, indicating that there are no more packets to deaggregate. Caller
+ * is responsible for freeing the original skb.
+ */
+struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
+ struct rmnet_port *port)
+{
+ struct sk_buff *skbn;
+ u32 packet_len;
+
+ packet_len = rmnet_map_validate_packet_len(skb, port);
+ if (!packet_len)
+ return NULL;
skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
if (!skbn)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0859/1266] net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (857 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0858/1266] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0860/1266] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
` (139 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zdi-disclosures, Victor Nogueira,
Jamal Hadi Salim, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit 8b519cbcabe836a441369fbec1a8a6518a709251 ]
There is a TOCTOU race condition in flower lockless approach between sizing
a flow_rule buffer and filling it.
zdi-disclosures@trendmicro.com reports:
The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED
(fl_change runs without RTNL), while RTM_NEWACTION holds RTNL, so the
independent locking domains make the race reachable in practice. KASAN
confirms:
BUG: KASAN: slab-out-of-bounds in tcf_pedit_offload_act_setup+0x81b/0x930
Write of size 4 at addr ffff888001f27520 by task poc-toctou/312
The buggy address is located 0 bytes to the right of
allocated 288-byte region [ffff888001f27400, ffff888001f27520)
(cache kmalloc-512)
Note: The result is a heap OOB write attacker-controlled content into the
adjacent slab object (requires CAP_NET_ADMIN).
The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places
using a new tcf_pedit_nkeys_locked() which replaces the old tcf_pedit_nkeys().
Additionally we close the remaining TOCTOU window between the sizing read and
the fill reads by more careful accounting.
Rather than silently truncating the key count, which leads to incorrect
action semantics offloaded to hardware and secondary OOB writes if
the remaining capacity is zero or consumed by prior actions, we enforce
remaining capacity checks and return -ENOSPC if the required space exceeds
the remaining capacity.
Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers")
Reported-by: zdi-disclosures@trendmicro.com
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260701161912.125355-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tc_act/tc_pedit.h | 18 ++++++++----------
net/sched/act_api.c | 13 +++++++++----
net/sched/act_pedit.c | 13 +++++++++++--
net/sched/cls_api.c | 22 +++++++++++++++++-----
4 files changed, 45 insertions(+), 21 deletions(-)
diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h
index a26d4cd3b8d6f3..fa4cd4fc36740d 100644
--- a/include/net/tc_act/tc_pedit.h
+++ b/include/net/tc_act/tc_pedit.h
@@ -36,17 +36,15 @@ static inline bool is_tcf_pedit(const struct tc_action *a)
return false;
}
-static inline int tcf_pedit_nkeys(const struct tc_action *a)
+/* Must be called with act->tcfa_lock held to ensure consistency of parallel
+ * reads of the same action's pedit keys (e.g. flow_offload count vs fill).
+ * Note, this is only used for pedit offload.
+ */
+static inline int tcf_pedit_nkeys_locked(const struct tc_action *a)
{
- struct tcf_pedit_parms *parms;
- int nkeys;
-
- rcu_read_lock();
- parms = to_pedit_parms(a);
- nkeys = parms->tcfp_nkeys;
- rcu_read_unlock();
-
- return nkeys;
+ lockdep_assert_held(&a->tcfa_lock);
+ return rcu_dereference_protected(to_pedit(a)->parms,
+ lockdep_is_held(&a->tcfa_lock))->tcfp_nkeys;
}
static inline u32 tcf_pedit_htype(const struct tc_action *a, int index)
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index bed04ae3003c43..3b7e5fcdd4ff29 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -148,10 +148,15 @@ static void offload_action_hw_count_dec(struct tc_action *act,
static unsigned int tcf_offload_act_num_actions_single(struct tc_action *act)
{
- if (is_tcf_pedit(act))
- return tcf_pedit_nkeys(act);
- else
- return 1;
+ unsigned int count;
+
+ if (is_tcf_pedit(act)) {
+ spin_lock_bh(&act->tcfa_lock);
+ count = tcf_pedit_nkeys_locked(act);
+ spin_unlock_bh(&act->tcfa_lock);
+ return count;
+ }
+ return 1;
}
static bool tc_act_skip_hw(u32 flags)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 80b2a1e9d5ceb9..f26f05fb10fe44 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -563,9 +563,18 @@ static int tcf_pedit_offload_act_setup(struct tc_action *act, void *entry_data,
{
if (bind) {
struct flow_action_entry *entry = entry_data;
+ int nkeys = tcf_pedit_nkeys_locked(act);
int k;
- for (k = 0; k < tcf_pedit_nkeys(act); k++) {
+ /* If the required keys exceed the remaining capacity return
+ * -ENOSPC to abort the offload and fallback to software.
+ */
+ if (nkeys > *index_inc) {
+ NL_SET_ERR_MSG_MOD(extack, "Not enough space to offload all pedit keys");
+ return -ENOSPC;
+ }
+
+ for (k = 0; k < nkeys; k++) {
switch (tcf_pedit_cmd(act, k)) {
case TCA_PEDIT_KEY_EX_CMD_SET:
entry->id = FLOW_ACTION_MANGLE;
@@ -602,7 +611,7 @@ static int tcf_pedit_offload_act_setup(struct tc_action *act, void *entry_data,
return -EOPNOTSUPP;
}
- for (k = 1; k < tcf_pedit_nkeys(act); k++) {
+ for (k = 1; k < tcf_pedit_nkeys_locked(act); k++) {
if (cmd != tcf_pedit_cmd(act, k)) {
NL_SET_ERR_MSG_MOD(extack, "Unsupported pedit command offload");
return -EOPNOTSUPP;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2c3af83c01c4f6..e259ec6ed145de 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -3808,12 +3808,21 @@ int tc_setup_action(struct flow_action *flow_action,
entry = &flow_action->entries[j];
spin_lock_bh(&act->tcfa_lock);
+
+ /* Abort the offload if we have exhausted the allocated capacity */
+ if (j >= flow_action->num_entries) {
+ NL_SET_ERR_MSG_MOD(extack, "Flow action buffer overflow");
+ err = -ENOSPC;
+ goto err_out_locked;
+ }
+
err = tcf_act_get_user_cookie(entry, act);
if (err)
goto err_out_locked;
- index = 0;
- err = tc_setup_offload_act(act, entry, &index, extack);
+ index = flow_action->num_entries - j;
+ err = tc_setup_offload_act(act, entry, &index,
+ extack);
if (err)
goto err_out_locked;
@@ -3867,10 +3876,13 @@ unsigned int tcf_exts_num_actions(struct tcf_exts *exts)
int i;
tcf_exts_for_each_action(i, act, exts) {
- if (is_tcf_pedit(act))
- num_acts += tcf_pedit_nkeys(act);
- else
+ if (is_tcf_pedit(act)) {
+ spin_lock_bh(&act->tcfa_lock);
+ num_acts += tcf_pedit_nkeys_locked(act);
+ spin_unlock_bh(&act->tcfa_lock);
+ } else {
num_acts++;
+ }
}
return num_acts;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0860/1266] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (858 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0859/1266] net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0861/1266] amt: fix size calculation in amt_get_size() Greg Kroah-Hartman
` (138 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 9d160b35cc34a2ba8229d07651468a7848325135 ]
smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate
Workqueue: rxe_wq do_work
refcount_warn_saturate (lib/refcount.c:25)
smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
tasklet_action_common (kernel/softirq.c:938)
handle_softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
Fixes: d7b0e37c1ac1 ("net/smc: restructure CDC message reception")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260630183227.2044998-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_cdc.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 3c06625ceb200e..65d6d388adf891 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -438,9 +438,9 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
{
struct smc_link *link = (struct smc_link *)wc->qp->qp_context;
struct smc_cdc_msg *cdc = buf;
+ struct smc_sock *smc = NULL;
struct smc_connection *conn;
struct smc_link_group *lgr;
- struct smc_sock *smc;
if (wc->byte_len < offsetof(struct smc_cdc_msg, reserved))
return; /* short message */
@@ -451,21 +451,26 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
lgr = smc_get_lgr(link);
read_lock_bh(&lgr->conns_lock);
conn = smc_lgr_find_conn(ntohl(cdc->token), lgr);
- read_unlock_bh(&lgr->conns_lock);
- if (!conn || conn->out_of_sync)
+ if (!conn || conn->out_of_sync) {
+ read_unlock_bh(&lgr->conns_lock);
return;
+ }
smc = container_of(conn, struct smc_sock, conn);
+ sock_hold(&smc->sk);
+ read_unlock_bh(&lgr->conns_lock);
if (cdc->prod_flags.failover_validation) {
smc_cdc_msg_validate(smc, cdc, link);
- return;
+ goto out;
}
if (smc_cdc_before(ntohs(cdc->seqno),
conn->local_rx_ctrl.seqno))
/* received seqno is old */
- return;
+ goto out;
smc_cdc_msg_recv(smc, cdc);
+out:
+ sock_put(&smc->sk);
}
static struct smc_wr_rx_handler smc_cdc_rx_handlers[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0861/1266] amt: fix size calculation in amt_get_size()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (859 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0860/1266] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0862/1266] Bluetooth: 6lowpan: hold L2CAP conn across debugfs control Greg Kroah-Hartman
` (137 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Kuniyuki Iwashima,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9e05e91a9a847ed57926414bd7c2c5e54d6c56c6 ]
amt_get_size() incorrectly used sizeof(struct iphdr) for the sizes of
IFLA_AMT_DISCOVERY_IP, IFLA_AMT_REMOTE_IP, and IFLA_AMT_LOCAL_IP.
These attributes contain IPv4 addresses (__be32), not full IP headers.
Replace sizeof(struct iphdr) with sizeof(__be32) to avoid over-allocating
netlink message space.
Fixes: b9022b53adad ("amt: add control plane of amt interface")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260701122329.3562825-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/amt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index ddd087c2c3ed45..f2da0c49171f5d 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -3303,9 +3303,9 @@ static size_t amt_get_size(const struct net_device *dev)
nla_total_size(sizeof(__u16)) + /* IFLA_AMT_GATEWAY_PORT */
nla_total_size(sizeof(__u32)) + /* IFLA_AMT_LINK */
nla_total_size(sizeof(__u32)) + /* IFLA_MAX_TUNNELS */
- nla_total_size(sizeof(struct iphdr)) + /* IFLA_AMT_DISCOVERY_IP */
- nla_total_size(sizeof(struct iphdr)) + /* IFLA_AMT_REMOTE_IP */
- nla_total_size(sizeof(struct iphdr)); /* IFLA_AMT_LOCAL_IP */
+ nla_total_size(sizeof(__be32)) + /* IFLA_AMT_DISCOVERY_IP */
+ nla_total_size(sizeof(__be32)) + /* IFLA_AMT_REMOTE_IP */
+ nla_total_size(sizeof(__be32)); /* IFLA_AMT_LOCAL_IP */
}
static int amt_fill_info(struct sk_buff *skb, const struct net_device *dev)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0862/1266] Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (860 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0861/1266] amt: fix size calculation in amt_get_size() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0863/1266] Bluetooth: MGMT: Fix adv monitor add failure cleanup Greg Kroah-Hartman
` (136 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 518aa9505fa10ea5662349e5d2efd8c9e32a820b ]
get_l2cap_conn() looks up an LE hci_conn under hdev protection, but
then drops that protection before reading hcon->l2cap_data and before
lowpan_control_write() later dereferences conn->hcon. A disconnect or
device close can tear down the same L2CAP connection in that window.
The buggy scenario involves two paths, with each column showing the order
within that path:
6LoWPAN control write: HCI disconnect/device close:
1. get_l2cap_conn() finds hcon 1. hci_disconn_cfm() dispatches
and hcon->l2cap_data. the L2CAP disconnect callback.
2. get_l2cap_conn() drops hdev 2. l2cap_conn_del() clears
protection and returns conn. hcon->l2cap_data and drops the
L2CAP connection reference.
3. lowpan_control_write() reads 3. hci_conn_del() removes and drops
conn->hcon. the HCI connection.
Take a reference to the L2CAP connection with
l2cap_conn_hold_unless_zero() while hdev is still locked, and drop that
reference after the debugfs command's last use of conn. This mirrors the
existing L2CAP ACL receive-side handoff and keeps the connection
dereferenceable after leaving hdev protection. Export the existing helper
so the bluetooth_6lowpan module can use the same lifetime primitive.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in lowpan_control_write+0x374/0x520
The buggy address belongs to the object at ffff888111b9d000 which belongs
to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of freed 1024-byte region
[ffff888111b9d000, ffff888111b9d400)
Read of size 8
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x5f0
lowpan_control_write+0x374/0x520 (net/bluetooth/6lowpan.c:1131)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
__debugfs_file_get+0xf7/0x400
full_proxy_write+0x9e/0xd0
vfs_write+0x1b0/0x810
ksys_write+0xd2/0x170
dnotify_flush+0x32/0x220
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x17/0x60
__kasan_kmalloc+0xaa/0xb0
l2cap_conn_add+0x45/0x520
l2cap_chan_connect+0xac6/0xd90
l2cap_sock_connect+0x216/0x350
__sys_connect+0x101/0x130
__x64_sys_connect+0x40/0x50
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x17/0x60
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x313/0x590
hci_conn_hash_flush+0xc0/0x140
hci_dev_close_sync+0x41a/0xb00
hci_dev_close+0x12f/0x160
hci_sock_ioctl+0x157/0x570
sock_do_ioctl+0xf7/0x210
sock_ioctl+0x32f/0x490
__x64_sys_ioctl+0xc7/0x110
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
kasan_record_aux_stack+0xa7/0xc0
insert_work+0x32/0x100
__queue_work+0x262/0xa60
queue_work_on+0xad/0xb0
l2cap_connect_cfm+0x4ef/0x670
hci_le_remote_feat_complete_evt+0x247/0x430
hci_event_packet+0x360/0x6f0
hci_rx_work+0x2ae/0x7a0
process_one_work+0x4fd/0xbc0
worker_thread+0x2d8/0x570
kthread+0x1ad/0x1f0
ret_from_fork+0x3c9/0x540
ret_from_fork_asm+0x1a/0x30
Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 21 +++++++++++++++------
net/bluetooth/l2cap_core.c | 1 +
2 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index b3132079573d4d..e44fcd37f809ed 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1006,16 +1006,19 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
hci_dev_lock(hdev);
hcon = hci_conn_hash_lookup_le(hdev, addr, le_addr_type);
- hci_dev_unlock(hdev);
- hci_dev_put(hdev);
-
- if (!hcon)
+ if (!hcon) {
+ hci_dev_unlock(hdev);
+ hci_dev_put(hdev);
return -ENOENT;
+ }
- *conn = (struct l2cap_conn *)hcon->l2cap_data;
+ *conn = l2cap_conn_hold_unless_zero(hcon->l2cap_data);
BT_DBG("conn %p dst %pMR type %u", *conn, &hcon->dst, hcon->dst_type);
+ hci_dev_unlock(hdev);
+ hci_dev_put(hdev);
+
return 0;
}
@@ -1158,18 +1161,22 @@ static ssize_t lowpan_control_write(struct file *fp,
if (conn) {
struct lowpan_peer *peer;
- if (!is_bt_6lowpan(conn->hcon))
+ if (!is_bt_6lowpan(conn->hcon)) {
+ l2cap_conn_put(conn);
return -EINVAL;
+ }
peer = lookup_peer(conn);
if (peer) {
BT_DBG("6LoWPAN connection already exists");
+ l2cap_conn_put(conn);
return -EALREADY;
}
BT_DBG("conn %p dst %pMR type %d user %u", conn,
&conn->hcon->dst, conn->hcon->dst_type,
addr_type);
+ l2cap_conn_put(conn);
}
ret = bt_6lowpan_connect(&addr, addr_type);
@@ -1185,6 +1192,8 @@ static ssize_t lowpan_control_write(struct file *fp,
return ret;
ret = bt_6lowpan_disconnect(conn, addr_type);
+ if (conn)
+ l2cap_conn_put(conn);
if (ret < 0)
return ret;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 8f83ee2e75112e..6a3b279d26886b 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7645,6 +7645,7 @@ struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
return c;
}
+EXPORT_SYMBOL(l2cap_conn_hold_unless_zero);
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0863/1266] Bluetooth: MGMT: Fix adv monitor add failure cleanup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (861 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0862/1266] Bluetooth: 6lowpan: hold L2CAP conn across debugfs control Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0864/1266] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
` (135 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cen Zhang, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <zzzccc427@gmail.com>
[ Upstream commit 384a4b2fef9ffe5e270ee5558975c0504881c5fb ]
hci_add_adv_monitor() publishes a new adv_monitor in
hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT
offload add path can then fail either locally before the controller add
command completes, or in the MSFT add callback. In the current queued
management add flow, hci_cmd_sync_work() still invokes
mgmt_add_adv_patterns_monitor_complete() with the original pending command
after msft_add_monitor_pattern() returns.
The buggy scenario involves two paths, with each column showing the order
within that path:
MSFT add handling MGMT completion
1. insert monitor and handle 1. receive sync error
2. send MSFT add command 2. call add-monitor completion
3. callback sees bad response 3. load cmd->user_data
4. callback frees monitor 4. read monitor->handle
Local MSFT setup failures have the other half of the same ownership bug:
they return an error after the IDR insertion, but no later code removes the
failed monitor from the IDR.
Keep ownership with the pending management command until its completion.
For normal management adds, the MSFT add callback now records successful
controller state and returns errors to its caller. The management
completion frees the monitor on non-success after copying the response
handle, while resume/reregister callback-error cleanup remains in the
MSFT callback. The success path keeps the existing bookkeeping.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
Call Trace:
<TASK>
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x5f0
? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x19f/0x330
? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
kasan_report+0xe0/0x110
? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
? srso_alias_return_thunk+0x5/0xfbef5
? 0xffffffffc00d00da
? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]
? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]
? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]
hci_cmd_sync_work+0x1c0/0x210 [bluetooth]
? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]
process_one_work+0x4fd/0xbc0
? __pfx_process_one_work+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __list_add_valid_or_report+0x37/0xf0
? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]
? srso_alias_return_thunk+0x5/0xfbef5
worker_thread+0x2d8/0x570
? __pfx_worker_thread+0x10/0x10
kthread+0x1ad/0x1f0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x3c9/0x540
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x2e9/0x730
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 471 on cpu 3 at 285.205389s:
kasan_save_stack+0x33/0x60
kasan_save_track+0x17/0x60
__kasan_kmalloc+0xaa/0xb0
add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]
hci_sock_sendmsg+0x96b/0xf80 [bluetooth]
__sys_sendto+0x2bc/0x2d0
__x64_sys_sendto+0x76/0x90
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 454 on cpu 2 at 285.217112s:
kasan_save_stack+0x33/0x60
kasan_save_track+0x17/0x60
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x313/0x590
msft_add_monitor_sync+0x54a/0x570 [bluetooth]
hci_add_adv_monitor+0x133/0x180 [bluetooth]
hci_cmd_sync_work+0x187/0x210 [bluetooth]
process_one_work+0x4fd/0xbc0
worker_thread+0x2d8/0x570
kthread+0x1ad/0x1f0
ret_from_fork+0x3c9/0x540
ret_from_fork_asm+0x1a/0x30
Fixes: a2a4dedf88ab ("Bluetooth: advmon offload MSFT add monitor")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 2 ++
net/bluetooth/msft.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index d64fe535d52512..ac696b870021af 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5347,6 +5347,8 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
monitor->state = ADV_MONITOR_STATE_REGISTERED;
hci_update_passive_scan(hdev);
+ } else {
+ hci_free_adv_monitor(hdev, monitor);
}
mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index d039683d3bdd41..9aee9bffaa7e07 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -292,7 +292,7 @@ static int msft_le_monitor_advertisement_cb(struct hci_dev *hdev, u16 opcode,
monitor->state = ADV_MONITOR_STATE_OFFLOADED;
unlock:
- if (status)
+ if (status && msft->resuming)
hci_free_adv_monitor(hdev, monitor);
hci_dev_unlock(hdev);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0864/1266] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (862 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0863/1266] Bluetooth: MGMT: Fix adv monitor add failure cleanup Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0865/1266] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
` (134 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit fd076d8deeab6f9f18ef13400f89e1f550df665b ]
slen contains ISO_SDU_Length (12 bits), RFU (2 bits),
Packet_Status_Flags (2 bits).
Exclude the RFU bits from hci_iso_data_len. Also add masks to the pack
macro.
Fixes: 4de0fc599eb9 ("Bluetooth: Add definitions for CIS connections")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index b25746b91986c2..ad640f85a66079 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2914,8 +2914,9 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
#define hci_iso_flags_pack(pb, ts) ((pb & 0x03) | ((ts & 0x01) << 2))
/* ISO data length and flags pack/unpack */
-#define hci_iso_data_len_pack(h, f) ((__u16) ((h) | ((f) << 14)))
-#define hci_iso_data_len(h) ((h) & 0x3fff)
+#define hci_iso_data_len_pack(h, f) ((__u16) (((h) & 0x0fff) | \
+ (((f) & 0x3) << 14)))
+#define hci_iso_data_len(h) ((h) & 0x0fff)
#define hci_iso_data_flags(h) ((h) >> 14)
/* codec transport types */
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0865/1266] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (863 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0864/1266] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0866/1266] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
` (133 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit dd068ef044128db655f48323a4acfd5907e04903 ]
bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:
bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
hci_set_fw_info(hdev, "%s", skb->data + 1);
A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.
Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.
Fixes: ddd68ec8f484 ("Bluetooth: bpa10x: Read revision information in setup stage")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/bpa10x.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 1fa58c059cbf5c..8942ebd0d0b9f6 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -254,9 +254,13 @@ static int bpa10x_setup(struct hci_dev *hdev)
if (IS_ERR(skb))
return PTR_ERR(skb);
- bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+ /* Bounded print: the device controls skb->len. */
+ if (skb->len > 1) {
+ int len = skb->len - 1;
- hci_set_fw_info(hdev, "%s", skb->data + 1);
+ bt_dev_info(hdev, "%.*s", len, (char *)(skb->data + 1));
+ hci_set_fw_info(hdev, "%.*s", len, skb->data + 1);
+ }
kfree_skb(skb);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0866/1266] ring-buffer: Fix event length with forced 8-byte alignment
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (864 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0865/1266] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0867/1266] net/tls: Consume empty data records in tls_sw_read_sock() Greg Kroah-Hartman
` (132 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Wang, Masami Hiramatsu (Google),
Steven Rostedt, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
[ Upstream commit c37e0a4b79a6bbb96ce5ffe279d7c001e20529e0 ]
When RB_FORCE_8BYTE_ALIGNMENT is true, rb_calculate_event_length()
reserves the space of event->array[0] for placing the data length and
rb_update_event() stores the data length in event->array[0]
accordingly. As a result the whole event length will add extra 4 bytes
for sizeof(event.array[0]) unconditionally.
But ring_buffer_event_length() only subtracts the
sizeof(event->array[0]) for events larger than RB_MAX_SMALL_DATA +
sizeof(event->array[0]). As a result, small events on architectures
with RB_FORCE_8BYTE_ALIGNMENT=true report a data length that is 4
bytes larger than expected.
To fix it, add the RB_FORCE_8BYTE_ALIGNMENT as a condition to subtract
the size of that length field whenever RB_FORCE_8BYTE_ALIGNMENT is
true.
This issue is observed in a riscv64 kernel with
CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, when we run ftrace selftest
trace_marker_raw.tc, we get the weird log: for cases where the id is
1..100, the number of data field is 8*N, but once id exceeds 100, the
number of data field becomes 8*N+4:
# 1 buf: 58 00 00 00 80 5e d1 63 (number of data field is 8*1)
...
# a buf: 58 ... (number of data field is 8*2)
...
# 64 buf: 58 ... (number of data field is 8*13)
# 65 buf: 58 ... (number of data field is 8*13+4)
After applying this change, the number of data field keeps being 8*N+4
consistently.
Link: https://patch.msgid.link/20260607072431.125633-2-hui.wang@canonical.com
Fixes: 2271048d1b3b ("ring-buffer: Do 8 byte alignment for 64 bit that can not handle 4 byte align")
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 52c7dbccafedde..0f761bca5135de 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -255,7 +255,8 @@ unsigned ring_buffer_event_length(struct ring_buffer_event *event)
if (event->type_len > RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
return length;
length -= RB_EVNT_HDR_SIZE;
- if (length > RB_MAX_SMALL_DATA + sizeof(event->array[0]))
+ if (length > RB_MAX_SMALL_DATA + sizeof(event->array[0]) ||
+ RB_FORCE_8BYTE_ALIGNMENT)
length -= sizeof(event->array[0]);
return length;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0867/1266] net/tls: Consume empty data records in tls_sw_read_sock()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (865 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0866/1266] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0868/1266] net: usb: lan78xx: move functions to avoid forward definitions Greg Kroah-Hartman
` (131 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Sabrina Dubroca,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
[ Upstream commit 3be28e2c9cd0230cb51fd4967df095273afd3848 ]
A peer may send a zero-length TLS application_data record; TLS 1.3
explicitly permits these as a traffic-analysis countermeasure (RFC
8446, Section 5.1). After decryption such a record has full_len ==
0. tls_sw_read_sock() hands it to the read_actor, which has no
payload to consume and returns zero. The loop treats a zero return
as backpressure (used <= 0), requeues the skb at the head of
rx_list, and stops. rx_list is serviced head-first on the next
call, so the empty record is dequeued, fails the same way, and is
requeued again; every later record on the connection is blocked
behind it.
tls_sw_recvmsg() does not stall on this: a zero-length data record
copies nothing and falls through to consume_skb(). Mirror that in
the read_sock() path by recognizing an empty data record before
the actor runs, consuming it, and continuing.
Fixes: 662fbcec32f4 ("net/tls: implement ->read_sock()")
Signed-off-by: Chuck Lever <cel@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20260630191551.875664-1-cel@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 89f01227ca5bf3..39021fab3c5965 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2392,6 +2392,17 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
goto read_sock_requeue;
}
+ /* An empty data record (legal in TLS 1.3) gives a zero
+ * read_actor return, indistinguishable from the consumer
+ * stalling; the used <= 0 path would requeue it at the
+ * head of rx_list and block all later records. Consume it
+ * here instead.
+ */
+ if (rxm->full_len == 0) {
+ consume_skb(skb);
+ continue;
+ }
+
used = read_actor(desc, skb, rxm->offset, rxm->full_len);
if (used <= 0) {
if (!copied)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0868/1266] net: usb: lan78xx: move functions to avoid forward definitions
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (866 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0867/1266] net/tls: Consume empty data records in tls_sw_read_sock() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0869/1266] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
` (130 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleksij Rempel, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <o.rempel@pengutronix.de>
[ Upstream commit 39aa1d620d10cdd276f4728da50f136dbe939643 ]
Move following functions to avoid forward declarations in the code:
- lan78xx_start_hw()
- lan78xx_stop_hw()
- lan78xx_flush_fifo()
- lan78xx_start_tx_path()
- lan78xx_stop_tx_path()
- lan78xx_flush_tx_fifo()
- lan78xx_start_rx_path()
- lan78xx_stop_rx_path()
- lan78xx_flush_rx_fifo()
These functions will be used in an upcoming PHYlink migration patch.
No modifications to the functionality of the code are made.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20241204084142.1152696-4-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 60444706aa17 ("net: usb: lan78xx: disable VLAN filter in promiscuous mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/lan78xx.c | 300 +++++++++++++++++++-------------------
1 file changed, 150 insertions(+), 150 deletions(-)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index f5bcf150fd9ed3..36a7ece093ae23 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -817,6 +817,156 @@ static void lan78xx_update_stats(struct lan78xx_net *dev)
usb_autopm_put_interface(dev->intf);
}
+static int lan78xx_start_hw(struct lan78xx_net *dev, u32 reg, u32 hw_enable)
+{
+ return lan78xx_update_reg(dev, reg, hw_enable, hw_enable);
+}
+
+static int lan78xx_stop_hw(struct lan78xx_net *dev, u32 reg, u32 hw_enabled,
+ u32 hw_disabled)
+{
+ unsigned long timeout;
+ bool stopped = true;
+ int ret;
+ u32 buf;
+
+ /* Stop the h/w block (if not already stopped) */
+
+ ret = lan78xx_read_reg(dev, reg, &buf);
+ if (ret < 0)
+ return ret;
+
+ if (buf & hw_enabled) {
+ buf &= ~hw_enabled;
+
+ ret = lan78xx_write_reg(dev, reg, buf);
+ if (ret < 0)
+ return ret;
+
+ stopped = false;
+ timeout = jiffies + HW_DISABLE_TIMEOUT;
+ do {
+ ret = lan78xx_read_reg(dev, reg, &buf);
+ if (ret < 0)
+ return ret;
+
+ if (buf & hw_disabled)
+ stopped = true;
+ else
+ msleep(HW_DISABLE_DELAY_MS);
+ } while (!stopped && !time_after(jiffies, timeout));
+ }
+
+ ret = stopped ? 0 : -ETIME;
+
+ return ret;
+}
+
+static int lan78xx_flush_fifo(struct lan78xx_net *dev, u32 reg, u32 fifo_flush)
+{
+ return lan78xx_update_reg(dev, reg, fifo_flush, fifo_flush);
+}
+
+static int lan78xx_start_tx_path(struct lan78xx_net *dev)
+{
+ int ret;
+
+ netif_dbg(dev, drv, dev->net, "start tx path");
+
+ /* Start the MAC transmitter */
+
+ ret = lan78xx_start_hw(dev, MAC_TX, MAC_TX_TXEN_);
+ if (ret < 0)
+ return ret;
+
+ /* Start the Tx FIFO */
+
+ ret = lan78xx_start_hw(dev, FCT_TX_CTL, FCT_TX_CTL_EN_);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+static int lan78xx_stop_tx_path(struct lan78xx_net *dev)
+{
+ int ret;
+
+ netif_dbg(dev, drv, dev->net, "stop tx path");
+
+ /* Stop the Tx FIFO */
+
+ ret = lan78xx_stop_hw(dev, FCT_TX_CTL, FCT_TX_CTL_EN_, FCT_TX_CTL_DIS_);
+ if (ret < 0)
+ return ret;
+
+ /* Stop the MAC transmitter */
+
+ ret = lan78xx_stop_hw(dev, MAC_TX, MAC_TX_TXEN_, MAC_TX_TXD_);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+/* The caller must ensure the Tx path is stopped before calling
+ * lan78xx_flush_tx_fifo().
+ */
+static int lan78xx_flush_tx_fifo(struct lan78xx_net *dev)
+{
+ return lan78xx_flush_fifo(dev, FCT_TX_CTL, FCT_TX_CTL_RST_);
+}
+
+static int lan78xx_start_rx_path(struct lan78xx_net *dev)
+{
+ int ret;
+
+ netif_dbg(dev, drv, dev->net, "start rx path");
+
+ /* Start the Rx FIFO */
+
+ ret = lan78xx_start_hw(dev, FCT_RX_CTL, FCT_RX_CTL_EN_);
+ if (ret < 0)
+ return ret;
+
+ /* Start the MAC receiver*/
+
+ ret = lan78xx_start_hw(dev, MAC_RX, MAC_RX_RXEN_);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+static int lan78xx_stop_rx_path(struct lan78xx_net *dev)
+{
+ int ret;
+
+ netif_dbg(dev, drv, dev->net, "stop rx path");
+
+ /* Stop the MAC receiver */
+
+ ret = lan78xx_stop_hw(dev, MAC_RX, MAC_RX_RXEN_, MAC_RX_RXD_);
+ if (ret < 0)
+ return ret;
+
+ /* Stop the Rx FIFO */
+
+ ret = lan78xx_stop_hw(dev, FCT_RX_CTL, FCT_RX_CTL_EN_, FCT_RX_CTL_DIS_);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+/* The caller must ensure the Rx path is stopped before calling
+ * lan78xx_flush_rx_fifo().
+ */
+static int lan78xx_flush_rx_fifo(struct lan78xx_net *dev)
+{
+ return lan78xx_flush_fifo(dev, FCT_RX_CTL, FCT_RX_CTL_RST_);
+}
+
/* Loop until the read is completed with timeout called with phy_mutex held */
static int lan78xx_phy_wait_not_busy(struct lan78xx_net *dev)
{
@@ -2747,156 +2897,6 @@ static int lan78xx_urb_config_init(struct lan78xx_net *dev)
return result;
}
-static int lan78xx_start_hw(struct lan78xx_net *dev, u32 reg, u32 hw_enable)
-{
- return lan78xx_update_reg(dev, reg, hw_enable, hw_enable);
-}
-
-static int lan78xx_stop_hw(struct lan78xx_net *dev, u32 reg, u32 hw_enabled,
- u32 hw_disabled)
-{
- unsigned long timeout;
- bool stopped = true;
- int ret;
- u32 buf;
-
- /* Stop the h/w block (if not already stopped) */
-
- ret = lan78xx_read_reg(dev, reg, &buf);
- if (ret < 0)
- return ret;
-
- if (buf & hw_enabled) {
- buf &= ~hw_enabled;
-
- ret = lan78xx_write_reg(dev, reg, buf);
- if (ret < 0)
- return ret;
-
- stopped = false;
- timeout = jiffies + HW_DISABLE_TIMEOUT;
- do {
- ret = lan78xx_read_reg(dev, reg, &buf);
- if (ret < 0)
- return ret;
-
- if (buf & hw_disabled)
- stopped = true;
- else
- msleep(HW_DISABLE_DELAY_MS);
- } while (!stopped && !time_after(jiffies, timeout));
- }
-
- ret = stopped ? 0 : -ETIME;
-
- return ret;
-}
-
-static int lan78xx_flush_fifo(struct lan78xx_net *dev, u32 reg, u32 fifo_flush)
-{
- return lan78xx_update_reg(dev, reg, fifo_flush, fifo_flush);
-}
-
-static int lan78xx_start_tx_path(struct lan78xx_net *dev)
-{
- int ret;
-
- netif_dbg(dev, drv, dev->net, "start tx path");
-
- /* Start the MAC transmitter */
-
- ret = lan78xx_start_hw(dev, MAC_TX, MAC_TX_TXEN_);
- if (ret < 0)
- return ret;
-
- /* Start the Tx FIFO */
-
- ret = lan78xx_start_hw(dev, FCT_TX_CTL, FCT_TX_CTL_EN_);
- if (ret < 0)
- return ret;
-
- return 0;
-}
-
-static int lan78xx_stop_tx_path(struct lan78xx_net *dev)
-{
- int ret;
-
- netif_dbg(dev, drv, dev->net, "stop tx path");
-
- /* Stop the Tx FIFO */
-
- ret = lan78xx_stop_hw(dev, FCT_TX_CTL, FCT_TX_CTL_EN_, FCT_TX_CTL_DIS_);
- if (ret < 0)
- return ret;
-
- /* Stop the MAC transmitter */
-
- ret = lan78xx_stop_hw(dev, MAC_TX, MAC_TX_TXEN_, MAC_TX_TXD_);
- if (ret < 0)
- return ret;
-
- return 0;
-}
-
-/* The caller must ensure the Tx path is stopped before calling
- * lan78xx_flush_tx_fifo().
- */
-static int lan78xx_flush_tx_fifo(struct lan78xx_net *dev)
-{
- return lan78xx_flush_fifo(dev, FCT_TX_CTL, FCT_TX_CTL_RST_);
-}
-
-static int lan78xx_start_rx_path(struct lan78xx_net *dev)
-{
- int ret;
-
- netif_dbg(dev, drv, dev->net, "start rx path");
-
- /* Start the Rx FIFO */
-
- ret = lan78xx_start_hw(dev, FCT_RX_CTL, FCT_RX_CTL_EN_);
- if (ret < 0)
- return ret;
-
- /* Start the MAC receiver*/
-
- ret = lan78xx_start_hw(dev, MAC_RX, MAC_RX_RXEN_);
- if (ret < 0)
- return ret;
-
- return 0;
-}
-
-static int lan78xx_stop_rx_path(struct lan78xx_net *dev)
-{
- int ret;
-
- netif_dbg(dev, drv, dev->net, "stop rx path");
-
- /* Stop the MAC receiver */
-
- ret = lan78xx_stop_hw(dev, MAC_RX, MAC_RX_RXEN_, MAC_RX_RXD_);
- if (ret < 0)
- return ret;
-
- /* Stop the Rx FIFO */
-
- ret = lan78xx_stop_hw(dev, FCT_RX_CTL, FCT_RX_CTL_EN_, FCT_RX_CTL_DIS_);
- if (ret < 0)
- return ret;
-
- return 0;
-}
-
-/* The caller must ensure the Rx path is stopped before calling
- * lan78xx_flush_rx_fifo().
- */
-static int lan78xx_flush_rx_fifo(struct lan78xx_net *dev)
-{
- return lan78xx_flush_fifo(dev, FCT_RX_CTL, FCT_RX_CTL_RST_);
-}
-
static int lan78xx_reset(struct lan78xx_net *dev)
{
struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0869/1266] net: usb: lan78xx: disable VLAN filter in promiscuous mode
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (867 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0868/1266] net: usb: lan78xx: move functions to avoid forward definitions Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0870/1266] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
` (129 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enrico Pozzobon, Nicolai Buchwitz,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
[ Upstream commit 60444706aa17616efc03190d099ac347e28b3d0a ]
The hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames
whose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is
left enabled in promiscuous mode, so packet capture (e.g. tcpdump or
Wireshark) does not see tagged frames for unregistered VIDs.
Clear the filter while the interface is promiscuous and restore it from
NETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in
lan78xx_set_features() so netdev_update_features() cannot re-enable the
filter while promiscuous.
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/lan78xx.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 36a7ece093ae23..cc9fa1ae7c1c19 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1418,6 +1418,17 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param)
lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
}
+static void lan78xx_update_vlan_filter(struct lan78xx_priv *pdata,
+ struct net_device *netdev,
+ netdev_features_t features)
+{
+ if ((features & NETIF_F_HW_VLAN_CTAG_FILTER) &&
+ !(netdev->flags & IFF_PROMISC))
+ pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
+ else
+ pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
+}
+
static void lan78xx_set_multicast(struct net_device *netdev)
{
struct lan78xx_net *dev = netdev_priv(netdev);
@@ -1452,6 +1463,8 @@ static void lan78xx_set_multicast(struct net_device *netdev)
}
}
+ lan78xx_update_vlan_filter(pdata, dev->net, dev->net->features);
+
if (netdev_mc_count(dev->net)) {
struct netdev_hw_addr *ha;
int i;
@@ -2756,10 +2769,7 @@ static int lan78xx_set_features(struct net_device *netdev,
else
pdata->rfe_ctl &= ~RFE_CTL_VLAN_STRIP_;
- if (features & NETIF_F_HW_VLAN_CTAG_FILTER)
- pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
- else
- pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
+ lan78xx_update_vlan_filter(pdata, netdev, features);
spin_unlock_irqrestore(&pdata->rfe_ctl_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0870/1266] net/sched: cake: reject overhead values that underflow length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (868 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0869/1266] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0871/1266] octeontx2-pf: check DMAC extraction support before filtering Greg Kroah-Hartman
` (128 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius,
Toke Høiland-Jørgensen, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit b7f97cae7ec1b6c3c32843c42be218690d310467 ]
CAKE accepts signed overhead values and stores them in an s16, but the
adjusted packet length calculation uses unsigned arithmetic. A negative
effective length can therefore wrap to a large value.
Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model. A static
netlink lower bound is not enough because packets reaching CAKE can be
smaller than any reasonable manual-overhead allowance.
Fold the signed overhead adjustment into the existing datapath MPU clamp
so negative adjusted lengths are clamped before link-layer framing
adjustments.
Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_cake.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 0b85971165d2a3..ce9ee43e9ee2bc 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1382,10 +1382,7 @@ static u32 cake_calc_overhead(struct cake_sched_data *q, u32 len, u32 off)
if (q->min_netlen > len)
q->min_netlen = len;
- len += q->rate_overhead;
-
- if (len < q->rate_mpu)
- len = q->rate_mpu;
+ len = max((s32)len + q->rate_overhead, (s32)q->rate_mpu);
if (q->atm_mode == CAKE_ATM_ATM) {
len += 47;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0871/1266] octeontx2-pf: check DMAC extraction support before filtering
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (869 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0870/1266] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0872/1266] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
` (127 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suman Ghosh, Nitin Shetty J,
Harshitha Ramamurthy, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Ghosh <sumang@marvell.com>
[ Upstream commit 235acadd310533ba386ae61ad155b72bee381559 ]
Currently, configuring a VF MAC address via the PF (e.g., 'ip link
set <pf> vf 0 mac <mac>') blindly attempts to install a DMAC-based
hardware filter. However, the hardware parser profile might not
support DMAC extraction.
Check if the hardware parsing profile supports DMAC extraction
before adding the filter. Additionally, emit a warning message
to inform the operator if the MAC filter installation fails due
to missing DMAC extraction support. Update config->mac only
after hardware programming succeeds in otx2_set_vf_mac().
Fixes: f0c2982aaf98 ("octeontx2-pf: Add support for SR-IOV management functions")
Signed-off-by: Suman Ghosh <sumang@marvell.com>
Signed-off-by: Nitin Shetty J <nshettyj@marvell.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/20260702033451.2969880-1-nshettyj@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/marvell/octeontx2/nic/otx2_pf.c | 43 ++++++++++++++++---
1 file changed, 37 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index a41ca759ce77fb..c4f5635284ef6f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -2361,10 +2361,42 @@ EXPORT_SYMBOL(otx2_ioctl);
static int otx2_do_set_vf_mac(struct otx2_nic *pf, int vf, const u8 *mac)
{
+ struct npc_get_field_status_req *freq;
+ struct npc_get_field_status_rsp *frsp;
struct npc_install_flow_req *req;
int err;
mutex_lock(&pf->mbox.lock);
+
+ /* Skip installing the DMAC filter if the hardware parser profile
+ * does not support DMAC extraction.
+ */
+ freq = otx2_mbox_alloc_msg_npc_get_field_status(&pf->mbox);
+ if (!freq) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ freq->field = NPC_DMAC;
+ err = otx2_sync_mbox_msg(&pf->mbox);
+ if (err)
+ goto out;
+
+ frsp = (struct npc_get_field_status_rsp *)otx2_mbox_get_rsp
+ (&pf->mbox.mbox, 0, &freq->hdr);
+ if (IS_ERR(frsp)) {
+ err = PTR_ERR(frsp);
+ goto out;
+ }
+
+ if (!frsp->enable) {
+ netdev_warn(pf->netdev,
+ "VF %d MAC filter not installed: DMAC extraction not supported by parser profile\n",
+ vf);
+ err = -EOPNOTSUPP;
+ goto out;
+ }
+
req = otx2_mbox_alloc_msg_npc_install_flow(&pf->mbox);
if (!req) {
err = -ENOMEM;
@@ -2403,13 +2435,12 @@ static int otx2_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
if (!is_valid_ether_addr(mac))
return -EINVAL;
- config = &pf->vf_configs[vf];
- ether_addr_copy(config->mac, mac);
-
ret = otx2_do_set_vf_mac(pf, vf, mac);
- if (ret == 0)
- dev_info(&pdev->dev,
- "Load/Reload VF driver\n");
+ if (ret == 0) {
+ config = &pf->vf_configs[vf];
+ ether_addr_copy(config->mac, mac);
+ dev_info(&pdev->dev, "Load/Reload VF driver\n");
+ }
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0872/1266] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (870 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0871/1266] octeontx2-pf: check DMAC extraction support before filtering Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0873/1266] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
` (126 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zero Day Initiative, Eric Dumazet,
Ido Schimmel, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7b19c0f81ed1fdaec6bc522569be367199a9edf3 ]
A race condition exists between device teardown (inetdev_destroy) and
incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free
in the IGMP timer callback.
During device destruction, inetdev_destroy() drops the primary reference
to in_device, which can drop its refcount to 0. The actual freeing of
in_device memory is deferred via RCU (using call_rcu()).
Concurrently, igmp_rcv() runs under RCU read lock and obtains the
in_device pointer. Because the memory is RCU-protected, CPU-0 can safely
dereference in_device even if its refcount has hit 0.
However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it
attempts to acquire a reference using in_dev_hold(). This increments the
refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning.
Since the in_device memory is still scheduled to be freed after the RCU
grace period (as the free callback does not check the refcount again),
the device is freed while the timer is still armed. When the timer
expires, it accesses the freed memory, causing a kernel panic.
Fix this by using refcount_inc_not_zero() (via a new helper
in_dev_hold_safe()) to prevent acquiring a reference if the device is
already being destroyed. If the refcount is 0, we do not arm the timer.
A similar issue in IPv6 MLD is fixed in a subsequent patch.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/inetdevice.h | 5 +++++
net/ipv4/igmp.c | 14 +++++++++-----
2 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index b157ff4f727fba..566f3c2b38928a 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -282,6 +282,11 @@ static inline void in_dev_put(struct in_device *idev)
#define __in_dev_put(idev) refcount_dec(&(idev)->refcnt)
#define in_dev_hold(idev) refcount_inc(&(idev)->refcnt)
+static inline bool in_dev_hold_safe(struct in_device *idev)
+{
+ return refcount_inc_not_zero(&idev->refcnt);
+}
+
#endif /* __KERNEL__ */
static __inline__ __be32 inet_make_mask(int logmask)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 9b3cb1cce2e515..732804f3a0aa35 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -232,16 +232,20 @@ static void igmp_gq_start_timer(struct in_device *in_dev)
return;
in_dev->mr_gq_running = 1;
- if (!mod_timer(&in_dev->mr_gq_timer, exp))
- in_dev_hold(in_dev);
+ if (in_dev_hold_safe(in_dev)) {
+ if (mod_timer(&in_dev->mr_gq_timer, exp))
+ in_dev_put(in_dev);
+ }
}
static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
{
- int tv = get_random_u32_below(delay);
+ if (in_dev_hold_safe(in_dev)) {
+ int tv = get_random_u32_below(delay);
- if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
- in_dev_hold(in_dev);
+ if (mod_timer(&in_dev->mr_ifc_timer, jiffies + tv + 2))
+ in_dev_put(in_dev);
+ }
}
static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0873/1266] ipv6: mcast: Replace locking comments with lockdep annotations.
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (871 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0872/1266] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0874/1266] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
` (125 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 818ae1a5ecb41d82ad180a99c39111f051894d90 ]
Commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface
mld data") added the same comments regarding locking to many functions.
Let's replace the comments with lockdep annotation, which is more helpful.
Note that we just remove the comment for mld_clear_zeros() and
mld_send_cr(), where mc_dereference() is used in the entry of the
function.
While at it, a comment for __ipv6_sock_mc_join() is moved back to the
correct place.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250702230210.3115355-3-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/mcast.c | 125 +++++++++++++++++++++++++++--------------------
1 file changed, 71 insertions(+), 54 deletions(-)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 5bd96298d3bb42..ddc2453a14b365 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -105,9 +105,9 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
-/*
- * socket join on multicast group
- */
+#define mc_assert_locked(idev) \
+ lockdep_assert_held(&(idev)->mc_lock)
+
#define mc_dereference(e, idev) \
rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
@@ -166,6 +166,9 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
return iv > 0 ? iv : 1;
}
+/*
+ * socket join on multicast group
+ */
static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
const struct in6_addr *addr, unsigned int mode)
{
@@ -664,12 +667,13 @@ bool inet6_mc_check(const struct sock *sk, const struct in6_addr *mc_addr,
return rv;
}
-/* called with mc_lock */
static void igmp6_group_added(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
char buf[MAX_ADDR_LEN];
+ mc_assert_locked(mc->idev);
+
if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
@@ -699,12 +703,13 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
mld_ifc_event(mc->idev);
}
-/* called with mc_lock */
static void igmp6_group_dropped(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
char buf[MAX_ADDR_LEN];
+ mc_assert_locked(mc->idev);
+
if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
@@ -725,14 +730,13 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
refcount_dec(&mc->mca_refcnt);
}
-/*
- * deleted ifmcaddr6 manipulation
- * called with mc_lock
- */
+/* deleted ifmcaddr6 manipulation */
static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
struct ifmcaddr6 *pmc;
+ mc_assert_locked(idev);
+
/* this is an "ifmcaddr6" for convenience; only the fields below
* are actually used. In particular, the refcnt and users are not
* used for management of the delete list. Using the same structure
@@ -766,13 +770,14 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
rcu_assign_pointer(idev->mc_tomb, pmc);
}
-/* called with mc_lock */
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
struct ip6_sf_list *psf, *sources, *tomb;
struct in6_addr *pmca = &im->mca_addr;
struct ifmcaddr6 *pmc, *pmc_prev;
+ mc_assert_locked(idev);
+
pmc_prev = NULL;
for_each_mc_tomb(idev, pmc) {
if (ipv6_addr_equal(&pmc->mca_addr, pmca))
@@ -809,11 +814,12 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
}
-/* called with mc_lock */
static void mld_clear_delrec(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *nextpmc;
+ mc_assert_locked(idev);
+
pmc = mc_dereference(idev->mc_tomb, idev);
RCU_INIT_POINTER(idev->mc_tomb, NULL);
@@ -870,13 +876,14 @@ static void ma_put(struct ifmcaddr6 *mc)
}
}
-/* called with mc_lock */
static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
const struct in6_addr *addr,
unsigned int mode)
{
struct ifmcaddr6 *mc;
+ mc_assert_locked(idev);
+
mc = kzalloc(sizeof(*mc), GFP_KERNEL);
if (!mc)
return NULL;
@@ -1046,46 +1053,51 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
return rv;
}
-/* called with mc_lock */
static void mld_gq_start_work(struct inet6_dev *idev)
{
unsigned long tv = get_random_u32_below(idev->mc_maxdelay);
+ mc_assert_locked(idev);
+
idev->mc_gq_running = 1;
if (!mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
in6_dev_hold(idev);
}
-/* called with mc_lock */
static void mld_gq_stop_work(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
idev->mc_gq_running = 0;
if (cancel_delayed_work(&idev->mc_gq_work))
__in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = get_random_u32_below(delay);
+ mc_assert_locked(idev);
+
if (!mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
in6_dev_hold(idev);
}
-/* called with mc_lock */
static void mld_ifc_stop_work(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
idev->mc_ifc_count = 0;
if (cancel_delayed_work(&idev->mc_ifc_work))
__in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = get_random_u32_below(delay);
+ mc_assert_locked(idev);
+
if (!mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
in6_dev_hold(idev);
}
@@ -1110,14 +1122,13 @@ static void mld_report_stop_work(struct inet6_dev *idev)
__in6_dev_put(idev);
}
-/*
- * IGMP handling (alias multicast ICMPv6 messages)
- * called with mc_lock
- */
+/* IGMP handling (alias multicast ICMPv6 messages) */
static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
{
unsigned long delay = resptime;
+ mc_assert_locked(ma->idev);
+
/* Do not start work for these addresses */
if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
@@ -1136,15 +1147,15 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
ma->mca_flags |= MAF_TIMER_RUNNING;
}
-/* mark EXCLUDE-mode sources
- * called with mc_lock
- */
+/* mark EXCLUDE-mode sources */
static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
struct ip6_sf_list *psf;
int i, scount;
+ mc_assert_locked(pmc->idev);
+
scount = 0;
for_each_psf_mclock(pmc, psf) {
if (scount == nsrcs)
@@ -1167,13 +1178,14 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
return true;
}
-/* called with mc_lock */
static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
struct ip6_sf_list *psf;
int i, scount;
+ mc_assert_locked(pmc->idev);
+
if (pmc->mca_sfmode == MCAST_EXCLUDE)
return mld_xmarksources(pmc, nsrcs, srcs);
@@ -1868,7 +1880,6 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)
-/* called with mc_lock */
static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
int type, int gdeleted, int sdeleted,
int crsend)
@@ -1882,6 +1893,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
struct mld2_report *pmr;
unsigned int mtu;
+ mc_assert_locked(idev);
+
if (pmc->mca_flags & MAF_NOREPORT)
return skb;
@@ -2000,12 +2013,13 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
return skb;
}
-/* called with mc_lock */
static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
{
struct sk_buff *skb = NULL;
int type;
+ mc_assert_locked(idev);
+
if (!pmc) {
for_each_mc_mclock(idev, pmc) {
if (pmc->mca_flags & MAF_NOREPORT)
@@ -2027,10 +2041,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
mld_sendpack(skb);
}
-/*
- * remove zero-count source records from a source filter list
- * called with mc_lock
- */
+/* remove zero-count source records from a source filter list */
static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *idev)
{
struct ip6_sf_list *psf_prev, *psf_next, *psf;
@@ -2054,7 +2065,6 @@ static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *i
}
}
-/* called with mc_lock */
static void mld_send_cr(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
@@ -2218,13 +2228,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
goto out;
}
-/* called with mc_lock */
static void mld_send_initial_cr(struct inet6_dev *idev)
{
- struct sk_buff *skb;
struct ifmcaddr6 *pmc;
+ struct sk_buff *skb;
int type;
+ mc_assert_locked(idev);
+
if (mld_in_v1_mode(idev))
return;
@@ -2271,13 +2282,14 @@ static void mld_dad_work(struct work_struct *work)
in6_dev_put(idev);
}
-/* called with mc_lock */
static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
- const struct in6_addr *psfsrc)
+ const struct in6_addr *psfsrc)
{
struct ip6_sf_list *psf, *psf_prev;
int rv = 0;
+ mc_assert_locked(pmc->idev);
+
psf_prev = NULL;
for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
@@ -2314,7 +2326,6 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
return rv;
}
-/* called with mc_lock */
static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
int delta)
@@ -2326,6 +2337,8 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
+ mc_assert_locked(idev);
+
for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
@@ -2367,15 +2380,14 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
return err;
}
-/*
- * Add multicast single-source filter to the interface list
- * called with mc_lock
- */
+/* Add multicast single-source filter to the interface list */
static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
- const struct in6_addr *psfsrc)
+ const struct in6_addr *psfsrc)
{
struct ip6_sf_list *psf, *psf_prev;
+ mc_assert_locked(pmc->idev);
+
psf_prev = NULL;
for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
@@ -2398,11 +2410,12 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
return 0;
}
-/* called with mc_lock */
static void sf_markstate(struct ifmcaddr6 *pmc)
{
- struct ip6_sf_list *psf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
+ struct ip6_sf_list *psf;
+
+ mc_assert_locked(pmc->idev);
for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
@@ -2415,14 +2428,15 @@ static void sf_markstate(struct ifmcaddr6 *pmc)
}
}
-/* called with mc_lock */
static int sf_setstate(struct ifmcaddr6 *pmc)
{
- struct ip6_sf_list *psf, *dpsf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
+ struct ip6_sf_list *psf, *dpsf;
int qrv = pmc->idev->mc_qrv;
int new_in, rv;
+ mc_assert_locked(pmc->idev);
+
rv = 0;
for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
@@ -2481,10 +2495,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
return rv;
}
-/*
- * Add multicast source filter list to the interface list
- * called with mc_lock
- */
+/* Add multicast source filter list to the interface list */
static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
int delta)
@@ -2496,6 +2507,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
+ mc_assert_locked(idev);
+
for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
@@ -2541,11 +2554,12 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
return err;
}
-/* called with mc_lock */
static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf, *nextpsf;
+ mc_assert_locked(pmc->idev);
+
for (psf = mc_dereference(pmc->mca_tomb, pmc->idev);
psf;
psf = nextpsf) {
@@ -2565,11 +2579,12 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
}
-/* called with mc_lock */
static void igmp6_join_group(struct ifmcaddr6 *ma)
{
unsigned long delay;
+ mc_assert_locked(ma->idev);
+
if (ma->mca_flags & MAF_NOREPORT)
return;
@@ -2616,9 +2631,10 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
return err;
}
-/* called with mc_lock */
static void igmp6_leave_group(struct ifmcaddr6 *ma)
{
+ mc_assert_locked(ma->idev);
+
if (mld_in_v1_mode(ma->idev)) {
if (ma->mca_flags & MAF_LAST_REPORTER) {
igmp6_send(&ma->mca_addr, ma->idev->dev,
@@ -2663,9 +2679,10 @@ static void mld_ifc_work(struct work_struct *work)
in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_ifc_event(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
if (mld_in_v1_mode(idev))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0874/1266] ipv6: mcast: Fix potential UAF in MLD delayed work
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (872 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0873/1266] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0875/1266] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
` (124 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Ido Schimmel,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e ]
A race condition exists between device teardown and incoming MLD query
processing, leading to a Use-After-Free in the MLD delayed work.
During device destruction, the primary reference to inet6_dev is dropped,
which can drop its refcount to 0. The actual freeing of inet6_dev memory
is deferred via RCU.
Concurrently, the packet receive path runs under RCU read lock and obtains
the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can
safely dereference inet6_dev even if its refcount has hit 0.
However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it
attempts to acquire a reference using in6_dev_hold(). This increments the
refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning.
Since the inet6_dev memory is still scheduled to be freed after the RCU
grace period, the device is freed while the work is still scheduled.
When the work runs, it accesses the freed memory, causing a kernel panic.
Fix this by using refcount_inc_not_zero() (via a new helper
in6_dev_hold_safe()) to prevent acquiring a reference if the device is
already being destroyed. If the refcount is 0, we do not schedule the work.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 5 +++++
net/ipv6/mcast.c | 40 ++++++++++++++++++++++++++++------------
2 files changed, 33 insertions(+), 12 deletions(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index e596f57f680dc1..0a9b055a8ee114 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -411,6 +411,11 @@ static inline void in6_dev_hold(struct inet6_dev *idev)
refcount_inc(&idev->refcnt);
}
+static inline bool in6_dev_hold_safe(struct inet6_dev *idev)
+{
+ return refcount_inc_not_zero(&idev->refcnt);
+}
+
/* called with rcu_read_lock held */
static inline bool ip6_ignore_linkdown(const struct net_device *dev)
{
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index ddc2453a14b365..dacd9e32e96eff 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1060,8 +1060,10 @@ static void mld_gq_start_work(struct inet6_dev *idev)
mc_assert_locked(idev);
idev->mc_gq_running = 1;
- if (!mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_gq_stop_work(struct inet6_dev *idev)
@@ -1079,8 +1081,10 @@ static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
mc_assert_locked(idev);
- if (!mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_ifc_stop_work(struct inet6_dev *idev)
@@ -1098,8 +1102,10 @@ static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
mc_assert_locked(idev);
- if (!mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_dad_stop_work(struct inet6_dev *idev)
@@ -1385,18 +1391,23 @@ static void mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
void igmp6_event_query(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
+ bool put = false;
if (!idev || idev->dead)
goto out;
spin_lock_bh(&idev->mc_query_lock);
- if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS) {
+ if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS &&
+ in6_dev_hold_safe(idev)) {
__skb_queue_tail(&idev->mc_query_queue, skb);
- if (!mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
- in6_dev_hold(idev);
+ if (mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
+ put = true;
skb = NULL;
}
spin_unlock_bh(&idev->mc_query_lock);
+
+ if (put)
+ in6_dev_put(idev);
out:
kfree_skb(skb);
}
@@ -1553,18 +1564,23 @@ static void mld_query_work(struct work_struct *work)
void igmp6_event_report(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
+ bool put = false;
if (!idev || idev->dead)
goto out;
spin_lock_bh(&idev->mc_report_lock);
- if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS) {
+ if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS &&
+ in6_dev_hold_safe(idev)) {
__skb_queue_tail(&idev->mc_report_queue, skb);
- if (!mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
- in6_dev_hold(idev);
+ if (mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
+ put = true;
skb = NULL;
}
spin_unlock_bh(&idev->mc_report_lock);
+
+ if (put)
+ in6_dev_put(idev);
out:
kfree_skb(skb);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0875/1266] ipvs: pass parsed transport offset to state handlers
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (873 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0874/1266] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0876/1266] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
` (123 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Julian Anastasov,
Florian Westphal, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866 ]
IPVS callers already parse the packet into struct ip_vs_iphdr before
updating connection state. For IPv6 this records the real
transport-header offset after extension headers in iph.len.
Pass this parsed transport offset through ip_vs_set_state() and the
protocol state_transition() callback so protocol handlers can use the
same packet context as scheduling and NAT handling. This patch only
changes the common callback plumbing and adapts the protocol callback
signatures; TCP and SCTP start using the value in follow-up patches.
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 2500fa3958b1 ("ipvs: use parsed transport offset in TCP state lookup")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_vs.h | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 10 +++++-----
net/netfilter/ipvs/ip_vs_proto_sctp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 ++-
5 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index d70268cf1af82e..08b90d33acdc65 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -516,7 +516,8 @@ struct ip_vs_protocol {
void (*state_transition)(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd);
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len);
int (*register_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 34c4648ba36ece..b0fa8f04f7a1c3 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -220,10 +220,10 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
static inline void
ip_vs_set_state(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd, unsigned int iph_len)
{
if (likely(pd->pp->state_transition))
- pd->pp->state_transition(cp, direction, skb, pd);
+ pd->pp->state_transition(cp, direction, skb, pd, iph_len);
}
static inline int
@@ -625,7 +625,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
ip_vs_in_stats(cp, skb);
/* set state */
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph->len);
/* transmit the first SYN packet */
ret = cp->packet_xmit(skb, cp, pd->pp, iph);
@@ -1306,7 +1306,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
after_nat:
ip_vs_out_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd, iph->len);
skb->ipvs_property = 1;
if (!(cp->flags & IP_VS_CONN_F_NFCT))
ip_vs_notrack(skb);
@@ -2051,7 +2051,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
IP_VS_DBG_PKT(11, af, pp, skb, iph.off, "Incoming packet");
ip_vs_in_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph.len);
if (cp->packet_xmit)
ret = cp->packet_xmit(skb, cp, pp, &iph);
/* do not touch skb anymore */
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 63c78a1f3918a7..394367b7b38879 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -468,7 +468,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
sctp_state_transition(struct ip_vs_conn *cp, int direction,
- const struct sk_buff *skb, struct ip_vs_proto_data *pd)
+ const struct sk_buff *skb, struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
spin_lock_bh(&cp->lock);
set_sctp_state(pd, cp, direction, skb);
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index ede4fa3b63f52d..dc8394383c148e 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -580,7 +580,8 @@ set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
tcp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
struct tcphdr _tcph, *th;
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index ffbebda547fc10..dbd4155bb07526 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -445,7 +445,8 @@ static const char * udp_state_name(int state)
static void
udp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
if (unlikely(!pd)) {
pr_err("UDP no ns data\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0876/1266] ipvs: use parsed transport offset in TCP state lookup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (874 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0875/1266] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0877/1266] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
` (122 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Julian Anastasov, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 2500fa3958b1ba51c2b065e39db1b04dfa7e23a2 ]
TCP state handling reparses the skb to find the TCP header. For IPv6 it
uses sizeof(struct ipv6hdr), while the surrounding IPVS code already
parsed the packet with ip_vs_fill_iph_skb() and has the real
transport-header offset in iph.len.
This makes TCP state handling look at the wrong bytes when an IPv6
packet carries extension headers. Use the parsed transport offset passed
down from ip_vs_set_state() when reading the TCP header.
For IPv4 and for IPv6 packets without extension headers, the passed
offset matches the previous value.
Fixes: 0bbdd42b7efa6 ("IPVS: Extend protocol DNAT/SNAT and state handlers")
Link: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_proto_tcp.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index dc8394383c148e..b382810156b2c6 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -585,13 +585,7 @@ tcp_state_transition(struct ip_vs_conn *cp, int direction,
{
struct tcphdr _tcph, *th;
-#ifdef CONFIG_IP_VS_IPV6
- int ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
-#else
- int ihl = ip_hdrlen(skb);
-#endif
-
- th = skb_header_pointer(skb, ihl, sizeof(_tcph), &_tcph);
+ th = skb_header_pointer(skb, iph_len, sizeof(_tcph), &_tcph);
if (th == NULL)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0877/1266] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (875 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0876/1266] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0878/1266] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
` (121 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Julian Anastasov, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 6b335af0d0d1ff44ac579d106953bf19299e5233 ]
When an ICMP Fragmentation Needed error is received for a tunneled IPVS
connection, ip_vs_in_icmp() recomputes the MTU that the original packet
can use by subtracting the tunnel overhead from the reported next-hop
MTU.
The current code always subtracts sizeof(struct iphdr), which is only
the IPIP overhead. For GUE and GRE tunnels, ipvs_udp_decap() and
ipvs_gre_decap() already compute the additional tunnel header length,
but that value is scoped to the decapsulation block and is lost before
the ICMP_FRAG_NEEDED handling. As a result, the ICMP error sent back to
the client advertises an MTU that is too large, so PMTUD can fail to
converge for GUE/GRE-tunneled real servers.
With a reported next-hop MTU of 1400, a GUE tunnel currently returns
1380 to the client. The correct value is 1368:
1400 - sizeof(struct iphdr) - sizeof(struct udphdr) -
sizeof(struct guehdr)
Hoist the tunnel header length into the main ip_vs_in_icmp() scope and
subtract sizeof(struct iphdr) + ulen in the Fragmentation Needed path.
The IPIP path keeps ulen as 0, so its existing 1400 - 20 = 1380 result
is unchanged.
Fixes: 508f744c0de3 ("ipvs: strip udp tunnel headers from icmp errors")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 3f7a535ff0fa ("ipvs: ensure inner headers in ICMP errors are in headroom")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index b0fa8f04f7a1c3..e6b0053672759f 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1585,6 +1585,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
bool tunnel, new_cp = false;
union nf_inet_addr *raddr;
char *outer_proto = "IPIP";
+ int ulen = 0;
*related = 1;
@@ -1649,7 +1650,6 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Error for our tunnel must arrive at LOCAL_IN */
(skb_rtable(skb)->rt_flags & RTCF_LOCAL)) {
__u8 iproto;
- int ulen;
/* Non-first fragment has no UDP/GRE header */
if (unlikely(cih->frag_off & htons(IP_OFFSET)))
@@ -1754,8 +1754,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (dest_dst)
mtu = dst_mtu(dest_dst->dst_cache);
}
- if (mtu > 68 + sizeof(struct iphdr))
- mtu -= sizeof(struct iphdr);
+ if (mtu > 68 + sizeof(struct iphdr) + ulen)
+ mtu -= sizeof(struct iphdr) + ulen;
info = htonl(mtu);
}
/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0878/1266] ipvs: ensure inner headers in ICMP errors are in headroom
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (876 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0877/1266] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0879/1266] s390/zcrypt: Remove the empty file Greg Kroah-Hartman
` (120 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Anastasov, Florian Westphal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
[ Upstream commit 3f7a535ff0fa627a0132803e4c2f903ceffcbc1c ]
Sashiko points out that after stripping the outer headers
with pskb_pull() we should ensure the inner IP headers
in ICMP errors from tunnels are present in the skb headroom
for functions like ipv4_update_pmtu(), icmp_send() and
IP_VS_DBG().
Also, add more checks for the length of the inner headers.
Fixes: f2edb9f7706d ("ipvs: implement passive PMTUD for IPIP packets")
Link: https://sashiko.dev/#/patchset/20260702073430.67680-1-zhaoyz24%40mails.tsinghua.edu.cn
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_core.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index e6b0053672759f..7aa323b1566422 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1585,6 +1585,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
bool tunnel, new_cp = false;
union nf_inet_addr *raddr;
char *outer_proto = "IPIP";
+ unsigned int hlen_ipip;
int ulen = 0;
*related = 1;
@@ -1622,9 +1623,10 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Now find the contained IP header */
offset += sizeof(_icmph);
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
- if (cih == NULL)
+ if (!(cih && cih->version == 4 && cih->ihl >= 5))
return NF_ACCEPT; /* The packet looks wrong, ignore */
raddr = (union nf_inet_addr *)&cih->daddr;
+ hlen_ipip = cih->ihl * 4;
/* Special case for errors for IPIP/UDP/GRE tunnel packets */
tunnel = false;
@@ -1640,9 +1642,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Only for known tunnel */
if (!dest || dest->tun_type != IP_VS_CONN_F_TUNNEL_TYPE_IPIP)
return NF_ACCEPT;
- offset += cih->ihl * 4;
+ offset += hlen_ipip;
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
- if (cih == NULL)
+ if (!(cih && cih->version == 4 && cih->ihl >= 5))
return NF_ACCEPT; /* The packet looks wrong, ignore */
tunnel = true;
} else if ((cih->protocol == IPPROTO_UDP || /* Can be UDP encap */
@@ -1654,7 +1656,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Non-first fragment has no UDP/GRE header */
if (unlikely(cih->frag_off & htons(IP_OFFSET)))
return NF_ACCEPT;
- offset2 = offset + cih->ihl * 4;
+ offset2 = offset + hlen_ipip;
if (cih->protocol == IPPROTO_UDP) {
ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,
raddr, &iproto);
@@ -1723,6 +1725,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
}
if (tunnel) {
+ unsigned int hlen_orig = cih->ihl * 4;
__be32 info = ic->un.gateway;
__u8 type = ic->type;
__u8 code = ic->code;
@@ -1739,6 +1742,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
goto ignore_tunnel;
offset2 -= ihl + sizeof(_icmph);
skb_reset_network_header(skb);
+ /* Ensure the IP header is present in headroom */
+ if (!pskb_may_pull(skb, hlen_ipip))
+ goto ignore_tunnel;
IP_VS_DBG(12, "ICMP for %s %pI4->%pI4: mtu=%u\n",
outer_proto, &ip_hdr(skb)->saddr,
&ip_hdr(skb)->daddr, mtu);
@@ -1754,8 +1760,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (dest_dst)
mtu = dst_mtu(dest_dst->dst_cache);
}
- if (mtu > 68 + sizeof(struct iphdr) + ulen)
- mtu -= sizeof(struct iphdr) + ulen;
+ if (mtu > 68 + hlen_ipip + ulen)
+ mtu -= hlen_ipip + ulen;
info = htonl(mtu);
}
/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
@@ -1764,6 +1770,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (pskb_pull(skb, offset2) == NULL)
goto ignore_tunnel;
skb_reset_network_header(skb);
+ /* Ensure the IP header is present in headroom */
+ if (!pskb_may_pull(skb, hlen_orig))
+ goto ignore_tunnel;
IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
type, code, ntohl(info));
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0879/1266] s390/zcrypt: Remove the empty file
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (877 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0878/1266] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0880/1266] cifs: validate DFS referral string offsets Greg Kroah-Hartman
` (119 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rongguang Wei, Holger Dengler,
Vasily Gorbik, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rongguang Wei <weirongguang@kylinos.cn>
[ Upstream commit 575f87b9d4882b0d621192fdd754d7e09dbd5789 ]
The files has no real user because CEX2 and CEX3 device drivers
are removed, also remove these empty files.
Fixes: 5ac8c72462cd ("s390/zcrypt: remove CEX2 and CEX3 device drivers")
Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/zcrypt_cex2a.c | 0
drivers/s390/crypto/zcrypt_cex2a.h | 0
drivers/s390/crypto/zcrypt_cex2c.c | 0
drivers/s390/crypto/zcrypt_cex2c.h | 0
4 files changed, 0 insertions(+), 0 deletions(-)
delete mode 100644 drivers/s390/crypto/zcrypt_cex2a.c
delete mode 100644 drivers/s390/crypto/zcrypt_cex2a.h
delete mode 100644 drivers/s390/crypto/zcrypt_cex2c.c
delete mode 100644 drivers/s390/crypto/zcrypt_cex2c.h
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
deleted file mode 100644
index e69de29bb2d1d6..00000000000000
diff --git a/drivers/s390/crypto/zcrypt_cex2a.h b/drivers/s390/crypto/zcrypt_cex2a.h
deleted file mode 100644
index e69de29bb2d1d6..00000000000000
diff --git a/drivers/s390/crypto/zcrypt_cex2c.c b/drivers/s390/crypto/zcrypt_cex2c.c
deleted file mode 100644
index e69de29bb2d1d6..00000000000000
diff --git a/drivers/s390/crypto/zcrypt_cex2c.h b/drivers/s390/crypto/zcrypt_cex2c.h
deleted file mode 100644
index e69de29bb2d1d6..00000000000000
--
2.53.0
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0880/1266] cifs: validate DFS referral string offsets
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (878 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0879/1266] s390/zcrypt: Remove the empty file Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0881/1266] SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED Greg Kroah-Hartman
` (118 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Steve French,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 027a84ac6b50c12ef767c15abfc58aa865820e9e ]
parse_dfs_referrals() validates that the response header and referral
array fit in the received buffer, but each referral also contains string
offsets supplied by the server.
Those offsets are used to compute the DfsPath and NetworkAddress string
pointers without checking whether they still point inside the response
buffer. A malformed referral can therefore make the computed pointer
exceed the end of the buffer. The resulting negative max_len is then
passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it
to kstrndup() as a size_t, allowing strnlen() to read out of bounds.
Validate each string offset before deriving the string pointer.
Fixes: 4ecce920e13a ("CIFS: move DFS response parsing out of SMB1 code")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/misc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
index a31b4e912719cc..46ca8f326c9813 100644
--- a/fs/smb/client/misc.c
+++ b/fs/smb/client/misc.c
@@ -1039,6 +1039,10 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
/* copy DfsPath */
+ if (le16_to_cpu(ref->DfsPathOffset) > data_end - (char *)ref) {
+ rc = -EINVAL;
+ goto parse_DFS_referrals_exit;
+ }
temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
max_len = data_end - temp;
node->path_name = cifs_strndup_from_utf16(temp, max_len,
@@ -1049,6 +1053,10 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
}
/* copy link target UNC */
+ if (le16_to_cpu(ref->NetworkAddressOffset) > data_end - (char *)ref) {
+ rc = -EINVAL;
+ goto parse_DFS_referrals_exit;
+ }
temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
max_len = data_end - temp;
node->node_name = cifs_strndup_from_utf16(temp, max_len,
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0881/1266] SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (879 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0880/1266] cifs: validate DFS referral string offsets Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0882/1266] SUNRPC: pin upper rpc_clnt across the TLS connect_worker Greg Kroah-Hartman
` (117 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Michael Nemanov,
Anna Schumaker, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 29bacb096d43bd04062f6655e50ceeed27fe6d2f ]
xs_tcp_tls_setup_socket() creates a temporary "lower" rpc_clnt with
rpc_create() to drive the inner TLS handshake, then waits for
XPRT_LOCKED on its xprt with TASK_KILLABLE so a stuck handshake can
be aborted by signal. When the wait is interrupted, the function
jumps to out_unlock without releasing lower_clnt. The success path
and the out_close error path both call
rpc_shutdown_client(lower_clnt); only the killed-wait path skips it,
leaking the clnt and its underlying xprt.
Call rpc_shutdown_client() on this path before joining out_unlock.
xprt_release_write() is not needed here because XPRT_LOCKED was
never acquired.
Fixes: 26e8bfa30dac ("SUNRPC/TLS: Lock the lower_xprt during the tls handshake")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Michael Nemanov <michael.nemanov@vastdata.com>
Reviewed-by: Michael Nemanov <michael.nemanov@vastdata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtsock.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 3660ef26471129..204641c71c7d82 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2713,8 +2713,11 @@ static void xs_tcp_tls_setup_socket(struct work_struct *work)
lower_xprt = rcu_dereference(lower_clnt->cl_xprt);
rcu_read_unlock();
- if (wait_on_bit_lock(&lower_xprt->state, XPRT_LOCKED, TASK_KILLABLE))
+ if (wait_on_bit_lock(&lower_xprt->state, XPRT_LOCKED, TASK_KILLABLE)) {
+ /* XPRT_LOCKED was never acquired. */
+ rpc_shutdown_client(lower_clnt);
goto out_unlock;
+ }
status = xs_tls_handshake_sync(lower_xprt, &upper_xprt->xprtsec);
if (status) {
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0882/1266] SUNRPC: pin upper rpc_clnt across the TLS connect_worker
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (880 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0881/1266] SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0883/1266] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
` (116 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Nemanov, Chuck Lever,
Anna Schumaker, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 46bc86c833956219bbfd246c1ffd832a479c5199 ]
The TLS connect path has a use-after-free: nothing pins the
upper rpc_clnt across the delayed connect_worker. xs_connect()
stores task->tk_client in sock_xprt::clnt as a raw pointer
and queues the worker; for TLS-secured transports that worker
is xs_tcp_tls_setup_socket(), which reads several fields out
of the saved pointer (cl_timeout, cl_program, cl_prog,
cl_vers, cl_cred, cl_stats) to construct the args for the
inner handshake rpc_clnt.
The xprt does not reference the rpc_clnt; the rpc_clnt
references the xprt. xs_destroy() does cancel the
connect_worker, but it runs only when the xprt's refcount
drops to zero, which cannot happen until the rpc_clnt
releases its cl_xprt reference in rpc_free_client_work().
When a TLS handshake fails fatally (for example, an mTLS
mount whose client cert does not match the server), the
connecting task is woken with -EACCES and exits, the mount
caller invokes rpc_shutdown_client(), and the upper rpc_clnt
is freed before the queued connect_worker fires.
xs_tcp_tls_setup_socket() then dereferences the freed clnt,
producing the refcount_t underflow Michael Nemanov reported.
Take a reference on the upper rpc_clnt in xs_connect() for
TLS transports via a new rpc_hold_client() helper, and drop
it in the connect_worker's exit path with rpc_release_client().
The xprt_lock_connect() / xprt_unlock_connect() pairing
already serialises xs_connect() with xs_tcp_tls_setup_socket(),
so the take and release are balanced one-for-one.
The non-TLS connect worker (xs_tcp_setup_socket) never reads
sock_xprt::clnt, so leave that path alone and avoid the
clnt-holds-xprt-holds-clnt cycle that would otherwise prevent
xprt destruction.
Reported-by: Michael Nemanov <michael.nemanov@vastdata.com>
Closes: https://lore.kernel.org/linux-nfs/40e3d522-dfcf-4fc1-9c55-b5e81f1536d5@vastdata.com/
Fixes: 75eb6af7acdf ("SUNRPC: Add a TCP-with-TLS RPC transport class")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Michael Nemanov <michael.nemanov@vastdata.com>
Reviewed-by: Michael Nemanov <michael.nemanov@vastdata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sunrpc/clnt.h | 1 +
net/sunrpc/clnt.c | 19 +++++++++++++++++--
net/sunrpc/xprtsock.c | 11 ++++++++++-
3 files changed, 28 insertions(+), 3 deletions(-)
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 17d84b3ee8a018..3c1fedb108bfec 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -186,6 +186,7 @@ int rpc_switch_client_transport(struct rpc_clnt *,
const struct rpc_timeout *);
void rpc_shutdown_client(struct rpc_clnt *);
+void rpc_hold_client(struct rpc_clnt *);
void rpc_release_client(struct rpc_clnt *);
void rpc_task_release_transport(struct rpc_task *);
void rpc_task_release_client(struct rpc_task *);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 63756607f63272..85cfd7b7c212a2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1016,8 +1016,23 @@ rpc_free_auth(struct rpc_clnt *clnt)
return NULL;
}
-/*
- * Release reference to the RPC client
+/**
+ * rpc_hold_client - acquire a reference on an rpc_clnt
+ * @clnt: rpc_clnt to pin
+ *
+ * Pairs with rpc_release_client().
+ */
+void rpc_hold_client(struct rpc_clnt *clnt)
+{
+ refcount_inc(&clnt->cl_count);
+}
+
+/**
+ * rpc_release_client - release a reference on an rpc_clnt
+ * @clnt: rpc_clnt to release
+ *
+ * Pairs with rpc_hold_client(). The rpc_clnt's resources are
+ * freed once its reference count drops to zero.
*/
void
rpc_release_client(struct rpc_clnt *clnt)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 204641c71c7d82..6263aa95e2ec20 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2751,6 +2751,7 @@ static void xs_tcp_tls_setup_socket(struct work_struct *work)
out_unlock:
current_restore_flags(pflags, PF_MEMALLOC);
upper_transport->clnt = NULL;
+ rpc_release_client(upper_clnt);
xprt_unlock_connect(upper_xprt, upper_transport);
return;
@@ -2798,7 +2799,15 @@ static void xs_connect(struct rpc_xprt *xprt, struct rpc_task *task)
} else
dprintk("RPC: xs_connect scheduled xprt %p\n", xprt);
- transport->clnt = task->tk_client;
+ /*
+ * Only the TLS connect_worker reads transport->clnt; pinning
+ * the upper rpc_clnt unconditionally would form a cycle with
+ * cl_xprt and prevent xprt destruction.
+ */
+ if (xprt->xprtsec.policy != RPC_XPRTSEC_NONE) {
+ rpc_hold_client(task->tk_client);
+ transport->clnt = task->tk_client;
+ }
queue_delayed_work(xprtiod_workqueue,
&transport->connect_worker,
delay);
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0883/1266] dm era: fix NULL pointer dereference in metadata_open()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (881 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 6.6 0882/1266] SUNRPC: pin upper rpc_clnt across the TLS connect_worker Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0884/1266] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
` (115 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Su Yue, Ming-Hung Tsai,
Mikulas Patocka, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 9ae672606c17891d90b282e3490b817620549599 ]
metadata_open() returns NULL when kzalloc_obj() fails, but the
caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL)
returns false, the NULL pointer is treated as a valid result
and later assigned to era->md, leading to a NULL pointer
dereference when the metadata is accessed.
Fix this by returning ERR_PTR(-ENOMEM) on allocation failure,
consistent with dm-cache-metadata.c, dm-thin-metadata.c, and
dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the
same pattern.
Fixes: eec40579d848 ("dm: add era target")
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Reviewed-by: Su Yue <glass.su@suse.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-era-target.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 6acfa5bf97a400..807d22c58189d9 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -810,8 +810,10 @@ static struct era_metadata *metadata_open(struct block_device *bdev,
int r;
struct era_metadata *md = kzalloc(sizeof(*md), GFP_KERNEL);
- if (!md)
- return NULL;
+ if (!md) {
+ DMERR("could not allocate metadata struct");
+ return ERR_PTR(-ENOMEM);
+ }
md->bdev = bdev;
md->block_size = block_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0884/1266] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (882 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0883/1266] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0885/1266] selftests/net: fix EVP_MD_CTX leak in tcp_mmap Greg Kroah-Hartman
` (114 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Timur Tabi, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <ttabi@nvidia.com>
[ Upstream commit d38f8bd771c4999b797d7074b348cf201414bd34 ]
Compare against -EDEADLK, which is what ww_mutex_lock() actually
returns and what every other deadlock check in this file already uses.
Function regulator_lock_two() acquires two regulators via
regulator_lock_nested() -> ww_mutex_lock(). On contention,
ww_mutex_lock() returns -EDEADLK, which is the caller's signal to drop
the lock it holds and retry the acquisition in the canonical order.
However, regulator_lock_two() tests the return value against -EDEADLOCK
rather than -EDEADLK. On most architectures, EDEADLK and EDEADLOCK are
the same value, so the comparison happens to be correct and the bug is
invisible. But on MIPS, SPARC, and PowerPC, those two errors have
different values. The test is wrong: a genuine -EDEADLK backoff no
longer matches -EDEADLOCK, so instead of unlocking and retrying, the
code falls into WARN_ON(ret) and returns with only one of the two
regulators locked.
In practice, this is a bug only on MIPS, because the regulator core is
not built or used on the other two platforms.
In general, EDEADLK is preferred over EDEADLOCK for new code.
Fixes: cba6cfdc7c3f ("regulator: core: Avoid lockdep reports when resolving supplies")
Signed-off-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260708235722.2953579-1-ttabi@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 0eadf6dc30e231..3f352d1c64b7d1 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -228,7 +228,7 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
ret = regulator_lock_nested(rdev1, ww_ctx);
WARN_ON(ret);
ret = regulator_lock_nested(rdev2, ww_ctx);
- if (ret != -EDEADLOCK) {
+ if (ret != -EDEADLK) {
WARN_ON(ret);
goto exit;
}
@@ -244,7 +244,7 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
swap(held, contended);
ret = regulator_lock_nested(contended, ww_ctx);
- if (ret != -EDEADLOCK) {
+ if (ret != -EDEADLK) {
WARN_ON(ret);
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0885/1266] selftests/net: fix EVP_MD_CTX leak in tcp_mmap
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (883 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0884/1266] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0886/1266] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
` (113 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Yan, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
[ Upstream commit f4ef35efbb49527293309f668ea73ec5de9b8e7a ]
In tcp_mmap.c, both child_thread() and main() allocate an EVP_MD_CTX
via EVP_MD_CTX_new() when integrity checking is enabled, but neither
function releases the context. child_thread() misses the free in its
common cleanup block, and main() returns without freeing the context.
This results in a SHA256 context leak on every run that uses the
‑i (integrity) option. Add the missing EVP_MD_CTX_free() calls to
the appropriate cleanup paths to fix the leak.
Fixes: 5c5945dc695c ("selftests/net: Add SHA256 computation over data sent in tcp_mmap")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Link: https://patch.msgid.link/20260702025949.442523-1-wangyan01@kylinos.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/tcp_mmap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/testing/selftests/net/tcp_mmap.c b/tools/testing/selftests/net/tcp_mmap.c
index 4fcce5150850dd..2544ae35d07a83 100644
--- a/tools/testing/selftests/net/tcp_mmap.c
+++ b/tools/testing/selftests/net/tcp_mmap.c
@@ -313,6 +313,8 @@ void *child_thread(void *arg)
tcp_info_get_rcv_mss(fd));
}
error:
+ if (ctx)
+ EVP_MD_CTX_free(ctx);
munmap(buffer, buffer_sz);
close(fd);
if (zflg)
@@ -606,6 +608,8 @@ int main(int argc, char *argv[])
EVP_DigestFinal_ex(ctx, digest, &digest_len);
send(fd, digest, (size_t)SHA256_DIGEST_LENGTH, 0);
}
+ if (ctx)
+ EVP_MD_CTX_free(ctx);
close(fd);
munmap(buffer, buffer_sz);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0886/1266] net/mlx5: Fix L3 tunnel entropy refcount leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (884 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0885/1266] selftests/net: fix EVP_MD_CTX leak in tcp_mmap Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0887/1266] octeontx2-af: fix VF bringup affecting PF promiscuous state Greg Kroah-Hartman
` (112 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Simon Horman,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027 ]
mlx5_tun_entropy_refcount_inc() counts both VXLAN and L2-to-L3
tunnel reformat entries as entropy-enabling users. The matching
decrement path only handled VXLAN, leaving L2-to-L3 tunnel entries
counted after release.
Handle MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL in
mlx5_tun_entropy_refcount_dec() as well so the enabling entry
refcount remains balanced.
Fixes: f828ca6a2fb6 ("net/mlx5e: Add support for hw encapsulation of MPLS over UDP")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260703141423.1723-1-lirongqing@baidu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
index 4571c56ec3c9b2..97f6097d4c705f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
@@ -176,7 +176,8 @@ void mlx5_tun_entropy_refcount_dec(struct mlx5_tun_entropy *tun_entropy,
int reformat_type)
{
mutex_lock(&tun_entropy->lock);
- if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_VXLAN)
+ if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_VXLAN ||
+ reformat_type == MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL)
tun_entropy->num_enabling_entries--;
else if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_NVGRE &&
--tun_entropy->num_disabling_entries == 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0887/1266] octeontx2-af: fix VF bringup affecting PF promiscuous state
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (885 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0886/1266] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0888/1266] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
` (111 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harman Kalra, Nitin Shetty J,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harman Kalra <hkalra@marvell.com>
[ Upstream commit fabb881df322da25442f98d23f5fa371e3c78ec4 ]
Mbox handling of nix_set_rx_mode for a VF with promiscuous and
all_multi flags set to false causes deletion of the PF's promiscuous
and allmulti MCAM rules. This occurs because the APIs that
enable/disable these rules operate only on the PF, even when the
mbox request is made via a VF interface.
Guard both rvu_npc_enable_allmulti_entry() and
rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so
that a VF bringing up or tearing down its interface cannot inadvertently
clear the PF's MCAM rules.
Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature")
Signed-off-by: Harman Kalra <hkalra@marvell.com>
Signed-off-by: Nitin Shetty J <nshettyj@marvell.com>
Link: https://patch.msgid.link/20260702045616.3002773-2-nshettyj@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index 0703b0d8df783e..095c339166b515 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -4121,7 +4121,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
rvu_npc_install_allmulti_entry(rvu, pcifunc, nixlf,
pfvf->rx_chan_base);
} else {
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_allmulti_entry(rvu, pcifunc, nixlf, false);
}
@@ -4131,7 +4131,7 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
pfvf->rx_chan_base,
pfvf->rx_chan_cnt);
else
- if (!nix_rx_multicast)
+ if (!nix_rx_multicast && !is_vf(pcifunc))
rvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0888/1266] smb: client: fix overflow in passthrough ioctl bounds check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (886 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0887/1266] octeontx2-af: fix VF bringup affecting PF promiscuous state Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0889/1266] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Greg Kroah-Hartman
` (110 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Steve French,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit a4f27ad055392fa164f5649e89a3637b033c5fcc ]
smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload
before copying it to userspace.
The payload offset and length both come from 32-bit fields. The bounds
check currently adds OutputOffset and qi.input_buffer_length directly, so
the addition can wrap in 32-bit arithmetic before the result is compared
against the response buffer length.
A malicious server can use a large OutputOffset and a small OutputCount
to make the wrapped sum pass the bounds check. The later copy_to_user()
then reads from io_rsp + OutputOffset, outside the response buffer.
Use size_add() for the offset plus length check so overflow is treated as
out of bounds.
Fixes: 2b1116bbe898 ("CIFS: Use common error handling code in smb2_ioctl_query_info()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 084804bab5cfc7..8d152c3a24481d 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -1728,8 +1728,8 @@ smb2_ioctl_query_info(const unsigned int xid,
if (le32_to_cpu(io_rsp->OutputCount) < qi.input_buffer_length)
qi.input_buffer_length = le32_to_cpu(io_rsp->OutputCount);
if (qi.input_buffer_length > 0 &&
- le32_to_cpu(io_rsp->OutputOffset) + qi.input_buffer_length
- > rsp_iov[1].iov_len) {
+ size_add(le32_to_cpu(io_rsp->OutputOffset),
+ qi.input_buffer_length) > rsp_iov[1].iov_len) {
rc = -EFAULT;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0889/1266] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (887 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0888/1266] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0890/1266] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
` (109 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Ido Schimmel,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af upstream.
When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join()
returns an error without releasing the lag reference obtained by
the earlier mlxsw_sp_lag_get(). All other error paths in the
function jump to the cleanup label that ends with
mlxsw_sp_lag_put(), so this is a single missed release.
Fix the leak by replacing the bare 'return err' with a goto to the
existing error cleanup label, which will drop the reference safely.
Cc: stable@vger.kernel.org
Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260609083709.209743-1-vulab@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4427,7 +4427,7 @@ static int mlxsw_sp_port_lag_join(struct
err = mlxsw_sp_port_lag_index_get(mlxsw_sp, lag_id, &port_index);
if (err)
- return err;
+ goto err_lag_uppers_bridge_join;
err = mlxsw_sp_lag_uppers_bridge_join(mlxsw_sp_port, lag_dev,
extack);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0890/1266] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (888 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0889/1266] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0891/1266] vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter Greg Kroah-Hartman
` (108 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Ido Schimmel,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 21cf8dc478a49e8de039c2739b1646a774cb1944 upstream.
When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,
the error rollback loop does not correctly revert the preceding
replacements. The loop decrements the index but fails to update the
vr pointer, which still points to the VR that caused the failure. As
a result, the condition and the rollback call always operate on the
same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple
times on it while never rolling back the earlier VRs. Those VRs
continue to hold a reference to new_tree acquired via
mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.
Fix by reinitializing vr inside the error loop with the updated index:
vr = &mlxsw_sp->router->vrs[i];
so that the loop correctly iterates over all VRs that were actually
replaced.
Cc: stable@vger.kernel.org
Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260609084730.215732-1-vulab@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1018,6 +1018,7 @@ static int mlxsw_sp_vrs_lpm_tree_replace
err_tree_replace:
for (i--; i >= 0; i--) {
+ vr = &mlxsw_sp->router->vrs[i];
if (!mlxsw_sp_vr_lpm_tree_should_replace(vr, proto, new_id))
continue;
mlxsw_sp_vr_lpm_tree_replace(mlxsw_sp,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0891/1266] vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (889 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0890/1266] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0892/1266] ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put Greg Kroah-Hartman
` (107 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Tianci, Xie Yongji, Jason Wang,
Eugenio Pérez, Michael S. Tsirkin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Tianci <zhangtianci.1997@bytedance.com>
commit ae9c13b6fd79087cc5a216ee1649b6f012c2a238 upstream.
There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:
vduse_dev_read_iter():
lock(msg_lock);
dequeue_msg(send_list);
unlock(msg_lock);
vduse_dev_msg_sync():
wait_timeout() finish
lock(msg_lock);
check msg->complete is false
list_del(msg); <- double list_del() crash!
To fix this case, we shall ensure vduse_msg is on send_list or recv_list
outside the msg_lock critical section.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260226115550.1814-3-zhangtianci.1997@bytedance.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vdpa/vdpa_user/vduse_dev.c | 37 +++++++++++++++++++++++++++----------
1 file changed, 27 insertions(+), 10 deletions(-)
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -330,6 +330,7 @@ static ssize_t vduse_dev_read_iter(struc
struct file *file = iocb->ki_filp;
struct vduse_dev *dev = file->private_data;
struct vduse_dev_msg *msg;
+ struct vduse_dev_request req;
int size = sizeof(struct vduse_dev_request);
ssize_t ret;
@@ -341,12 +342,11 @@ static ssize_t vduse_dev_read_iter(struc
msg = vduse_dequeue_msg(&dev->send_list);
if (msg)
break;
+ spin_unlock(&dev->msg_lock);
- ret = -EAGAIN;
if (file->f_flags & O_NONBLOCK)
- goto unlock;
+ return -EAGAIN;
- spin_unlock(&dev->msg_lock);
ret = wait_event_interruptible_exclusive(dev->waitq,
!list_empty(&dev->send_list));
if (ret)
@@ -354,17 +354,34 @@ static ssize_t vduse_dev_read_iter(struc
spin_lock(&dev->msg_lock);
}
+
+ memcpy(&req, &msg->req, sizeof(req));
+ /*
+ * We must ensure vduse_msg is on send_list or recv_list before unlock
+ * dev->msg_lock. Because vduse_dev_msg_sync() may be timeout when we
+ * copy data to userspace, and will call list_del() for this msg.
+ */
+ vduse_enqueue_msg(&dev->recv_list, msg);
spin_unlock(&dev->msg_lock);
- ret = copy_to_iter(&msg->req, size, to);
- spin_lock(&dev->msg_lock);
+
+ ret = copy_to_iter(&req, size, to);
if (ret != size) {
+ /*
+ * Roll back: move msg back to send_list if still pending.
+ *
+ * NOTE:
+ * vduse_find_msg() must use req.request_id instead of `msg`.
+ * A malicious userspace may reply to this request, and wake up
+ * the caller, after which `msg` will have already been freed.
+ * And here vduse_find_msg() will return NULL then do nothing.
+ */
+ spin_lock(&dev->msg_lock);
+ msg = vduse_find_msg(&dev->recv_list, req.request_id);
+ if (msg)
+ vduse_enqueue_msg_head(&dev->send_list, msg);
+ spin_unlock(&dev->msg_lock);
ret = -EFAULT;
- vduse_enqueue_msg_head(&dev->send_list, msg);
- goto unlock;
}
- vduse_enqueue_msg(&dev->recv_list, msg);
-unlock:
- spin_unlock(&dev->msg_lock);
return ret;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0892/1266] ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (890 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0891/1266] vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0893/1266] ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc Greg Kroah-Hartman
` (106 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Liam Girdwood,
Bard Liao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit 3ad673e7139cf214afd24321a829aad6575f4163 upstream.
In sof_ipc4_bytes_put(), the copy size is derived from the old
data->size in the buffer rather than the incoming new data's size
field from ucontrol. If the new data has a different size, the copy
uses the wrong length: it may truncate valid data or copy stale bytes.
Fix by validating and using the incoming data's sof_abi_hdr.size from
ucontrol before copying.
Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc4-control.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/sound/soc/sof/ipc4-control.c
+++ b/sound/soc/sof/ipc4-control.c
@@ -407,6 +407,8 @@ static int sof_ipc4_bytes_put(struct snd
struct snd_soc_component *scomp = scontrol->scomp;
struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp);
struct sof_abi_hdr *data = cdata->data;
+ const struct sof_abi_hdr *new_hdr =
+ (const struct sof_abi_hdr *)ucontrol->value.bytes.data;
size_t size;
int ret;
@@ -417,15 +419,16 @@ static int sof_ipc4_bytes_put(struct snd
return -EINVAL;
}
- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */
- if (data->size > scontrol->max_size - sizeof(*data)) {
+ /* Validate the new data's size, not the old one */
+ if (new_hdr->size > scontrol->max_size - sizeof(*new_hdr)) {
dev_err_ratelimited(scomp->dev,
"data size too big %u bytes max is %zu\n",
- data->size, scontrol->max_size - sizeof(*data));
+ new_hdr->size,
+ scontrol->max_size - sizeof(*new_hdr));
return -EINVAL;
}
- size = data->size + sizeof(*data);
+ size = new_hdr->size + sizeof(*new_hdr);
/* copy from kcontrol */
memcpy(data, ucontrol->value.bytes.data, size);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0893/1266] ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (891 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0892/1266] ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0894/1266] ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get Greg Kroah-Hartman
` (105 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Liam Girdwood,
Bard Liao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit 8791977d7289f6e9d2b014f60a5455f053a7bc04 upstream.
In sof_ipc3_control_update(), the expected_size calculation uses
firmware-provided cdata->num_elems in arithmetic that could overflow
on 32-bit platforms, wrapping to a small value. This would allow the
cdata->rhdr.hdr.size comparison to pass with mismatched sizes,
potentially leading to out-of-bounds access in snd_sof_update_control.
Use check_mul_overflow() and check_add_overflow() to detect and reject
overflowed size calculations.
Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc3-control.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/sound/soc/sof/ipc3-control.c
+++ b/sound/soc/sof/ipc3-control.c
@@ -626,16 +626,28 @@ static void sof_ipc3_control_update(stru
return;
}
- expected_size = sizeof(struct sof_ipc_ctrl_data);
switch (cdata->type) {
case SOF_CTRL_TYPE_VALUE_CHAN_GET:
case SOF_CTRL_TYPE_VALUE_CHAN_SET:
- expected_size += cdata->num_elems *
- sizeof(struct sof_ipc_ctrl_value_chan);
+ if (check_mul_overflow((size_t)cdata->num_elems,
+ sizeof(struct sof_ipc_ctrl_value_chan),
+ &expected_size))
+ return;
+ if (check_add_overflow(expected_size,
+ sizeof(struct sof_ipc_ctrl_data),
+ &expected_size))
+ return;
break;
case SOF_CTRL_TYPE_DATA_GET:
case SOF_CTRL_TYPE_DATA_SET:
- expected_size += cdata->num_elems + sizeof(struct sof_abi_hdr);
+ if (check_add_overflow((size_t)cdata->num_elems,
+ sizeof(struct sof_abi_hdr),
+ &expected_size))
+ return;
+ if (check_add_overflow(expected_size,
+ sizeof(struct sof_ipc_ctrl_data),
+ &expected_size))
+ return;
break;
default:
return;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0894/1266] ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (892 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0893/1266] ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0895/1266] ASoC: SOF: topology: validate vendor array size before parsing Greg Kroah-Hartman
` (104 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Liam Girdwood,
Bard Liao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 upstream.
In sof_ipc3_bytes_put(), the size used for the memcpy is derived from
the old data->size already in the buffer, not the incoming new data's
size field. If the new data has a different size, the copy length is
wrong: it may truncate valid data or copy stale bytes.
Similarly, sof_ipc3_bytes_get() checks data->size against max_size
without accounting for the sizeof(struct sof_ipc_ctrl_data) offset
of the flex array within the allocation.
Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size
from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata)
from the bounds check to match the actual available space.
Fixes: 544ac8858f24 ("ASoC: SOF: Add bytes_get/put control IPC ops for IPC3")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-6-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc3-control.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/sound/soc/sof/ipc3-control.c
+++ b/sound/soc/sof/ipc3-control.c
@@ -315,10 +315,13 @@ static int sof_ipc3_bytes_get(struct snd
}
/* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */
- if (data->size > scontrol->max_size - sizeof(*data)) {
+ if (data->size > scontrol->max_size - sizeof(*cdata) -
+ sizeof(*data)) {
dev_err_ratelimited(scomp->dev,
"%u bytes of control data is invalid, max is %zu\n",
- data->size, scontrol->max_size - sizeof(*data));
+ data->size,
+ scontrol->max_size - sizeof(*cdata) -
+ sizeof(*data));
return -EINVAL;
}
@@ -336,6 +339,8 @@ static int sof_ipc3_bytes_put(struct snd
struct sof_ipc_ctrl_data *cdata = scontrol->ipc_control_data;
struct snd_soc_component *scomp = scontrol->scomp;
struct sof_abi_hdr *data = cdata->data;
+ const struct sof_abi_hdr *new_hdr =
+ (const struct sof_abi_hdr *)ucontrol->value.bytes.data;
size_t size;
if (scontrol->max_size > sizeof(ucontrol->value.bytes.data)) {
@@ -344,14 +349,18 @@ static int sof_ipc3_bytes_put(struct snd
return -EINVAL;
}
- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */
- if (data->size > scontrol->max_size - sizeof(*data)) {
- dev_err_ratelimited(scomp->dev, "data size too big %u bytes max is %zu\n",
- data->size, scontrol->max_size - sizeof(*data));
+ /* Validate the new data's size, not the old one */
+ if (new_hdr->size > scontrol->max_size - sizeof(*cdata) -
+ sizeof(*new_hdr)) {
+ dev_err_ratelimited(scomp->dev,
+ "data size too big %u bytes max is %zu\n",
+ new_hdr->size,
+ scontrol->max_size - sizeof(*cdata) -
+ sizeof(*new_hdr));
return -EINVAL;
}
- size = data->size + sizeof(*data);
+ size = new_hdr->size + sizeof(*new_hdr);
/* copy from kcontrol */
memcpy(data, ucontrol->value.bytes.data, size);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0895/1266] ASoC: SOF: topology: validate vendor array size before parsing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (893 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0894/1266] ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0896/1266] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
` (103 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 upstream.
sof_parse_token_sets() reads array->size while iterating over topology
private data. The loop condition only checks that some data remains, so a
malformed topology with a truncated trailing vendor array can make the
parser read the size field before a full vendor-array header is available.
Validate that the remaining private data contains a complete
snd_soc_tplg_vendor_array header before reading array->size.
The declared array size check also needs to remain signed. asize is an int,
but sizeof(*array) has type size_t, so comparing them directly promotes
negative asize values to unsigned and lets them pass the check,
as reported in the stable review thread reference below.
Cast sizeof(*array) to int when validating the declared array size. This
rejects negative, zero and otherwise too-small sizes before the parser
dispatches to the tuple-specific code.
Link: https://lore.kernel.org/stable/CANiDSCsjR5NHqu_Ui5cOqWdJgFqmYsQ9WR8O7m0WOhngaYXFpw@mail.gmail.com/t/#m9b3be379221e79327cc13fd71009287368ef4f23
Fixes: 215e5fe75881 ("ASoC: SOF: topology: reject invalid vendor array size in token parser")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260603-sof-topology-array-size-signed-v1-1-84f97879a4ef@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/topology.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -719,10 +719,13 @@ static int sof_parse_token_sets(struct s
int ret;
while (array_size > 0 && total < count * token_instance_num) {
+ if (array_size < (int)sizeof(*array))
+ return -EINVAL;
+
asize = le32_to_cpu(array->size);
/* validate asize */
- if (asize < sizeof(*array)) {
+ if (asize < (int)sizeof(*array)) {
dev_err(scomp->dev, "error: invalid array size 0x%x\n",
asize);
return -EINVAL;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0896/1266] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (894 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0895/1266] ASoC: SOF: topology: validate vendor array size before parsing Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0897/1266] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
` (102 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Simon Horman,
Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 20054869770c7df060c5ecee3e8bbf9029c47191 upstream.
qrtr_endpoint_post() validates an incoming packet with
if (!size || len != ALIGN(size, 4) + hdrlen)
goto err;
where size comes from the wire. On 32-bit, size_t is 32 bits and
ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
passes and skb_put_data(skb, data + hdrlen, size) writes past the
hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.
This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
Read in qrtr_endpoint_post"), which fixed only the 64-bit case.
Reject any size that cannot fit the buffer before the ALIGN.
Fixes: ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260611125455.2352279-1-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/af_qrtr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -496,7 +496,7 @@ int qrtr_endpoint_post(struct qrtr_endpo
if (cb->dst_port == QRTR_PORT_CTRL_LEGACY)
cb->dst_port = QRTR_PORT_CTRL;
- if (!size || len != ALIGN(size, 4) + hdrlen)
+ if (!size || size > len || len != ALIGN(size, 4) + hdrlen)
goto err;
if ((cb->type == QRTR_TYPE_NEW_SERVER ||
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0897/1266] net: atm: reject out-of-range traffic classes in QoS validation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (895 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0896/1266] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0898/1266] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
` (101 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Xin Liu, Zhengchuan Liang,
Ren Wei, Simon Horman, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <zcliangcn@gmail.com>
commit cdf19f380e46192e7084be559638aab1f6ed86a2 upstream.
Reject ATM traffic classes above ATM_ANYCLASS in check_tp().
SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so
accepting larger values leaves invalid traffic_class values in
vcc->qos.
That bad state later reaches pvc_info(), which indexes class_name[]
with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause
an out-of-bounds read when /proc/net/atm/pvc is read.
Tighten the existing QoS validation so invalid traffic_class values
are rejected at the point where user supplied QoS is accepted.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/58f02c6f73d9818fd5d2022e1116759fdde6116b.1780965530.git.zcliangcn@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/atm/common.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -720,6 +720,8 @@ static int atm_change_qos(struct atm_vcc
static int check_tp(const struct atm_trafprm *tp)
{
/* @@@ Should be merged with adjust_tp */
+ if (tp->traffic_class > ATM_ANYCLASS)
+ return -EINVAL;
if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS)
return 0;
if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr &&
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0898/1266] net: ife: require ETH_HLEN to be pullable in ife_decode()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (896 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0897/1266] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0899/1266] arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() Greg Kroah-Hartman
` (100 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Xin Liu, Yong Wang,
Ren Wei, Jakub Kicinski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong Wang <edragain@163.com>
commit 9406f6012b7343661efb516a11c62d4db2b62f75 upstream.
ife decode may return after making only the outer IFE header and
metadata pullable. The caller then passes the decapsulated packet to
eth_type_trans(), which expects the inner Ethernet header to be
accessible from the linear data area.
With a malformed IFE frame, the inner Ethernet header may still be
shorter than ETH_HLEN in the linear area, which can lead to a crash in
the original code.
Fix this by extending the pull check in ife_decode() so that the inner
Ethernet header is also guaranteed to be pullable before returning.
Fixes: ef6980b6becb ("introduce IFE action")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yong Wang <edragain@163.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20260610183814.1648888-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ife/ife.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -79,7 +79,7 @@ void *ife_decode(struct sk_buff *skb, u1
if (unlikely(ifehdrln < 2))
return NULL;
- if (unlikely(!pskb_may_pull(skb, total_pull)))
+ if (unlikely(!pskb_may_pull(skb, total_pull + ETH_HLEN)))
return NULL;
ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0899/1266] arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (897 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0898/1266] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0900/1266] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
` (99 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Catalin Marinas,
Fuad Tabba, James Morse, Marc Zyngier, Mark Brown, Oliver Upton,
Vladimir Murzin, Will Deacon
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit ae24f6b06e90681ec36b9c21c3f5c09618350f5a upstream.
The sve_save_state() and sve_load_state() functions take a 32-bit int
argument that describes whether to save/restore the FFR. Their assembly
implementations consume the entire 64-bit register containing this
32-bit value, and will attempt to save/restore the FFR if any bit of
that 64-bit register is non-zero.
Per the AAPCS64 parameter passing rules, the callee is responsible for
any necessary widening, and the upper 32-bits are permitted to contain
arbitrary values. If the upper 32 bits are non-zero, this could result
in an unexpected attempt to save/restore the FFR, and consequently could
lead to unexpected traps/undefs/faults.
In practice compilers are very unlikely to generate code where the upper
32-bits would be non-zero, but they are permitted to do so.
Fix this by only consuming the low 32 bits of the register, and update
comments accordingly.
The hyp code __sve_save_state() and __sve_restore_state() functions
don't have the same latent bug as they override the full 64-bit register
containing the argument.
Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Vladimir Murzin <vladimir.murzin@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/entry-fpsimd.S | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/kernel/entry-fpsimd.S
+++ b/arch/arm64/kernel/entry-fpsimd.S
@@ -38,10 +38,10 @@ SYM_FUNC_END(fpsimd_load_state)
*
* x0 - pointer to buffer for state
* x1 - pointer to storage for FPSR
- * x2 - Save FFR if non-zero
+ * w2 - Save FFR if non-zero
*/
SYM_FUNC_START(sve_save_state)
- sve_save 0, x1, x2, 3
+ sve_save 0, x1, w2, 3
ret
SYM_FUNC_END(sve_save_state)
@@ -50,10 +50,10 @@ SYM_FUNC_END(sve_save_state)
*
* x0 - pointer to buffer for state
* x1 - pointer to storage for FPSR
- * x2 - Restore FFR if non-zero
+ * w2 - Restore FFR if non-zero
*/
SYM_FUNC_START(sve_load_state)
- sve_load 0, x1, x2, 4
+ sve_load 0, x1, w2, 4
ret
SYM_FUNC_END(sve_load_state)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0900/1266] arm64: dts: qcom: sdm630: describe adsp_mem region properly
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (898 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0899/1266] arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0901/1266] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure Greg Kroah-Hartman
` (98 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ekansh Gupta, Dmitry Baryshkov,
Nickolay Goppen, Bjorn Andersson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolay Goppen <setotau@mainlining.org>
commit ce414263e9ebe5080381a50cbdf9065c29816202 upstream.
Downstream [1] this region is marked as shared, reusable and dynamic so
describe it that way.
[1]: https://github.com/xiaomi-sdm660/android_kernel_xiaomi_sdm660/blob/11-EAS/arch/arm/boot/dts/qcom/sdm660.dtsi#L448
Fixes: b190fb010664 ("arm64: dts: qcom: sdm630: Add sdm630 dts file")
Cc: stable@vger.kernel.org
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Nickolay Goppen <setotau@mainlining.org>
Link: https://lore.kernel.org/r/20260429-qcom-sdm660-cdsp-adsp-fastrpc-dts-fix-v5-4-16bc82e622ad@mainlining.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -491,9 +491,12 @@
no-map;
};
- adsp_mem: adsp-region@f6000000 {
- reg = <0x0 0xf6000000 0x0 0x800000>;
- no-map;
+ adsp_mem: adsp-region {
+ compatible = "shared-dma-pool";
+ alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
+ alignment = <0x0 0x400000>;
+ size = <0x0 0x800000>;
+ reusable;
};
qseecom_mem: qseecom-region@f6800000 {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0901/1266] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (899 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0900/1266] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0902/1266] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
` (97 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Matthew Rosato,
Claudio Imbrenda, Christian Borntraeger
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 7b69729046a4c58f4cb457184e5ac4aaa179bff4 upstream.
kvm_s390_gisc_register() registers the guest ISC before pinning
the guest interrupt forwarding pages and allocating the AISB bit.
If any of the later setup steps fails, the function unwinds the
pinned pages and other local state, but does not unregister the
GISC reference. Add the missing kvm_s390_gisc_unregister() to the
error unwind path.
Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260624061910.2794734-1-haoxiang_li2024@163.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/pci.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -330,6 +330,7 @@ unpin2:
unpin1:
unpin_user_page(aibv_page);
out:
+ kvm_s390_gisc_unregister(kvm, fib->fmt0.isc);
return rc;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0902/1266] KVM: arm64: vgic: Check the interrupt is still ours before migrating it
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (900 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0901/1266] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0903/1266] KVM: s390: pci: Fix handling of AIF enable without AISB Greg Kroah-Hartman
` (96 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Marc Zyngier
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe upstream.
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.
That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.
Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.
Fixes: 0919e84c0fc1 ("KVM: arm/arm64: vgic-new: Add IRQ sync/flush framework")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://patch.msgid.link/aiHnI1mu6SGQrgnz@v4bel
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -701,15 +701,16 @@ retry:
raw_spin_lock(&irq->irq_lock);
/*
- * If the affinity has been preserved, move the
- * interrupt around. Otherwise, it means things have
- * changed while the interrupt was unlocked, and we
- * need to replay this.
+ * If the interrupt is still ours and its affinity has
+ * been preserved, move it around. Otherwise, it means
+ * things have changed while the interrupt was unlocked
+ * (it may even have been taken off the list with its
+ * affinity left untouched), and we need to replay this.
*
* In all cases, we cannot trust the list not to have
* changed, so we restart from the beginning.
*/
- if (target_vcpu == vgic_target_oracle(irq)) {
+ if (irq->vcpu == vcpu && target_vcpu == vgic_target_oracle(irq)) {
struct vgic_cpu *new_cpu = &target_vcpu->arch.vgic_cpu;
list_del(&irq->ap_list);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0903/1266] KVM: s390: pci: Fix handling of AIF enable without AISB
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (901 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0902/1266] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0904/1266] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Greg Kroah-Hartman
` (95 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Farhan Ali, Matthew Rosato,
Christian Borntraeger
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Rosato <mjrosato@linux.ibm.com>
commit 3e3aa6da87d30a0064a17b836685cd43c90a3572 upstream.
When a guest seeks to register IRQs without a summary bit specified,
ensure that the associated GAITE then stores 0 for the guest AISB
location instead of virt_to_phys(page_address(NULL)).
Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
Cc: stable@vger.kernel.org
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/pci.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/arch/s390/kvm/pci.c
+++ b/arch/s390/kvm/pci.c
@@ -302,9 +302,14 @@ static int kvm_s390_pci_aif_enable(struc
gaite->gisc = fib->fmt0.isc;
gaite->count++;
- gaite->aisbo = fib->fmt0.aisbo;
- gaite->aisb = virt_to_phys(page_address(aisb_page) + (fib->fmt0.aisb &
- ~PAGE_MASK));
+ if (fib->fmt0.sum == 1) {
+ gaite->aisbo = fib->fmt0.aisbo;
+ gaite->aisb = virt_to_phys(page_address(aisb_page) +
+ (fib->fmt0.aisb & ~PAGE_MASK));
+ } else {
+ gaite->aisbo = 0;
+ gaite->aisb = 0;
+ }
aift->kzdev[zdev->aisb] = zdev->kzdev;
spin_unlock_irq(&aift->gait_lock);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0904/1266] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (902 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0903/1266] KVM: s390: pci: Fix handling of AIF enable without AISB Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0905/1266] fbdev: metronomefb: fix potential memory leak in metronomefb_probe() Greg Kroah-Hartman
` (94 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kai Huang, Sean Christopherson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 9285e4070df2c40585c3d7ec9571faa7a2b97e17 upstream.
Ignore KVM's internal "service pending PV EOI" request if the vCPU has
disabled PV EOIs since the request was made. Asserting that PV EOIs are
enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.
if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables
PV EOIs.
kernel BUG at arch/x86/kvm/lapic.c:3338!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]
kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb5/0xb40
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Modules linked in: kvm_intel kvm irqbypass
---[ end trace 0000000000000000 ]---
Fixes: ae7a2a3fb6f8 ("KVM: host side for eoi optimization")
Cc: stable@vger.kernel.org
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260624220516.3033391-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -3138,6 +3138,12 @@ static void apic_sync_pv_eoi_from_guest(
struct kvm_lapic *apic)
{
int vector;
+
+ if (unlikely(!pv_eoi_enabled(vcpu))) {
+ __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
+ return;
+ }
+
/*
* PV EOI state is derived from KVM_APIC_PV_EOI_PENDING in host
* and KVM_PV_EOI_ENABLED in guest memory as follows:
@@ -3149,8 +3155,6 @@ static void apic_sync_pv_eoi_from_guest(
* KVM_APIC_PV_EOI_PENDING is set, KVM_PV_EOI_ENABLED is unset:
* -> host enabled PV EOI, guest executed EOI.
*/
- BUG_ON(!pv_eoi_enabled(vcpu));
-
if (pv_eoi_test_and_clr_pending(vcpu))
return;
vector = apic_set_eoi(apic);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0905/1266] fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (903 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0904/1266] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0906/1266] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() Greg Kroah-Hartman
` (93 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Thomas Zimmermann,
Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 894632b862a39b3fe1cb5de06fbae86225ea64de upstream.
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/metronomefb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
@@ -645,12 +645,14 @@ static int metronomefb_probe(struct plat
info->flags = FBINFO_VIRTFB;
info->fbdefio = &metronomefb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_free_irq;
retval = fb_alloc_cmap(&info->cmap, 8, 0);
if (retval < 0) {
dev_err(&dev->dev, "Failed to allocate colormap\n");
- goto err_free_irq;
+ goto err_fbdefio;
}
/* set cmap */
@@ -673,6 +675,8 @@ static int metronomefb_probe(struct plat
err_cmap:
fb_dealloc_cmap(&info->cmap);
+err_fbdefio:
+ fb_deferred_io_cleanup(info);
err_free_irq:
board->cleanup(par);
err_csum_table:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0906/1266] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (904 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0905/1266] fbdev: metronomefb: fix potential memory leak in metronomefb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0907/1266] fbdev: hecubafb: fix potential memory leak in hecubafb_probe() Greg Kroah-Hartman
` (92 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Thomas Zimmermann,
Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c upstream.
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/broadsheetfb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -1072,12 +1072,14 @@ static int broadsheetfb_probe(struct pla
info->flags = FBINFO_VIRTFB;
info->fbdefio = &broadsheetfb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_vfree;
retval = fb_alloc_cmap(&info->cmap, 16, 0);
if (retval < 0) {
dev_err(&dev->dev, "Failed to allocate colormap\n");
- goto err_vfree;
+ goto err_fbdefio;
}
/* set cmap */
@@ -1121,6 +1123,8 @@ err_free_irq:
board->cleanup(par);
err_cmap:
fb_dealloc_cmap(&info->cmap);
+err_fbdefio:
+ fb_deferred_io_cleanup(info);
err_vfree:
vfree(videomemory);
err_fb_rel:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0907/1266] fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (905 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0906/1266] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0908/1266] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
` (91 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Thomas Zimmermann,
Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit cbef2a305a8a72969b86f96b7c07b86edde61aff upstream.
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/hecubafb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/video/fbdev/hecubafb.c
+++ b/drivers/video/fbdev/hecubafb.c
@@ -192,7 +192,9 @@ static int hecubafb_probe(struct platfor
info->flags = FBINFO_VIRTFB;
info->fbdefio = &hecubafb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_fbdefio;
retval = register_framebuffer(info);
if (retval < 0)
@@ -209,6 +211,8 @@ static int hecubafb_probe(struct platfor
return 0;
err_fbreg:
+ fb_deferred_io_cleanup(info);
+err_fbdefio:
framebuffer_release(info);
err_fballoc:
vfree(videomemory);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0908/1266] fbdev: sm712: Fix operator precedence in big_swap macro
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (906 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0907/1266] fbdev: hecubafb: fix potential memory leak in hecubafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0909/1266] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
` (90 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li RongQing, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
commit 5dbe5b65df0b0c0ec77492427c274b7b5011890e upstream.
The big_swap(p) macro was intended to swap bytes within 16-bit halves
of a 32-bit value. However, because the bitwise shift operators (<<, >>)
have higher precedence than the bitwise AND operator (&), the original
code failed to perform any shifting on the masked bits.
For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p &
(0xff00ff00 >> 8)', effectively neutralizing the intended swap.
Fix this by adding parentheses to ensure the bitwise AND is performed
before the shift, correctly implementing the byte swap logic.
Fixes: 1461d66728648 ("staging: sm7xxfb: merge sm712fb with fbdev")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/sm712.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/fbdev/sm712.h
+++ b/drivers/video/fbdev/sm712.h
@@ -101,7 +101,7 @@ struct modeinit {
#define mmio_addr 0x00800000
#define seqw17() smtc_seqw(0x17, 0x30)
#define big_pixel_depth(p, d) {if (p == 24) {p = 32; d = 32; } }
-#define big_swap(p) ((p & 0xff00ff00 >> 8) | (p & 0x00ff00ff << 8))
+#define big_swap(p) (((p & 0xff00ff00) >> 8) | ((p & 0x00ff00ff) << 8))
#else
#define pal_rgb(r, g, b, val) val
#define big_addr 0
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0909/1266] fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (907 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0908/1266] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0910/1266] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
` (89 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit df8c1101c9a08859da612b5d0a08d55d475522c6 upstream.
The function radeonfb_pci_register() allocates memory for modelist
(by calling radeon_check_modes() which calls fb_add_videomode()).
The memory is appended to info->modelist, but is not freed in subsequent
error paths. Fix this by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/aty/radeon_base.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -2474,6 +2474,7 @@ static int radeonfb_pci_register(struct
return 0;
err_unmap_fb:
iounmap(rinfo->fb_base);
+ fb_destroy_modelist(&info->modelist);
err_unmap_rom:
kfree(rinfo->mon1_EDID);
kfree(rinfo->mon2_EDID);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0910/1266] fbdev: i740fb: fix potential memory leak in i740fb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (908 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0909/1266] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0911/1266] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
` (88 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 5936063409af230a2c88b8700c47b89a19fd70b5 upstream.
In i740fb_probe(), the memory allocated in fb_videomode_to_modelist()
for modelist is not freed in the error paths. Fix that by calling
fb_destroy_modelist().
Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/i740fb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/i740fb.c
+++ b/drivers/video/fbdev/i740fb.c
@@ -1153,6 +1153,7 @@ err_reg_framebuffer:
fb_dealloc_cmap(&info->cmap);
err_alloc_cmap:
err_find_mode:
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
pci_iounmap(dev, par->regs);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0911/1266] fbdev: s3fb: fix potential memory leak in s3_pci_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (909 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0910/1266] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0912/1266] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
` (87 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 upstream.
In s3_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist()
Fixes: 86c0f043a737 ("s3fb: add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/s3fb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/s3fb.c
+++ b/drivers/video/fbdev/s3fb.c
@@ -1374,6 +1374,7 @@ err_reg_fb:
err_alloc_cmap:
err_find_mode:
#ifdef CONFIG_FB_S3_DDC
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
if (par->mmio)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0912/1266] fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (910 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0911/1266] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0913/1266] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
` (86 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 033e56fed09047ee63072e9f58789f40c1c7079d upstream.
Due to an incorrect goto label, memory allocated for modedb and modelist
in uvesafb_vbe_init() is not freed in some error paths. Fix this by
updating the goto label.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/uvesafb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1697,14 +1697,14 @@ static int uvesafb_probe(struct platform
i = uvesafb_vbe_init_mode(info);
if (i < 0) {
err = -EINVAL;
- goto out;
+ goto out_mode;
} else {
mode = &par->vbe_modes[i];
}
if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
err = -ENXIO;
- goto out;
+ goto out_mode;
}
uvesafb_init_info(info, mode);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0913/1266] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (911 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0912/1266] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0914/1266] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
` (85 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit bb019d755366cc3e777a12d4bf457ff289837370 upstream.
In tdfxfb_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not
freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/tdfxfb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/tdfxfb.c
+++ b/drivers/video/fbdev/tdfxfb.c
@@ -1551,6 +1551,7 @@ static int tdfxfb_probe(struct pci_dev *
out_err_iobase:
#ifdef CONFIG_FB_3DFX_I2C
+ fb_destroy_modelist(&info->modelist);
tdfxfb_delete_i2c_busses(default_par);
#endif
arch_phys_wc_del(default_par->wc_cookie);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0914/1266] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (912 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0913/1266] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0915/1266] fbdev: vesafb: fix memory leak in vesafb_probe() Greg Kroah-Hartman
` (84 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 6fcca16a2b19c37f60693c56cbc0c923364ff3ef upstream.
The memory allocated for modelist in fb_videomode_to_modelist() is not
freed in the subsequent error path.
Fix that by calling fb_destroy_modelist()
Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/carminefb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/carminefb.c
+++ b/drivers/video/fbdev/carminefb.c
@@ -589,6 +589,7 @@ static int alloc_carmine_fb(void __iomem
return 0;
err_dealloc_cmap:
+ fb_destroy_modelist(&info->modelist);
fb_dealloc_cmap(&info->cmap);
err_free_fb:
framebuffer_release(info);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0915/1266] fbdev: vesafb: fix memory leak in vesafb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (913 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0914/1266] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0916/1266] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
` (83 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Thomas Zimmermann,
Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit b15d708995c01bbffe7dcd634a31959f6805bed3 upstream.
Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to
caller; clarify ownership") the string returned from fb_get_options()
is expected to be freed by the caller. But the string is not freed in
vesafb_probe(). Fix that by freeing the option string after setup.
Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/vesafb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/vesafb.c
+++ b/drivers/video/fbdev/vesafb.c
@@ -255,6 +255,7 @@ static int vesafb_probe(struct platform_
/* ignore error return of fb_get_options */
fb_get_options("vesafb", &option);
vesafb_setup(option);
+ kfree(option);
if (si->orig_video_isVGA != VIDEO_TYPE_VLFB)
return -ENODEV;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0916/1266] fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (914 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0915/1266] fbdev: vesafb: fix memory leak in vesafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0917/1266] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
` (82 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 85f5e38c162bdf9dbbe197275d416402712f3707 upstream.
In nvidiafb_probe(), the memory allocated for modelist in
nvidia_set_fbinfo() is not freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/nvidia/nvidia.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -1418,6 +1418,7 @@ static int nvidiafb_probe(struct pci_dev
err_out_iounmap_fb:
iounmap(info->screen_base);
+ fb_destroy_modelist(&info->modelist);
err_out_free_base1:
fb_destroy_modedb(info->monspecs.modedb);
nvidia_delete_i2c_busses(par);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0917/1266] fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (915 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0916/1266] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0918/1266] ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get Greg Kroah-Hartman
` (81 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 7a35ec619d9af8ee128320975c1252b8ad65f1e8 upstream.
In trident_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/tridentfb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/tridentfb.c
+++ b/drivers/video/fbdev/tridentfb.c
@@ -1705,6 +1705,7 @@ static int trident_pci_probe(struct pci_
return 0;
out_unmap2:
+ fb_destroy_modelist(&info->modelist);
if (default_par->ddc_registered)
i2c_del_adapter(&default_par->ddc_adapter);
kfree(info->pixmap.addr);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0918/1266] ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (916 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0917/1266] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0919/1266] ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control Greg Kroah-Hartman
` (80 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Liam Girdwood,
Bard Liao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit fd46668d538993218eea19c6925c868ac0f2630c upstream.
The ipc_control_data buffer is allocated as kzalloc(max_size), where
max_size covers the entire struct sof_ipc_ctrl_data including its
flexible array payload. However, the bounds checks in bytes_ext_put
and _bytes_ext_get compared user data lengths against max_size
directly, ignoring that cdata->data sits at an offset of
sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.
This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past
the end of the heap buffer from unprivileged userspace via the ALSA TLV
kcontrol interface, and similarly allowed over-reading adjacent heap
data on the get path.
Fix all bounds checks to subtract sizeof(*cdata) from max_size so they
reflect the actual space available at the cdata->data offset. Also fix
the error-path restore in bytes_ext_put which wrote to cdata->data
instead of cdata, causing the same overflow.
Fixes: 67ec2a091630 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-7-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc3-control.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
--- a/sound/soc/sof/ipc3-control.c
+++ b/sound/soc/sof/ipc3-control.c
@@ -398,9 +398,17 @@ static int sof_ipc3_bytes_ext_put(struct
}
/* be->max is coming from topology */
- if (header.length > scontrol->max_size) {
- dev_err_ratelimited(scomp->dev, "Bytes data size %d exceeds max %zu\n",
- header.length, scontrol->max_size);
+ if (header.length > scontrol->max_size - sizeof(*cdata)) {
+ dev_err_ratelimited(scomp->dev, "Bytes data size %u exceeds max %zu\n",
+ header.length, scontrol->max_size - sizeof(*cdata));
+ return -EINVAL;
+ }
+
+ /* Ensure the data is large enough to contain the ABI header */
+ if (header.length < sizeof(struct sof_abi_hdr)) {
+ dev_err_ratelimited(scomp->dev,
+ "Bytes data size %u less than ABI header %zu\n",
+ header.length, sizeof(struct sof_abi_hdr));
return -EINVAL;
}
@@ -436,7 +444,7 @@ static int sof_ipc3_bytes_ext_put(struct
}
/* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */
- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) {
+ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) - sizeof(struct sof_abi_hdr)) {
dev_err_ratelimited(scomp->dev, "Mismatch in ABI data size (truncated?)\n");
goto err_restore;
}
@@ -452,7 +460,7 @@ static int sof_ipc3_bytes_ext_put(struct
err_restore:
/* If we have an issue, we restore the old, valid bytes control data */
if (scontrol->old_ipc_control_data) {
- memcpy(cdata->data, scontrol->old_ipc_control_data, scontrol->max_size);
+ memcpy(cdata, scontrol->old_ipc_control_data, scontrol->max_size);
kfree(scontrol->old_ipc_control_data);
scontrol->old_ipc_control_data = NULL;
}
@@ -491,10 +499,13 @@ static int _sof_ipc3_bytes_ext_get(struc
}
/* check data size doesn't exceed max coming from topology */
- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) {
- dev_err_ratelimited(scomp->dev, "User data size %d exceeds max size %zu\n",
+ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) -
+ sizeof(struct sof_abi_hdr)) {
+ dev_err_ratelimited(scomp->dev,
+ "User data size %u exceeds max size %zu\n",
cdata->data->size,
- scontrol->max_size - sizeof(struct sof_abi_hdr));
+ scontrol->max_size - sizeof(*cdata) -
+ sizeof(struct sof_abi_hdr));
return -EINVAL;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0919/1266] ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (917 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0918/1266] ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0920/1266] ASoC: mediatek: mt8192: Release reserved memory on cleanup Greg Kroah-Hartman
` (79 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Liam Girdwood,
Bard Liao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
commit 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e upstream.
In snd_sof_update_control(), firmware-provided cdata->num_elems is
checked against local_cdata->data->size but never against the actual
allocation size. If local_cdata->data->size was previously set to an
inconsistent value, the memcpy could write past the allocated buffer.
Add a bounds check to ensure num_elems fits within the available space
in the ipc_control_data allocation before copying.
Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260609083458.31193-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sof/ipc3-control.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/soc/sof/ipc3-control.c
+++ b/sound/soc/sof/ipc3-control.c
@@ -555,6 +555,15 @@ static void snd_sof_update_control(struc
return;
}
+ /* Verify the size fits within the allocation */
+ if (cdata->num_elems > scontrol->max_size - sizeof(*local_cdata) -
+ sizeof(*local_cdata->data)) {
+ dev_err(scomp->dev,
+ "cdata binary size %u exceeds buffer\n",
+ cdata->num_elems);
+ return;
+ }
+
/* copy the new binary data */
memcpy(local_cdata->data, cdata->data, cdata->num_elems);
} else if (cdata->num_elems != scontrol->num_channels) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0920/1266] ASoC: mediatek: mt8192: Release reserved memory on cleanup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (918 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0919/1266] ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0921/1266] ASoC: mediatek: mt8183: " Greg Kroah-Hartman
` (78 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 965e17ae6751c5d3302430c8ebd650e72d45a85f upstream.
The MT8192 AFE probe calls of_reserved_mem_device_init() and falls
back to preallocated buffers when no reserved memory region is
available. When the reserved memory assignment succeeds, however, the
driver never releases it.
Register a devm cleanup action after a successful reserved-memory
assignment so the assignment is released on probe failure and driver
unbind.
Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-1-1bb834d05b72@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
@@ -2171,6 +2171,11 @@ static const dai_register_cb dai_registe
mt8192_dai_memif_register,
};
+static void mt8192_afe_release_reserved_mem(void *data)
+{
+ of_reserved_mem_device_release(data);
+}
+
static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
{
struct mtk_base_afe *afe;
@@ -2201,6 +2206,10 @@ static int mt8192_afe_pcm_dev_probe(stru
if (ret) {
dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n");
afe->preallocate_buffers = true;
+ } else {
+ ret = devm_add_action_or_reset(dev, mt8192_afe_release_reserved_mem, dev);
+ if (ret)
+ return ret;
}
/* init audio related clock */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0921/1266] ASoC: mediatek: mt8183: Release reserved memory on cleanup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (919 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0920/1266] ASoC: mediatek: mt8192: Release reserved memory on cleanup Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0922/1266] ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback Greg Kroah-Hartman
` (77 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit bee65e00c0924ebecf97718d95dcf4a05ee36471 upstream.
The MT8183 AFE probe can assign reserved memory with
of_reserved_mem_device_init(), but the assignment is never released on
driver removal or later probe failures.
Register a devm cleanup action so the reserved memory assignment is
released consistently, matching newer Mediatek AFE drivers.
Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260527-asoc-mt8183-probe-cleanup-v1-1-4f4f5593c8d1@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
@@ -1085,6 +1085,11 @@ static const dai_register_cb dai_registe
mt8183_dai_memif_register,
};
+static void mt8183_afe_release_reserved_mem(void *data)
+{
+ of_reserved_mem_device_release(data);
+}
+
static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
{
struct mtk_base_afe *afe;
@@ -1111,6 +1116,12 @@ static int mt8183_afe_pcm_dev_probe(stru
if (ret) {
dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n");
afe->preallocate_buffers = true;
+ } else {
+ ret = devm_add_action_or_reset(dev,
+ mt8183_afe_release_reserved_mem,
+ dev);
+ if (ret)
+ return ret;
}
/* initial audio related clock */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0922/1266] ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (920 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0921/1266] ASoC: mediatek: mt8183: " Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0923/1266] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
` (76 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Val Packett,
Srinivas Kandagatla, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
commit 2e9261761b35f0b67b7487688cd1365f535be0b3 upstream.
When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf
and sets them to NULL under graph->lock. A late DSP buffer-done response
can race with this: graph_callback() passes the !graph->ar_graph guard
(not yet NULL), acquires the lock, but then dereferences a now-NULL buf
pointer to read buf[token].phys, crashing at virtual address 0x10.
Add a NULL check for buf inside the mutex-protected section in both the
write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and
read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail
out cleanly if buffers have already been freed.
This problem is only shown up recently while apr bus was updated to
process the commands per service rather from single global queue.
Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support")
Cc: Stable@vger.kernel.org
Assisted-by: Claude:claude-4-6-sonnet
Reported-by: Val Packett <val@packett.cool>
Closes: https://lore.kernel.org/all/133ced18-1aa9-475d-80d8-6120678bdde4@packett.cool/
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260616170257.9381-1-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/qcom/qdsp6/q6apm.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -533,6 +533,10 @@ static int graph_callback(struct gpr_res
token = hdr->token & APM_WRITE_TOKEN_MASK;
done = data->payload;
+ if (!graph->rx_data.buf) {
+ mutex_unlock(&graph->lock);
+ break;
+ }
phys = graph->rx_data.buf[token].phys;
mutex_unlock(&graph->lock);
/* token numbering starts at 0 */
@@ -567,6 +571,10 @@ static int graph_callback(struct gpr_res
client_event = APM_CLIENT_EVENT_DATA_READ_DONE;
mutex_lock(&graph->lock);
rd_done = data->payload;
+ if (!graph->tx_data.buf) {
+ mutex_unlock(&graph->lock);
+ break;
+ }
phys = graph->tx_data.buf[hdr->token].phys;
mutex_unlock(&graph->lock);
/* token numbering starts at 0 */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0923/1266] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (921 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0922/1266] ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0924/1266] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
` (75 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a upstream.
parse_dcc() treats data_end as an inclusive end pointer, but its only
caller passes data_limit = ib_ptr + datalen, which points one past the
last valid byte.
The newline search loop iterates while tmp <= data_end, so when no
newline is present, *tmp is read at tmp == data_end, one byte beyond
the region filled by skb_header_pointer().
irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is
capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte
is uninitialized or stale; if it contains an ASCII digit, simple_strtoul
will consume it and produce a wrong DCC IP or port in the conntrack
expectation. The extra allocation byte is also a fragile guard: if the
cap or allocation size changes, this becomes a real out-of-bounds read.
Change the loop and its post-loop check to use strict less-than,
consistent with the caller's exclusive-end convention. Update the
function comment accordingly.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_irc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -64,7 +64,7 @@ static const char *const dccprotos[] = {
/* tries to get the ip_addr and port out of a dcc command
* return value: -1 on failure, 0 on success
* data pointer to first byte of DCC command data
- * data_end pointer to last byte of dcc command data
+ * data_end one past end of data
* ip returns parsed ip of dcc command
* port returns parsed port of dcc command
* ad_beg_p returns pointer to first byte of addr data
@@ -82,10 +82,10 @@ static int parse_dcc(char *data, const c
/* Make sure we have a newline character within the packet boundaries
* because simple_strtoul parses until the first invalid character. */
- for (tmp = data; tmp <= data_end; tmp++)
+ for (tmp = data; tmp < data_end; tmp++)
if (*tmp == '\n')
break;
- if (tmp > data_end || *tmp != '\n')
+ if (tmp >= data_end || *tmp != '\n')
return -1;
*ad_beg_p = data;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0924/1266] netfilter: nfnl_cthelper: apply per-class values when updating policies
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (922 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0923/1266] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0925/1266] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
` (74 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Carlier, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
commit d738feccb98cb224ebabecb703e98f5008276bff upstream.
When a userspace conntrack helper with multiple expectation classes is
updated via nfnetlink, every class ends up with the first class's
max_expected and timeout values.
nfnl_cthelper_update_policy_all() validates each new policy into the
corresponding slot of the temporary new_policy array, but the second
loop that commits the values into the live helper dereferences
new_policy as a pointer instead of indexing it, so every iteration
reads new_policy[0] regardless of i. An update that changes per-class
values is silently collapsed onto class 0's values with no error
returned to userspace.
Index the temporary array by i in the commit loop so each class gets
its own validated values.
Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nfnetlink_cthelper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -348,8 +348,8 @@ static int nfnl_cthelper_update_policy_a
for (i = 0; i < helper->expect_class_max + 1; i++) {
policy = (struct nf_conntrack_expect_policy *)
&helper->expect_policy[i];
- policy->max_expected = new_policy->max_expected;
- policy->timeout = new_policy->timeout;
+ policy->max_expected = new_policy[i].max_expected;
+ policy->timeout = new_policy[i].timeout;
}
err:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0925/1266] netfilter: xt_cluster: reject template conntracks in hash match
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (923 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0924/1266] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0926/1266] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Greg Kroah-Hartman
` (73 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Pablo Neira Ayuso
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit 5feba91006ec92da57acc1cc2e34df623b98541e upstream.
xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
initialized conntrack and passes it to xt_cluster_hash().
This causes a state confusion bug when the raw table CT target attaches
a template conntrack to skb->_nfct before normal conntrack processing.
Templates carry IPS_TEMPLATE status but do not have a valid tuple for
hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
zeroed l3num field.
Reject template conntracks before hashing them. This matches existing
netfilter handling for template objects and avoids hashing incomplete
conntrack state.
Fixes: 0269ea493734 ("netfilter: xtables: add cluster match")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_cluster.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff *skb,
}
ct = nf_ct_get(skb, &ctinfo);
- if (ct == NULL)
+ if (!ct || nf_ct_is_template(ct))
return false;
if (ct->master)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0926/1266] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (924 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0925/1266] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0927/1266] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
` (72 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, Haoze Xie, Ren Wei, Pablo Neira Ayuso
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoze Xie <royenheart@gmail.com>
commit c9c9b37f8c5505224e8d206184df3bb668ee00cf upstream.
The br_netfilter fake rtable is embedded in struct net_bridge and is
attached to bridged packets with skb_dst_set_noref(). If such a packet is
queued to NFQUEUE, __nf_queue() upgrades that fake dst with
skb_dst_force().
At that point the queued skb can hold a real dst reference after bridge
teardown has started. The problem is not that every bridged packet needs
its own dst reference. The problem is that NFQUEUE can keep the bridge
private fake dst alive after unregister begins.
Fix this by keeping the bridge fake dst model unchanged and pinning the
bridge master device only while the packet sits in NFQUEUE. Record the
bridge device in nf_queue_entry when the queued skb carries a bridge fake
dst, take a device reference for the queue lifetime, and drop it when the
queue entry is freed.
Also make sure queued entries are reaped when that bridge device goes
down, and drop the redundant nf_bridge_info_exists() test from the fake
dst detection.
This keeps netdev_priv(br->dev) alive until verdict completion, so the
embedded fake rtable and its metrics backing storage cannot be freed out
from under dst_release(). It also avoids the constant refcount bump and
avoids using ipv4-specific dst helpers for IPv6 bridge traffic.
Fixes: 34666d467cbf ("netfilter: bridge: move br_netfilter out of the core")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Haoze Xie <royenheart@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/netfilter/nf_queue.h | 1 +
net/netfilter/nf_queue.c | 14 ++++++++++++++
net/netfilter/nfnetlink_queue.c | 3 +++
3 files changed, 18 insertions(+)
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -16,6 +16,7 @@ struct nf_queue_entry {
unsigned int id;
unsigned int hook_index; /* index in hook_entries->hook[] */
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ struct net_device *bridge_dev;
struct net_device *physin;
struct net_device *physout;
#endif
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -67,6 +67,7 @@ static void nf_queue_entry_release_refs(
nf_queue_sock_put(state->sk);
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ dev_put(entry->bridge_dev);
dev_put(entry->physin);
dev_put(entry->physout);
#endif
@@ -83,6 +84,8 @@ static void __nf_queue_entry_init_physde
{
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
const struct sk_buff *skb = entry->skb;
+ struct dst_entry *dst = skb_dst(skb);
+ struct net_device *dev = NULL;
if (nf_bridge_info_exists(skb)) {
entry->physin = nf_bridge_get_physindev(skb, entry->state.net);
@@ -91,6 +94,16 @@ static void __nf_queue_entry_init_physde
entry->physin = NULL;
entry->physout = NULL;
}
+
+ if (entry->state.pf == NFPROTO_BRIDGE &&
+ dst && (dst->flags & DST_FAKE_RTABLE))
+ dev = dst_dev_rcu(dst);
+
+ /* Must hold a reference on the bridge device: dst_hold() protects
+ * the dst itself, but the fake rtable is embedded in bridge-private
+ * storage that netdevice teardown can free independently.
+ */
+ entry->bridge_dev = dev;
#endif
}
@@ -107,6 +120,7 @@ bool nf_queue_entry_get_refs(struct nf_q
dev_hold(state->out);
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ dev_hold(entry->bridge_dev);
dev_hold(entry->physin);
dev_hold(entry->physout);
#endif
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -971,6 +971,9 @@ dev_cmp(struct nf_queue_entry *entry, un
if (physinif == ifindex || physoutif == ifindex)
return 1;
+
+ if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex)
+ return 1;
#endif
if (entry->skb_dev && entry->skb_dev->ifindex == ifindex)
return 1;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0927/1266] netfilter: nf_nat_sip: reload possible stale data pointer
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (925 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0926/1266] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0928/1266] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
` (71 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 upstream.
quoting sashiko:
------------------------------------------------------------------------
[..] noticed a potential memory bug and header corruption involving the
SIP NAT helper.
In net/netfilter/nf_nat_sip.c:nf_nat_sip():
if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet");
return NF_DROP;
}
uh = (void *)skb->data + protoff;
uh->dest = ct_sip_info->forced_dport;
if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
0, 0, NULL, 0)) {
If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the
old data buffer is freed. However, nf_nat_sip() fails to update *dptr to
point to the new buffer.
It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP
packet, which would overwrite the sequence number with a checksum update.
------------------------------------------------------------------------
nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.
But clones are possible, so rebuild dptr.
Disable nf_nat_mangle_udp_packet() branch for TCP streams.
It doesn't look like this can ever happen, else we should have received
bug reports about this, so just check the conntrack is UDP and drop
otherwise.
The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages,
so I don't think this is ever expected to be true for a TCP stream.
Fixes: 7266507d8999 ("netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_nat_sip.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -283,13 +283,24 @@ next:
/* Mangle destination port for Cisco phones, then fix up checksums */
if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
+ int doff = *dptr - (const char *)skb->data;
struct udphdr *uh;
+ if (doff <= 0) {
+ DEBUG_NET_WARN_ON_ONCE(1);
+ return NF_DROP;
+ }
+
+ /* ct_sip_info->forced_dport only expected with UDP */
+ if (nf_ct_protonum(ct) != IPPROTO_UDP)
+ return NF_DROP;
+
if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet");
return NF_DROP;
}
+ *dptr = skb->data + doff;
uh = (void *)skb->data + protoff;
uh->dest = ct_sip_info->forced_dport;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0928/1266] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (926 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0927/1266] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0929/1266] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
` (70 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 upstream.
nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
fragment header and then unconditionally advances skb->mac_header:
skb->mac_header += sizeof(struct frag_hdr);
On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding
sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
after which skb_mac_header_was_set() wrongly reports a MAC header is
present and skb_mac_header() points into the headroom.
The reassembler has done this unconditional add since it was introduced;
it was harmless while mac_header was a bare pointer, but wrong once
mac_header became a u16 offset whose unset state is the ~0U sentinel
tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c
does the same relocation and does guard the adjustment; mirror the
guard here.
Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -346,7 +346,8 @@ static int nf_ct_frag6_reasm(struct frag
skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
memmove(skb->head + sizeof(struct frag_hdr), skb->head,
(skb->data - skb->head) - sizeof(struct frag_hdr));
- skb->mac_header += sizeof(struct frag_hdr);
+ if (skb_mac_header_was_set(skb))
+ skb->mac_header += sizeof(struct frag_hdr);
skb->network_header += sizeof(struct frag_hdr);
skb_reset_transport_header(skb);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0929/1266] netfilter: nf_conncount: fix zone comparison in tuple dedup
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (927 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0928/1266] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0930/1266] netfilter: ecache: fix inverted time_after() check Greg Kroah-Hartman
` (69 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit f62c41b4910e65da396ec9a8c40c1fe7fe82e449 upstream.
The "already exists" dedup logic in __nf_conncount_add() decides
whether a connection has already been counted and can be skipped instead
of incrementing the connlimit count. It compares the conntrack zone of a
list entry with the zone of the connection being added using
nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
zone->dir as the direction argument.
Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0
and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:
NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and
NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction
shifts the meaning of every non-zero value. An ORIG-only zone passes 1
and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and
test bits beyond the valid direction range. In those cases
nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using
the real zone id, so different zones can be treated as equal and dedup
collapses to tuple equality alone.
nf_conncount stores and compares the original-direction tuple for a
connection. If an skb already has an attached conntrack entry,
get_ct_or_tuple_from_skb() explicitly copies
ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's
ctinfo. Therefore the zone comparison in the tuple dedup path must use
IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a
zone id applies, not which direction this conncount tuple represents.
Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.
Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone
ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the
direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional
zone contains the ORIG bit, so it naturally returns the real zone id;
reply-only zones continue to fall back for original-direction tuple
comparisons.
Fixes: 21ba8847f857 ("netfilter: nf_conncount: Fix garbage collection with zones")
Fixes: b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conncount.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -207,8 +207,8 @@ check_connections:
/* Not found, but might be about to be confirmed */
if (PTR_ERR(found) == -EAGAIN) {
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
- nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
- nf_ct_zone_id(zone, zone->dir))
+ nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) ==
+ nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL))
goto out_put; /* already exists */
} else {
collect++;
@@ -219,7 +219,7 @@ check_connections:
found_ct = nf_ct_tuplehash_to_ctrack(found);
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
- nf_ct_zone_equal(found_ct, zone, zone->dir)) {
+ nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) {
/*
* We should not see tuples twice unless someone hooks
* this into a table without "-p tcp --syn".
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0930/1266] netfilter: ecache: fix inverted time_after() check
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (928 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0929/1266] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0931/1266] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
` (68 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit b06163ce52ec0561f202fbfb9b08090cb61f512e upstream.
ecache_work_evict_list() redelivers DESTROY events for conntracks that
were moved to the per-netns dying_list after event delivery failed. It
sets a 10ms deadline:
stop = jiffies + ECACHE_MAX_JIFFIES
but then tests:
time_after(stop, jiffies)
This condition is true while the deadline is still in the future, so the
worker returns STATE_RESTART after the first successful redelivery in the
usual case. ecache_work() maps STATE_RESTART to delay 0, which turns the
redelivery path into one dying conntrack per workqueue dispatch and makes
the sent > 16 batching/cond_resched() path effectively unreachable.
A conntrack netlink listener whose receive queue is congested can make
DESTROY event delivery fail with -ENOBUFS. With sustained conntrack
churn, entries then accumulate on the dying_list and are only drained at
the degraded one-entry-per-dispatch rate once delivery succeeds again,
wasting CPU on back-to-back workqueue reschedules and prolonging
conntrack memory/resource pressure.
In a KASAN QEMU test with CONFIG_NF_CONNTRACK_EVENTS=y and
nf_conntrack.enable_hooks=1, a congested DESTROY listener caused 8192
nf_ct_delete() calls to return false and move entries to the dying_list.
After closing the listener, the unfixed kernel needed 7670 ecache_work()
entries to destroy 7669 conntracks. With this change, the same 8192
entries were destroyed by 2 ecache_work() entries.
Swap the comparison so the worker restarts only after the deadline has
expired.
Fixes: 2ed3bf188b33 ("netfilter: ecache: use dedicated list for event redelivery")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_ecache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -77,7 +77,7 @@ next:
hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &evicted_list);
- if (time_after(stop, jiffies)) {
+ if (time_after(jiffies, stop)) {
ret = STATE_RESTART;
break;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0931/1266] netfilter: xt_nat: reject unsupported target families
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (929 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0930/1266] netfilter: ecache: fix inverted time_after() check Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0932/1266] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
` (67 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd upstream.
xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
is present and can dereference a NULL pointer when instantiated from an
unsupported family through nft_compat. A bridge-family compat rule can
therefore trigger a NULL-dereference in nf_nat_setup_info().
Reject non-IP families in xt_nat_checkentry() so unsupported targets
cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
compat users and leave the runtime fast path unchanged.
[ The crash was fixed via
9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"),
so this patch is no longer critical.
Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra
family check is a good idea in any case. ]
Fixes: c7232c9979cb ("netfilter: add protocol independent NAT core")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_nat.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const st
static int xt_nat_checkentry(const struct xt_tgchk_param *par)
{
+ switch (par->family) {
+ case NFPROTO_IPV4:
+ case NFPROTO_IPV6:
+ case NFPROTO_INET:
+ break;
+ default:
+ return -EINVAL;
+ }
+
return nf_ct_netns_get(par->net, par->family);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0932/1266] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (930 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0931/1266] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0933/1266] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
` (66 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AutonomousCodeSecurity,
Xiang Mei (Microsoft), Florian Westphal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <xmei5@asu.edu>
commit 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d upstream.
br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
use-after-free write.
Save prevhdr's offset before skb_checksum_help() and recompute it after,
like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
fragment").
BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)
Write of size 1 at addr ffff888013ff5016 by task exploit/141
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip6_frag_next (net/ipv6/ip6_output.c:857)
br_ip6_fragment (net/ipv6/netfilter.c:212)
nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)
nf_hook_slow (net/netfilter/core.c:619)
br_forward_finish (net/bridge/br_forward.c:66)
__br_forward (net/bridge/br_forward.c:115)
maybe_deliver (net/bridge/br_forward.c:191)
br_flood (net/bridge/br_forward.c:245)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:442)
...
packet_sendmsg (net/packet/af_packet.c:3114)
...
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
Cc: stable@vger.kernel.org
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -130,7 +130,7 @@ int br_ip6_fragment(struct net *net, str
ktime_t tstamp = skb->tstamp;
struct ip6_frag_state state;
u8 *prevhdr, nexthdr = 0;
- unsigned int mtu, hlen;
+ unsigned int mtu, hlen, nexthdr_offset;
int hroom, err = 0;
__be32 frag_id;
@@ -139,6 +139,7 @@ int br_ip6_fragment(struct net *net, str
goto blackhole;
hlen = err;
nexthdr = *prevhdr;
+ nexthdr_offset = prevhdr - skb_network_header(skb);
mtu = skb->dev->mtu;
if (frag_max_size > mtu ||
@@ -157,6 +158,7 @@ int br_ip6_fragment(struct net *net, str
(err = skb_checksum_help(skb)))
goto blackhole;
+ prevhdr = skb_network_header(skb) + nexthdr_offset;
hroom = LL_RESERVED_SPACE(skb->dev);
if (skb_has_frag_list(skb)) {
unsigned int first_len = skb_pagelen(skb);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0933/1266] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (931 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0932/1266] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0934/1266] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
` (65 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Mikko Perttunen,
Thierry Reding
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit e75717f9aec04355777be41070890c6a815c76df upstream.
After device_initialize(), the embedded struct device in struct
host1x_device should be released through the device core with
put_device().
In host1x_device_add(), if host1x_device_parse_dt() fails, the current
error path frees the object directly with kfree(device). That bypasses
the normal device lifetime handling and leaks the reference held on the
embedded struct device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fix this by using put_device() in the host1x_device_parse_dt() failure
path.
Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/host1x/bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -457,7 +457,7 @@ static int host1x_device_add(struct host
err = host1x_device_parse_dt(device, driver);
if (err < 0) {
- kfree(device);
+ put_device(&device->dev);
return err;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0934/1266] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (932 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0933/1266] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0935/1266] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
` (64 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli,
Hari Prasath Gujulan Elango, Nishanth Menon
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <s-vadapalli@ti.com>
commit b920352cfd2b0fcd1249ff006618c939b64fc8f7 upstream.
k3_ringacc_ring_pop_tail_io() and k3_ringacc_ring_pop_tail_proxy()
incorrectly use K3_RINGACC_ACCESS_MODE_POP_HEAD instead of
K3_RINGACC_ACCESS_MODE_POP_TAIL. This will result in ring elements being
popped in the reverse order of that which the caller expects. Fix this.
Fixes: 3277e8aa2504 ("soc: ti: k3: add navss ringacc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com>
Link: https://patch.msgid.link/20260501124129.362192-1-s-vadapalli@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/ti/k3-ringacc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/soc/ti/k3-ringacc.c
+++ b/drivers/soc/ti/k3-ringacc.c
@@ -1012,7 +1012,7 @@ static int k3_ringacc_ring_pop_head_prox
static int k3_ringacc_ring_pop_tail_proxy(struct k3_ring *ring, void *elem)
{
return k3_ringacc_ring_access_proxy(ring, elem,
- K3_RINGACC_ACCESS_MODE_POP_HEAD);
+ K3_RINGACC_ACCESS_MODE_POP_TAIL);
}
static int k3_ringacc_ring_access_io(struct k3_ring *ring, void *elem,
@@ -1083,7 +1083,7 @@ static int k3_ringacc_ring_pop_io(struct
static int k3_ringacc_ring_pop_tail_io(struct k3_ring *ring, void *elem)
{
return k3_ringacc_ring_access_io(ring, elem,
- K3_RINGACC_ACCESS_MODE_POP_HEAD);
+ K3_RINGACC_ACCESS_MODE_POP_TAIL);
}
/*
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0935/1266] soc: fsl: qe: panic on ioremap() failure in qe_reset()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (933 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0934/1266] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0936/1266] selinux: check connect-related permissions on TCP Fast Open Greg Kroah-Hartman
` (63 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Jun,
Christophe Leroy (CS GROUP)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jun <1742789905@qq.com>
commit a0fe29d20e7822182e12324905af5115c1b3aed3 upstream.
When ioremap() fails in qe_reset(), the global pointer qe_immr remains
NULL, leading to a subsequent NULL pointer dereference when the pointer
is accessed. Since this happens early in the boot process, a failure to
map a few bytes of I/O memory indicates a fatal error from which the
system cannot recover.
Follow the same pattern as qe_sdma_init() and panic immediately when
ioremap() fails. This avoids a silent NULL pointer dereference later
and makes the error explicit.
Fixes: 986585385131 ("[POWERPC] Add QUICC Engine (QE) infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Jun <1742789905@qq.com>
Link: https://lore.kernel.org/r/tencent_FED49CF5331CC0C7910618883332A08E2606@qq.com
[chleroy: Rearranged change to reduce churn]
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/fsl/qe/qe.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/soc/fsl/qe/qe.c
+++ b/drivers/soc/fsl/qe/qe.c
@@ -89,6 +89,9 @@ void qe_reset(void)
if (qe_immr == NULL)
qe_immr = ioremap(get_qe_base(), QE_IMMAP_SIZE);
+ if (!qe_immr)
+ panic("QE:ioremap failed!");
+
qe_snums_init();
qe_issue_cmd(QE_RESET, QE_CR_SUBBLOCK_INVALID,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0936/1266] selinux: check connect-related permissions on TCP Fast Open
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (934 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0935/1266] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0937/1266] selinux: fix incorrect execmem checks on overlayfs Greg Kroah-Hartman
` (62 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Matthieu Buffet,
Mikhail Ivanov, Stephen Smalley, Paul Moore
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <stephen.smalley.work@gmail.com>
commit 44c74d27d1b9aaa99fa8a83640c1223575262b80 upstream.
Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/selinux/hooks.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5047,7 +5047,24 @@ static int selinux_socket_accept(struct
static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size)
{
- return sock_has_perm(sock->sk, SOCKET__WRITE);
+ int rc;
+ struct sockaddr *const addr = msg->msg_name;
+ const int addrlen = msg->msg_namelen;
+
+ rc = sock_has_perm(sock->sk, SOCKET__WRITE);
+ if (rc)
+ return rc;
+
+ if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
+ (sk_is_tcp(sock->sk) ||
+ (sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
+ sock->sk->sk_protocol == IPPROTO_MPTCP))) {
+ rc = selinux_socket_connect(sock, addr, addrlen);
+ if (rc)
+ return rc;
+ }
+
+ return 0;
}
static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0937/1266] selinux: fix incorrect execmem checks on overlayfs
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (935 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0936/1266] selinux: check connect-related permissions on TCP Fast Open Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0938/1266] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
` (61 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Mosnacek, Stephen Smalley,
Paul Moore
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <omosnace@redhat.com>
commit 9fe595fad54d4ac6a402edb3f60bec859d52cea6 upstream.
The commit fixing the overlayfs mmap() and mprotect() access checks
failed to skip the execmem check in __file_map_prot_check() for the case
where the "mounter check" is being performed. This check should be
performed only against the credentials of the task that is calling
mmap()/mprotect(), since it doesn't pertain to the file itself, but
rather just gates the ability of the calling task to get an executable
memory mapping in general.
The purpose of the "mounter check" is to guard against using an
overlayfs mount to gain file access that would otherwise be denied to
the mounter. For execmem this is not relevant, as there is no further
file access granted based on it (notice that the file's context is not
used as the target in the check), so checking it also against the
mounter credentials would be incorrect.
Fix this by passing a boolean to [__]file_map_prot_check() and
selinux_mmap_file_common() that indicates if we are doing the "mounter
check" and skiping the execmem check in that case. Since this boolean
also indicates if we use current_cred() or the mounter cred as the
subject, also remove the "cred" argument from these functions and
determine it based on the boolean and the file struct.
Cc: stable@vger.kernel.org
Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/selinux/hooks.c | 42 ++++++++++++++++++++++++------------------
1 file changed, 24 insertions(+), 18 deletions(-)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3789,9 +3789,9 @@ static int selinux_file_ioctl_compat(str
static int default_noexec __ro_after_init;
-static int __file_map_prot_check(const struct cred *cred,
- const struct file *file, unsigned long prot,
- bool shared, bool bf_user_file)
+static int __file_map_prot_check(const struct file *file, unsigned long prot,
+ bool shared, bool mounter_check,
+ bool bf_user_file)
{
struct inode *inode = NULL;
bool prot_exec = prot & PROT_EXEC;
@@ -3804,10 +3804,10 @@ static int __file_map_prot_check(const s
inode = file_inode(file);
}
- if (default_noexec && prot_exec &&
+ if (!mounter_check && default_noexec && prot_exec &&
(!file || IS_PRIVATE(inode) || (!shared && prot_write))) {
int rc;
- u32 sid = cred_sid(cred);
+ u32 sid = current_sid();
/*
* We are making executable an anonymous mapping or a private
@@ -3820,6 +3820,8 @@ static int __file_map_prot_check(const s
}
if (file) {
+ const struct cred *cred = mounter_check ?
+ file->f_cred : current_cred();
/* "read" always possible, "write" only if shared */
u32 av = FILE__READ;
if (shared && prot_write)
@@ -3833,11 +3835,11 @@ static int __file_map_prot_check(const s
return 0;
}
-static inline int file_map_prot_check(const struct cred *cred,
- const struct file *file,
- unsigned long prot, bool shared)
+static inline int file_map_prot_check(const struct file *file,
+ unsigned long prot, bool shared,
+ bool mounter_check)
{
- return __file_map_prot_check(cred, file, prot, shared, false);
+ return __file_map_prot_check(file, prot, shared, mounter_check, false);
}
static int selinux_mmap_addr(unsigned long addr)
@@ -3853,12 +3855,14 @@ static int selinux_mmap_addr(unsigned lo
return rc;
}
-static int selinux_mmap_file_common(const struct cred *cred, struct file *file,
- unsigned long prot, bool shared)
+static int selinux_mmap_file_common(struct file *file, unsigned long prot,
+ bool shared, bool mounter_check)
{
if (file) {
int rc;
struct common_audit_data ad;
+ const struct cred *cred = mounter_check ?
+ file->f_cred : current_cred();
ad.type = LSM_AUDIT_DATA_FILE;
ad.u.file = file;
@@ -3867,15 +3871,16 @@ static int selinux_mmap_file_common(cons
return rc;
}
- return file_map_prot_check(cred, file, prot, shared);
+ return file_map_prot_check(file, prot, shared, mounter_check);
}
static int selinux_mmap_file(struct file *file,
unsigned long reqprot __always_unused,
unsigned long prot, unsigned long flags)
{
- return selinux_mmap_file_common(current_cred(), file, prot,
- (flags & MAP_TYPE) == MAP_SHARED);
+ return selinux_mmap_file_common(file, prot,
+ (flags & MAP_TYPE) == MAP_SHARED,
+ false);
}
/**
@@ -3907,8 +3912,9 @@ static int selinux_mmap_backing_file(str
if (vma->vm_flags & VM_EXEC)
prot |= PROT_EXEC;
- return selinux_mmap_file_common(backing_file->f_cred, backing_file,
- prot, vma->vm_flags & VM_SHARED);
+ return selinux_mmap_file_common(backing_file, prot,
+ vma->vm_flags & VM_SHARED,
+ true);
}
static int selinux_file_mprotect(struct vm_area_struct *vma,
@@ -3969,11 +3975,11 @@ static int selinux_file_mprotect(struct
}
}
- rc = __file_map_prot_check(cred, file, prot, shared, backing_file);
+ rc = __file_map_prot_check(file, prot, shared, false, backing_file);
if (rc)
return rc;
if (backing_file) {
- rc = file_map_prot_check(file->f_cred, file, prot, shared);
+ rc = file_map_prot_check(file, prot, shared, true);
if (rc)
return rc;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0938/1266] leds: uleds: Fix potential buffer overread
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (936 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0937/1266] selinux: fix incorrect execmem checks on overlayfs Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0939/1266] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
` (60 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Lee Jones
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
commit c19fe864f667afc49d1391d764e20b66555bcf7a upstream.
The name string supplied by userspace is not guaranteed to be
null-terminated, so using strchr() on it might result in a buffer
overread. The same thing will happen when said string is used by
the LED class device.
Fix this by using strnchr() instead and explicitly check that
the name string is properly null-terminated.
Cc: stable@vger.kernel.org
Fixes: e381322b0190 ("leds: Introduce userspace LED class driver")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/uleds.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/leds/uleds.c
+++ b/drivers/leds/uleds.c
@@ -102,7 +102,8 @@ static ssize_t uleds_write(struct file *
name = udev->user_dev.name;
if (!name[0] || !strcmp(name, ".") || !strcmp(name, "..") ||
- strchr(name, '/')) {
+ strnchr(name, sizeof(udev->user_dev.name), '/') ||
+ !strnchr(name, sizeof(udev->user_dev.name), '\0')) {
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0939/1266] mfd: sm501: Fix reference leak on failed device registration
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (937 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0938/1266] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0940/1266] tools/power/x86/intel-speed-select: Harden daemon pidfile open Greg Kroah-Hartman
` (59 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Lee Jones
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream.
When platform_device_register() fails in sm501_register_device(), the
embedded struct device in pdev has already been initialized by
device_initialize(), but the failure path only reports the error and
returns without dropping the device reference for the current platform
device:
sm501_register_device()
-> platform_device_register(pdev)
-> device_initialize(&pdev->dev)
-> setup_pdev_dma_masks(pdev)
-> platform_device_add(pdev)
This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/sm501.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -747,9 +747,11 @@ static int sm501_register_device(struct
if (ret >= 0) {
dev_dbg(sm->dev, "registered %s\n", pdev->name);
list_add_tail(&smdev->list, &sm->devices);
- } else
+ } else {
dev_err(sm->dev, "error registering %s (%d)\n",
pdev->name, ret);
+ platform_device_put(pdev);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0940/1266] tools/power/x86/intel-speed-select: Harden daemon pidfile open
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (938 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0939/1266] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0941/1266] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
` (58 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ali Ahmet MEMIS, Srinivas Pandruvada,
stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
commit 607af438e6430893a822964c841a1994b33acccc upstream.
Avoid symlink-based pidfile clobbering by opening the pidfile with
O_NOFOLLOW and validating it with fstat() before locking/writing.
The daemon currently uses a fixed pidfile path under /tmp. A local
unprivileged user can pre-create a symlink at that path and cause a
root-run daemon instance to write into an attacker-chosen file.
Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode")
Signed-off-by: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/power/x86/intel-speed-select/isst-daemon.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/tools/power/x86/intel-speed-select/isst-daemon.c
+++ b/tools/power/x86/intel-speed-select/isst-daemon.c
@@ -147,6 +147,7 @@ static void daemonize(char *rundir, char
{
int pid, sid, i;
char str[10];
+ struct stat st;
struct sigaction sig_actions;
sigset_t sig_set;
int ret;
@@ -199,11 +200,17 @@ static void daemonize(char *rundir, char
if (ret == -1)
exit(EXIT_FAILURE);
- pid_file_handle = open(pidfile, O_RDWR | O_CREAT, 0600);
+ pid_file_handle = open(pidfile, O_RDWR | O_CREAT | O_NOFOLLOW, 0600);
if (pid_file_handle == -1) {
/* Couldn't open lock file */
exit(1);
}
+
+ if (fstat(pid_file_handle, &st) == -1)
+ exit(1);
+
+ if (!S_ISREG(st.st_mode))
+ exit(1);
/* Try to lock file */
#ifdef LOCKF_SUPPORT
if (lockf(pid_file_handle, F_TLOCK, 0) == -1) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0941/1266] x86/boot: Validate console=uart8250 baud rate to fix early boot hang
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (939 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0940/1266] tools/power/x86/intel-speed-select: Harden daemon pidfile open Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0942/1266] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
` (57 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Ingo Molnar,
H. Peter Anvin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit ffa0aa5b625fe0bed7463ac613f8b06676ff4542 upstream.
When the baud rate is empty, 0, invalid, or overflows to 0 when stored
as an int, the system will hang during early boot because of a division
by zero in early_serial_init().
Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent
an early system hang.
Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/early_serial_console.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -117,7 +117,7 @@ static unsigned int probe_baud(int port)
static void parse_console_uart8250(void)
{
char optstr[64], *options;
- int baud = DEFAULT_BAUD;
+ int baud;
int port = 0;
/*
@@ -136,10 +136,13 @@ static void parse_console_uart8250(void)
else
return;
- if (options && (options[0] == ','))
- baud = simple_strtoull(options + 1, &options, 0);
- else
+ if (options && (options[0] == ',')) {
+ baud = simple_strtoull(options + 1, NULL, 0);
+ if (!baud)
+ baud = DEFAULT_BAUD;
+ } else {
baud = probe_baud(port);
+ }
if (port)
early_serial_init(port, baud);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0942/1266] x86/boot: Reject too long acpi_rsdp= values
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (940 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0941/1266] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0943/1266] perf/x86/amd/lbr: Fix kernel address leakage Greg Kroah-Hartman
` (56 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Borislav Petkov (AMD)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit d130041a7b96f79cd4c7079a6c2431a6db4c9619 upstream.
cmdline_find_option() returns the full length of the parsed acpi_rsdp=
value. get_cmdline_acpi_rsdp() then silently truncates values which do
not fit in the val[] buffer.
Prevent boot_kstrtoul() from parsing a truncated value and then the
kernel from silently using the wrong RSDP address, see discussion in
Link:.
Issue a warning so that the user is aware that s/he supplied a malformed
value and can get feedback instead of silent crashes.
[ bp: Make commit message more precise. ]
Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/acpi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/boot/compressed/acpi.c
+++ b/arch/x86/boot/compressed/acpi.c
@@ -182,10 +182,15 @@ static unsigned long get_cmdline_acpi_rs
char val[MAX_ADDR_LEN] = { };
int ret;
- ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
+ ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
if (ret < 0)
return 0;
+ if (ret >= sizeof(val)) {
+ warn("acpi_rsdp= value too long; ignoring");
+ return 0;
+ }
+
if (boot_kstrtoul(val, 16, &addr))
return 0;
#endif
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0943/1266] perf/x86/amd/lbr: Fix kernel address leakage
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (941 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 6.6 0942/1266] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0944/1266] s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() Greg Kroah-Hartman
` (55 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Sandipan Das,
Ingo Molnar, Peter Zijlstra
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
commit 2a892294b83f541115c94b0bb637f39bef187657 upstream.
A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET
entries for which the branch-from addresses are in the kernel.
E.g.
$ perf record -e cycles -o - -j any,save_type,u -- \
perf bench syscall basic --loop 1000 | \
perf script -i - -F brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}'
...
0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
...
The reason is that the hardware filter only considers the privilege
level applicable to the branch target. Extend software filtering to
also validate the branch-from addresses against br_sel, so that any
branch record whose branch-from address is in the kernel is dropped
when PERF_SAMPLE_BRANCH_USER is requested.
Fixes: f4f925dae741 ("perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support")
Reported-by: Ian Rogers <irogers@google.com>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/amd/lbr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/x86/events/amd/lbr.c
+++ b/arch/x86/events/amd/lbr.c
@@ -124,7 +124,8 @@ static void amd_pmu_lbr_filter(void)
}
/* If type does not correspond, then discard */
- if (type == X86_BR_NONE || (br_sel & type) != type) {
+ if (type == X86_BR_NONE || (br_sel & type) != type ||
+ (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
cpuc->lbr_entries[i].from = 0; /* mark invalid */
compress = true;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0944/1266] s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (942 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0943/1266] perf/x86/amd/lbr: Fix kernel address leakage Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0945/1266] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
` (54 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumanth Korikkar, Ilya Leoshkevich,
Thomas Richter, Vasily Gorbik
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Korikkar <sumanthk@linux.ibm.com>
commit 49145bce539117db4b6e9e83c0e5ef528e361050 upstream.
ev variable is userspace controlled via event->attr.config and used
as an array index after bounds checking, but without speculation
barriers.
Add the missing array_index_nospec() call to prevent speculative
execution.
Cc: stable@vger.kernel.org
Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters")
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/perf_cpum_cf.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -17,6 +17,7 @@
#include <linux/export.h>
#include <linux/miscdevice.h>
#include <linux/perf_event.h>
+#include <linux/nospec.h>
#include <asm/cpu_mf.h>
#include <asm/hwctrset.h>
@@ -766,6 +767,7 @@ static int __hw_perf_event_init(struct p
if (!is_userspace_event(ev)) {
if (ev >= ARRAY_SIZE(cpumf_generic_events_user))
return -EOPNOTSUPP;
+ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_user));
ev = cpumf_generic_events_user[ev];
}
} else if (!attr->exclude_kernel && attr->exclude_user) {
@@ -776,6 +778,7 @@ static int __hw_perf_event_init(struct p
if (!is_userspace_event(ev)) {
if (ev >= ARRAY_SIZE(cpumf_generic_events_basic))
return -EOPNOTSUPP;
+ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_basic));
ev = cpumf_generic_events_basic[ev];
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0945/1266] batman-adv: gw: acquire ethernet header only after skb realloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (943 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0944/1266] s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0946/1266] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
` (53 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 77880a3be88d378d60cc1e8f8ec70430e2ed0518 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/gateway_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -693,12 +693,13 @@ bool batadv_gw_out_of_range(struct batad
struct batadv_gw_node *gw_node = NULL;
struct batadv_gw_node *curr_gw = NULL;
struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
- struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+ struct ethhdr *ethhdr;
bool out_of_range = false;
u8 curr_tq_avg;
unsigned short vid;
vid = batadv_get_vid(skb, 0);
+ ethhdr = (struct ethhdr *)skb->data;
if (is_multicast_ether_addr(ethhdr->h_dest))
goto out;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0946/1266] batman-adv: access unicast_ttvn skb->data only after skb realloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (944 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0945/1266] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0947/1266] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
` (52 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 7141990add3f75436f2933cb310654cad3b1e3e9 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/routing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -855,8 +855,8 @@ static bool batadv_check_unicast_ttvn(st
if (skb_cow(skb, sizeof(*unicast_packet)) < 0)
return false;
- unicast_packet = (struct batadv_unicast_packet *)skb->data;
vid = batadv_get_vid(skb, hdr_len);
+ unicast_packet = (struct batadv_unicast_packet *)skb->data;
ethhdr = (struct ethhdr *)(skb->data + hdr_len);
/* do not reroute multicast frames in a unicast header */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0947/1266] batman-adv: dat: acquire ARP hw source only after skb realloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (945 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0946/1266] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0948/1266] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
` (51 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 48067b2ae4504500a7093d9e1e16b42e70330480 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1758,6 +1758,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(
struct ethhdr *ethhdr;
__be32 ip_src, yiaddr;
unsigned short vid;
+ int hdr_size_tmp;
__be16 proto;
u8 *hw_src;
@@ -1774,8 +1775,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(
if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
return;
+ hdr_size_tmp = hdr_size;
+ vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
+ ethhdr = (struct ethhdr *)(skb->data + hdr_size);
hw_src = ethhdr->h_source;
- vid = batadv_dat_get_vid(skb, &hdr_size);
batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0948/1266] batman-adv: bla: reacquire gw address after skb realloc
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (946 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0947/1266] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0949/1266] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
` (50 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit cdf3b5af2bc4431e58629e8ad2086b1e9185c761 upstream.
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/routing.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1035,6 +1035,7 @@ int batadv_recv_unicast_packet(struct sk
hdr_size);
batadv_orig_node_put(orig_node_gw);
if (is_gw) {
+ orig_addr_gw = eth_hdr(skb)->h_source;
batadv_dbg(BATADV_DBG_BLA, bat_priv,
"%s(): Dropped unicast pkt received from another backbone gw %pM.\n",
__func__, orig_addr_gw);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0949/1266] batman-adv: dat: ensure accessible eth_hdr proto field
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (947 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0948/1266] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0950/1266] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
` (49 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 26560c4a03dc4d607331600c187f59ab2df5f341 upstream.
When batadv_get_vid() accesses the proto field of the ethernet header, it
is not checking if the data itself is accessible. The caller is responsible
for it. But in contrast to other call sites, batadv_dat_get_vid() and its
caller didn't make sure this is true. This could have caused an
out-of-bounds access.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++
net/batman-adv/main.c | 3 +++
2 files changed, 26 insertions(+)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1077,6 +1077,9 @@ out:
* @skb: the buffer containing the packet to extract the VID from
* @hdr_size: the size of the batman-adv header encapsulating the packet
*
+ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: If the packet embedded in the skb is vlan tagged this function
* returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS
* is returned.
@@ -1159,6 +1162,10 @@ bool batadv_dat_snoop_outgoing_arp_reque
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1254,6 +1261,10 @@ bool batadv_dat_snoop_incoming_arp_reque
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1316,6 +1327,10 @@ void batadv_dat_snoop_outgoing_arp_reply
if (!atomic_read(&bat_priv->distributed_arp_table))
return;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ return;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1364,6 +1379,10 @@ bool batadv_dat_snoop_incoming_arp_reply
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1818,6 +1837,10 @@ bool batadv_dat_drop_broadcast_packet(st
if (batadv_forw_packet_is_rebroadcast(forw_packet))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size);
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -618,6 +618,9 @@ __be32 batadv_skb_crc32(struct sk_buff *
* @skb: the buffer containing the packet
* @header_len: length of the batman header preceding the ethernet header
*
+ * The caller must ensure that at least @header_len + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the
* skb is vlan tagged. Otherwise BATADV_NO_FLAGS.
*/
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0950/1266] batman-adv: dat: fix tie-break for candidate selection
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (948 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0949/1266] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0951/1266] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
` (48 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b upstream.
The original version of the candidate selection for DAT attempted to
compare both candidate and max_orig_node to identify which has the smaller
MAC address. This comparison is required as tie-break when a hash collision
happened.
But the used function returned 0 when the function was not equal and a
non-zero value when it was equal. As result, the actually selected
node was dependent on the order of entries in the orig_hash and not
actually on the mac addresses. The last originator in the hash collision
would always win.
To have a proper ordering, it must diff the actual MAC address bytes and
reject the candidate when the diff is not smaller than 0.
Cc: stable@vger.kernel.org
Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -546,7 +546,7 @@ static bool batadv_is_orig_node_eligible
* the one with the lowest address
*/
if (tmp_max == max && max_orig_node &&
- batadv_compare_eth(candidate->orig, max_orig_node->orig))
+ memcmp(candidate->orig, max_orig_node->orig, ETH_ALEN) >= 0)
goto out;
ret = true;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0951/1266] batman-adv: tt: avoid request storms during pending request
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (949 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0950/1266] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0952/1266] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
` (47 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 27c7d40008231ae4140d35501b60087a9de2d2c3 upstream.
batadv_send_tt_request() allocates a tt_req_node when none exists for the
destination originator node. This should prevent that a multiple TT
requests are send at the same time to an originator.
But if allocation of the send buffer failed, this request must be cleaned
up again. But indicator for such a failure is "ret == false". But the
actual implementation is checking for "ret == true".
The check must be inverted to not loose the information about the TT
request directly after it was attempted to be sent out. This should avoid
potential request storms.
Cc: stable@vger.kernel.org
Fixes: 335fbe0f5d25 ("batman-adv: tvlv - convert tt query packet to use tvlv unicast packets")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3032,7 +3032,7 @@ static bool batadv_send_tt_request(struc
out:
batadv_hardif_put(primary_if);
- if (ret && tt_req_node) {
+ if (!ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock);
if (!hlist_unhashed(&tt_req_node->list)) {
hlist_del_init(&tt_req_node->list);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0952/1266] batman-adv: fix VLAN priority offset
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (950 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0951/1266] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0953/1266] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
` (46 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 upstream.
The batadv_skb_set_priority() receives an SKB with the inner ethernet
header at position "offset". When it tries to extract the IPv4 and IPv6
header, it needs to skip the ethernet header to get access to the IP
header.
But for VLAN header, it performs the access with the struct vlan_ethhdr.
This struct contains both both the ethernet header and the VLAN header. It
is therefore incorrect to skip over the whole vlan_ethhdr size to get
access to the vlan_ethhdr.
Cc: stable@vger.kernel.org
Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -375,7 +375,7 @@ void batadv_skb_set_priority(struct sk_b
switch (ethhdr->h_proto) {
case htons(ETH_P_8021Q):
- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr),
+ vhdr = skb_header_pointer(skb, offset,
sizeof(*vhdr), &vhdr_tmp);
if (!vhdr)
return;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0953/1266] batman-adv: frag: free unfragmentable packet
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (951 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0952/1266] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0954/1266] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
` (45 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 6b628425aed49a1c7a4ffc997583840fc582d32b upstream.
The caller of batadv_frag_send_packet() assume that the skb provided to the
function are always consumed. But the pre-check for an empty payload or the
zero fragment size returned an error without any further actions.
A failed pre-check must use the same error handling code as the rest of the
function.
Cc: stable@vger.kernel.org
Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -522,8 +522,10 @@ int batadv_frag_send_packet(struct sk_bu
mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
max_fragment_size = mtu - header_size;
- if (skb->len == 0 || max_fragment_size == 0)
- return -EINVAL;
+ if (skb->len == 0 || max_fragment_size == 0) {
+ ret = -EINVAL;
+ goto free_skb;
+ }
num_fragments = (skb->len - 1) / max_fragment_size + 1;
max_fragment_size = (skb->len - 1) / num_fragments + 1;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0954/1266] batman-adv: frag: fix primary_if leak on failed linearization
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (952 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0953/1266] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0955/1266] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
` (44 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 353d2c1d5492e53ae34f490a84494124dc3d3531 upstream.
If the skb has a frag_list, it must be linearized before it can be split
using skb_split(). But when this step failed, it must not only free the skb
but also take care of the reference to the already found primary_if.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a063f2fba3fa ("batman-adv: Don't skb_split skbuffs with frag_list")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -551,7 +551,7 @@ int batadv_frag_send_packet(struct sk_bu
*/
if (skb_has_frag_list(skb) && __skb_linearize(skb)) {
ret = -ENOMEM;
- goto free_skb;
+ goto put_primary_if;
}
/* Create one header to be copied to all fragments */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0955/1266] batman-adv: tt: prevent TVLV OOB check overflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (953 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0954/1266] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0956/1266] cifs: invalidate cfid on unlink/rename/rmdir Greg Kroah-Hartman
` (43 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b upstream.
A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.
Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.
Cc: stable@vger.kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -4101,7 +4101,8 @@ static int batadv_tt_tvlv_unicast_handle
u16 tvlv_value_len)
{
struct batadv_tvlv_tt_data *tt_data;
- u16 tt_vlan_len, tt_num_entries;
+ u16 tt_num_entries;
+ size_t tt_vlan_len;
char tt_flag;
bool ret;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0956/1266] cifs: invalidate cfid on unlink/rename/rmdir
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (954 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0955/1266] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0957/1266] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
` (42 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shyam Prasad N, Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <sprasad@microsoft.com>
commit f71d68d2b473e47db260c27c98212829590d8bae upstream.
Today we do not invalidate the cached_dirent or the entire
parent cfid when a dentry in a dir has been removed/moved.
This change invalidates the parent cfid so that we don't serve
directory contents from the cache.
Cc: <stable@vger.kernel.org>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/inode.c | 30 +++++++++++++++++++++++++++++-
1 file changed, 29 insertions(+), 1 deletion(-)
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -119,6 +119,23 @@ cifs_revalidate_cache(struct inode *inod
fscache_invalidate(cifs_inode_cookie(inode), &cd, i_size_read(inode), 0);
}
+static void cifs_invalidate_cached_dir(struct cifs_tcon *tcon,
+ struct dentry *parent)
+{
+ struct cached_fid *parent_cfid = NULL;
+
+ if (!tcon || !parent)
+ return;
+
+ if (!open_cached_dir_by_dentry(tcon, parent, &parent_cfid)) {
+ mutex_lock(&parent_cfid->dirents.de_mutex);
+ parent_cfid->dirents.is_valid = false;
+ parent_cfid->dirents.is_failed = true;
+ mutex_unlock(&parent_cfid->dirents.de_mutex);
+ close_cached_dir(parent_cfid);
+ }
+}
+
/*
* copy nlink to the inode, unless it wasn't provided. Provide
* sane values if we don't have an existing one and none was provided
@@ -1964,6 +1981,9 @@ psx_del_no_retry:
cifs_set_file_info(inode, attrs, xid, full_path, origattr);
out_reval:
+ if (!rc && dentry->d_parent)
+ cifs_invalidate_cached_dir(tcon, dentry->d_parent);
+
if (inode) {
cifs_inode = CIFS_I(inode);
cifs_inode->time = 0; /* will force revalidate to get info
@@ -2268,13 +2288,14 @@ int cifs_rmdir(struct inode *inode, stru
}
rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);
- cifs_put_tlink(tlink);
if (!rc) {
spin_lock(&d_inode(direntry)->i_lock);
i_size_write(d_inode(direntry), 0);
clear_nlink(d_inode(direntry));
spin_unlock(&d_inode(direntry)->i_lock);
+ if (direntry->d_parent)
+ cifs_invalidate_cached_dir(tcon, direntry->d_parent);
}
cifsInode = CIFS_I(d_inode(direntry));
@@ -2290,6 +2311,7 @@ int cifs_rmdir(struct inode *inode, stru
inode_set_ctime_current(d_inode(direntry));
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
+ cifs_put_tlink(tlink);
rmdir_exit:
free_dentry_path(page);
@@ -2512,6 +2534,12 @@ unlink_target:
}
/* force revalidate to go get info when needed */
+ if (!rc) {
+ cifs_invalidate_cached_dir(tcon, source_dentry->d_parent);
+ if (target_dentry->d_parent != source_dentry->d_parent)
+ cifs_invalidate_cached_dir(tcon, target_dentry->d_parent);
+ }
+
CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
cifs_rename_exit:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0957/1266] mfd: tps6586x: Fix OF node refcount
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (955 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0956/1266] cifs: invalidate cfid on unlink/rename/rmdir Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0958/1266] HID: playstation: validate num_touch_reports in DualShock 4 reports Greg Kroah-Hartman
` (41 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Lee Jones
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream.
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().
Cc: stable@vger.kernel.org
Fixes: 62f6b0879304 ("tps6586x: Add device tree support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/tps6586x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -395,7 +395,7 @@ static int tps6586x_add_subdevs(struct t
pdev->dev.parent = tps6586x->dev;
pdev->dev.platform_data = subdev->platform_data;
- pdev->dev.of_node = subdev->of_node;
+ pdev->dev.of_node = of_node_get(subdev->of_node);
ret = platform_device_add(pdev);
if (ret) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0958/1266] HID: playstation: validate num_touch_reports in DualShock 4 reports
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (956 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0957/1266] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0959/1266] Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready Greg Kroah-Hartman
` (40 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benoît Sevens, Jiri Kosina
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <bsevens@google.com>
commit 82a4fc46330910b4c1d9b189561439d468e3ff11 upstream.
The DualShock 4 HID driver fails to validate the num_touch_reports field
received from the device in both USB and Bluetooth input reports.
A malicious device could set this field to a value larger than the
allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
leading to an out-of-bounds read in dualshock4_parse_report().
This can result in kernel memory disclosure when processing malicious
HID reports.
Validate num_touch_reports against the array size for the respective
connection types before processing the touch data.
Signed-off-by: Benoît Sevens <bsevens@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-playstation.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -2199,6 +2199,12 @@ static int dualshock4_parse_report(struc
size == DS4_INPUT_REPORT_USB_SIZE) {
struct dualshock4_input_report_usb *usb = (struct dualshock4_input_report_usb *)data;
+ if (usb->num_touch_reports > ARRAY_SIZE(usb->touch_reports)) {
+ hid_err(hdev, "DualShock4 USB input report has invalid num_touch_reports=%d\n",
+ usb->num_touch_reports);
+ return -EINVAL;
+ }
+
ds4_report = &usb->common;
num_touch_reports = min_t(u8, usb->num_touch_reports,
ARRAY_SIZE(usb->touch_reports));
@@ -2214,6 +2220,12 @@ static int dualshock4_parse_report(struc
return -EILSEQ;
}
+ if (bt->num_touch_reports > ARRAY_SIZE(bt->touch_reports)) {
+ hid_err(hdev, "DualShock4 BT input report has invalid num_touch_reports=%d\n",
+ bt->num_touch_reports);
+ return -EINVAL;
+ }
+
ds4_report = &bt->common;
num_touch_reports = min_t(u8, bt->num_touch_reports,
ARRAY_SIZE(bt->touch_reports));
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0959/1266] Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (957 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0958/1266] HID: playstation: validate num_touch_reports in DualShock 4 reports Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0960/1266] Bluetooth: SCO: hold sk properly " Greg Kroah-Hartman
` (39 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
commit b819db93d73f4593636299e229914052b89e3ef2 upstream.
sco_conn_ready calls sleeping functions under conn->lock spinlock.
The critical section can be reduced: conn->hcon is modified only with
hdev->lock held. It is guaranteed to be held in sco_conn_ready, so
conn->lock is not needed to guard it.
Move taking conn->lock after lock_sock(parent). This also follows the
lock ordering lock_sock() > conn->lock elsewhere in the file.
Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/sco.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1314,26 +1314,24 @@ static void sco_conn_ready(struct sco_co
sk->sk_state_change(sk);
release_sock(sk);
} else {
- sco_conn_lock(conn);
-
- if (!conn->hcon) {
- sco_conn_unlock(conn);
+ if (!conn->hcon)
return;
- }
+
+ lockdep_assert_held(&conn->hcon->hdev->lock);
parent = sco_get_sock_listen(&conn->hcon->src);
- if (!parent) {
- sco_conn_unlock(conn);
+ if (!parent)
return;
- }
lock_sock(parent);
+ sco_conn_lock(conn);
+
sk = sco_sock_alloc(sock_net(parent), NULL,
BTPROTO_SCO, GFP_ATOMIC, 0);
if (!sk) {
- release_sock(parent);
sco_conn_unlock(conn);
+ release_sock(parent);
return;
}
@@ -1353,9 +1351,9 @@ static void sco_conn_ready(struct sco_co
/* Wake up parent */
parent->sk_data_ready(parent);
- release_sock(parent);
-
sco_conn_unlock(conn);
+
+ release_sock(parent);
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0960/1266] Bluetooth: SCO: hold sk properly in sco_conn_ready
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (958 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0959/1266] Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0961/1266] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Greg Kroah-Hartman
` (38 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 upstream.
sk deref in sco_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk and parent sk is
currently accessed without either, and without checking parent->sk_state:
[Task 1] [Task 2]
sco_sock_release
sco_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
sco_sock_kill(sk)
UAF on sk deref
and similarly for access to sco_get_sock_listen() return value.
Fix possible UAF by holding sk refcount in sco_conn_ready() and making
sco_get_sock_listen() increase refcount. Also recheck after lock_sock
that the socket is still valid. Adjust conn->sk locking so it's
protected also by lock_sock() of the associated socket if any.
Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/sco.c | 44 ++++++++++++++++++++++++++++++++------------
1 file changed, 32 insertions(+), 12 deletions(-)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -409,9 +409,13 @@ static struct sock *sco_get_sock_listen(
sk1 = sk;
}
+ sk = sk ? sk : sk1;
+ if (sk)
+ sock_hold(sk);
+
read_unlock(&sco_sk_list.lock);
- return sk ? sk : sk1;
+ return sk;
}
static void sco_sock_destruct(struct sock *sk)
@@ -451,11 +455,13 @@ static void sco_sock_kill(struct sock *s
BT_DBG("sk %p state %d", sk, sk->sk_state);
/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+ lock_sock(sk);
if (sco_pi(sk)->conn) {
sco_conn_lock(sco_pi(sk)->conn);
sco_pi(sk)->conn->sk = NULL;
sco_conn_unlock(sco_pi(sk)->conn);
}
+ release_sock(sk);
/* Kill poor orphan */
bt_sock_unlink(&sco_sk_list, sk);
@@ -1302,17 +1308,28 @@ static int sco_sock_release(struct socke
static void sco_conn_ready(struct sco_conn *conn)
{
- struct sock *parent;
- struct sock *sk = conn->sk;
+ struct sock *parent, *sk;
+
+ sco_conn_lock(conn);
+ sk = sco_sock_hold(conn);
+ sco_conn_unlock(conn);
BT_DBG("conn %p", conn);
if (sk) {
lock_sock(sk);
- sco_sock_clear_timer(sk);
- sk->sk_state = BT_CONNECTED;
- sk->sk_state_change(sk);
+
+ /* conn->sk may have become NULL if racing with sk close, but
+ * due to held hdev->lock, it can't become different sk.
+ */
+ if (conn->sk) {
+ sco_sock_clear_timer(sk);
+ sk->sk_state = BT_CONNECTED;
+ sk->sk_state_change(sk);
+ }
+
release_sock(sk);
+ sock_put(sk);
} else {
if (!conn->hcon)
return;
@@ -1327,13 +1344,15 @@ static void sco_conn_ready(struct sco_co
sco_conn_lock(conn);
+ /* hdev->lock guarantees conn->sk == NULL still here */
+
+ if (parent->sk_state != BT_LISTEN)
+ goto release;
+
sk = sco_sock_alloc(sock_net(parent), NULL,
BTPROTO_SCO, GFP_ATOMIC, 0);
- if (!sk) {
- sco_conn_unlock(conn);
- release_sock(parent);
- return;
- }
+ if (!sk)
+ goto release;
sco_sock_init(sk, parent);
@@ -1351,9 +1370,10 @@ static void sco_conn_ready(struct sco_co
/* Wake up parent */
parent->sk_data_ready(parent);
+release:
sco_conn_unlock(conn);
-
release_sock(parent);
+ sock_put(parent);
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0961/1266] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (959 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0960/1266] Bluetooth: SCO: hold sk properly " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0962/1266] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
` (37 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo, Baokun Li,
Zhang Yi, Jan Kara, Theodore Tso
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit 289a2ca0c9b7eae74f93fc213b0b971669b8683d upstream.
jbd2_journal_initialize_fast_commit() validates journal capacity by
checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).
Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds
j_last the subtraction wraps to a large value, bypassing the bounds
check.
The resulting underflow corrupts j_last, j_fc_first, and j_free,
leading to journal abort.
Fix by checking num_fc_blks against j_last before the subtraction,
returning -EFSCORRUPTED.
Fixes: 6866d7b3f2bb ("ext4 / jbd2: add fast commit initialization")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: e029c5f27987 ("ext4: make num of fast commit blocks configurable")
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Fixes: e029c5f279872 ("ext4: make num of fast commit blocks configurable")
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/SYBPR01MB7881663C927DE9D7BBF4D1DFAF062@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/journal.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2303,6 +2303,8 @@ jbd2_journal_initialize_fast_commit(jour
unsigned long long num_fc_blks;
num_fc_blks = jbd2_journal_get_num_fc_blks(sb);
+ if (num_fc_blks > journal->j_last)
+ return -EFSCORRUPTED;
if (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS)
return -ENOSPC;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0962/1266] nvdimm/btt: Free arenas on btt_init() error paths
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (960 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0961/1266] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0963/1266] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
` (36 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Alison Schofield
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 upstream.
The arenas allocated by discover_arenas() or create_arenas() are not
freed on some error paths in btt_init(). This leaks memory when BTT
initialization fails.
Call free_arenas() from the affected error paths to release the
allocations.
[ as: commit message and log edits ]
Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/btt.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1593,7 +1593,7 @@ static struct btt *btt_init(struct nd_bt
if (btt->init_state != INIT_READY && nd_region->ro) {
dev_warn(dev, "%s is read-only, unable to init btt metadata\n",
dev_name(&nd_region->dev));
- return NULL;
+ goto err;
} else if (btt->init_state != INIT_READY) {
btt->num_arenas = (rawsize / ARENA_MAX_SIZE) +
((rawsize % ARENA_MAX_SIZE) ? 1 : 0);
@@ -1603,25 +1603,28 @@ static struct btt *btt_init(struct nd_bt
ret = create_arenas(btt);
if (ret) {
dev_info(dev, "init: create_arenas: %d\n", ret);
- return NULL;
+ goto err;
}
ret = btt_meta_init(btt);
if (ret) {
dev_err(dev, "init: error in meta_init: %d\n", ret);
- return NULL;
+ goto err;
}
}
ret = btt_blk_init(btt);
if (ret) {
dev_err(dev, "init: error in blk_init: %d\n", ret);
- return NULL;
+ goto err;
}
btt_debugfs_init(btt);
return btt;
+err:
+ free_arenas(btt);
+ return NULL;
}
/**
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0963/1266] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (961 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0962/1266] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0964/1266] sunrpc: pin svc_xprt across the asynchronous TLS handshake callback Greg Kroah-Hartman
` (35 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Alison Schofield
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 13fe4cd9ddd0aacb7777812328be525a11ea3fea upstream.
Memory allocated by btt_freelist_init(), btt_rtt_init(), and
btt_maplocks_init() is not freed on some discover_arenas() error
paths. This leaks memory when arena discovery fails.
Add the missing kfree() calls to release the allocations before
returning an error.
[ as: commit message and log edits ]
Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-1-592300fb7a43@cse.iitm.ac.in
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/btt.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -923,6 +923,9 @@ static int discover_arenas(struct btt *b
return ret;
out:
+ kfree(arena->freelist);
+ kfree(arena->rtt);
+ kfree(arena->map_locks);
kfree(arena);
free_arenas(btt);
out_super:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0964/1266] sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (962 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0963/1266] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0965/1266] sunrpc: wait for in-flight TLS handshake callback when cancel loses race Greg Kroah-Hartman
` (34 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 4f988f3a2808fb659f3880c282041ff067acad78 upstream.
svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core takes only
sock_hold(req->hr_sk); nothing references the embedding struct
svc_sock that svc_tcp_handshake_done() reaches via container_of().
Two close races leave the in-flight callback writing through a freed
svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards
its return value: a false return means handshake_complete() has
already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have
finished, yet svc_sock_free() proceeds to kfree(svsk). The
cancel-loser fall-through inside svc_tcp_handshake() itself produces
the same window: when wait_for_completion_interruptible_timeout()
returns <= 0 (timeout or signal) and tls_handshake_cancel() returns
false, the function does not drain, returns, and svc_handle_xprt()
calls svc_xprt_received(), which clears XPT_BUSY and can drop the
last reference. A concurrent close then runs svc_sock_free() while
svc_tcp_handshake_done() is still updating xpt_flags and walking
svsk->sk_handshake_done.
The corruption surfaces as set_bit/clear_bit RMW into the freed
xpt_flags slab slot and as complete_all() walking and writing the
freed wait_queue_head_t list embedded in sk_handshake_done -- a
slab-corruption primitive, not a benign read. The path is reachable
on any TLS-enabled NFS server whenever a connection close overlaps
the tlshd downcall delivery window; the interruptible wait means
signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.
Take svc_xprt_get(xprt) immediately before tls_server_hello_x509()
so the in-flight callback owns its own reference. Release it on the
two edges where the callback is guaranteed not to fire -- submission
failure from tls_server_hello_x509() and a successful
tls_handshake_cancel() -- and at the tail of
svc_tcp_handshake_done() after complete_all().
Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Assisted-by: kres (claude-opus-4-7)
[cel: rewrote commit message to describe the actual change]
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -462,6 +462,7 @@ static void svc_tcp_handshake_done(void
}
clear_bit(XPT_HANDSHAKE, &xprt->xpt_flags);
complete_all(&svsk->sk_handshake_done);
+ svc_xprt_put(xprt);
}
/**
@@ -485,9 +486,13 @@ static void svc_tcp_handshake(struct svc
clear_bit(XPT_TLS_SESSION, &xprt->xpt_flags);
init_completion(&svsk->sk_handshake_done);
+ /* Pin the transport across the asynchronous handshake callback. */
+ svc_xprt_get(xprt);
+
ret = tls_server_hello_x509(&args, GFP_KERNEL);
if (ret) {
trace_svc_tls_not_started(xprt);
+ svc_xprt_put(xprt);
goto out_failed;
}
@@ -496,6 +501,7 @@ static void svc_tcp_handshake(struct svc
if (ret <= 0) {
if (tls_handshake_cancel(sk)) {
trace_svc_tls_timed_out(xprt);
+ svc_xprt_put(xprt);
goto out_close;
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0965/1266] sunrpc: wait for in-flight TLS handshake callback when cancel loses race
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (963 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0964/1266] sunrpc: pin svc_xprt across the asynchronous TLS handshake callback Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0966/1266] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
` (33 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 upstream.
When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then returns false, handshake_complete() has
won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
is about to invoke svc_tcp_handshake_done(), but the callback's
side effects on xpt_flags and on svsk->sk_handshake_done have not
yet committed.
The current code reads xpt_flags immediately to decide whether the
session succeeded. Two races result.
If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
enqueues the transport, and returns. svc_xprt_received() then
clears XPT_BUSY, a worker thread picks the transport up, the
dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
and xpo_handshake is invoked a second time. That svc_tcp_handshake()
calls init_completion(&svsk->sk_handshake_done) while the original
callback concurrently calls complete_all() on it, corrupting the
embedded swait_queue.
If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
XPT_TLS_SESSION as clear and tears the connection down even though
the handshake is about to succeed.
Wait for the callback to commit before inspecting xpt_flags. The
completion is guaranteed to fire because handshake_complete()
invokes svc_tcp_handshake_done() unconditionally once it has set
HANDSHAKE_F_REQ_COMPLETED.
Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svcsock.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -504,6 +504,10 @@ static void svc_tcp_handshake(struct svc
svc_xprt_put(xprt);
goto out_close;
}
+ /* Cancellation lost to handshake_complete(): the
+ * callback is in flight and should finish quickly.
+ */
+ wait_for_completion(&svsk->sk_handshake_done);
}
if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags)) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0966/1266] lockd: Plug nlm_file leak when nlm_do_fopen() fails
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (964 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0965/1266] sunrpc: wait for in-flight TLS handshake callback when cancel loses race Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0967/1266] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
` (32 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit f16a1513452edb532fec81e591c64c320866719c upstream.
A client can repeatedly drive nlm_do_fopen() failures by presenting
file handles that the underlying export rejects. After kzalloc_obj()
succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not
yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps
to out_unlock, which releases nlm_file_mutex and returns without
freeing the allocation, so each failure leaks one nlm_file.
Route the failure through out_free so kfree() runs before the
function returns.
Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svcsubs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -139,7 +139,7 @@ nlm_lookup_file(struct svc_rqst *rqstp,
nfserr = nlm_do_fopen(rqstp, file, mode);
if (nfserr)
- goto out_unlock;
+ goto out_free;
hlist_add_head(&file->f_list, &nlm_files[hash]);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0967/1266] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (965 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0966/1266] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0968/1266] SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing Greg Kroah-Hartman
` (31 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 70a38f87bed7f0694fd07988b47b2db1e10d8df3 upstream.
The cached-file path in nlm_lookup_file() reaches the found: label
unconditionally, even when nlm_do_fopen() fails. At that label
*result and file->f_count are updated before the error is returned.
The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then
bail out of their switch without copying *result back to their
caller, so the proc handler's local nlm_file pointer remains NULL
and the cleanup path skips nlm_release_file(). The f_count
increment is never released, and nlm_traverse_files() can no
longer reap the file because its refcount never returns to zero
between requests.
Short-circuit the cached path so neither *result nor f_count is
touched when nlm_do_fopen() fails on a hashed nlm_file.
Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svcsubs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -123,6 +123,8 @@ nlm_lookup_file(struct svc_rqst *rqstp,
mutex_lock(&file->f_mutex);
nfserr = nlm_do_fopen(rqstp, file, mode);
mutex_unlock(&file->f_mutex);
+ if (nfserr)
+ goto out_unlock;
goto found;
}
nlm_debug_print_fh("creating file for", &lock->fh);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0968/1266] SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (966 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0967/1266] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0969/1266] remoteproc: qcom: Fix leak when custom dump_segments addition fails Greg Kroah-Hartman
` (30 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 42f5b80dda6b86e424054baf1475df686c403d5c upstream.
xdr_buf_to_bvec() writes a bio_vec into the caller's array before
testing whether that slot is in range, and the head branch performs
the store with no check at all. When the caller's budget is exactly
used up, the next store lands one element past the end of the array.
The overflow label returns count - 1, which masks the surplus store
but cannot undo it.
rq_bvec, the array passed by nfsd_vfs_write(), is allocated to
exactly rq_maxpages entries with no slack. The OOB store can land in
adjacent slab memory; the bv_len and bv_offset fields written there
are derived from client-supplied RPC payload sizes.
Move the in-range check ahead of the store in the head, page-loop,
and tail branches. With the check at the top of each sequence, count
is incremented only after a successful store, so the overflow label
can return count directly.
Reported-by: Chris Mason <clm@meta.com>
Fixes: 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use bio_vecs directly")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xdr.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -180,6 +180,8 @@ unsigned int xdr_buf_to_bvec(struct bio_
unsigned int count = 0;
if (head->iov_len) {
+ if (unlikely(count >= bvec_size))
+ goto bvec_overflow;
bvec_set_virt(bvec++, head->iov_base, head->iov_len);
++count;
}
@@ -193,25 +195,27 @@ unsigned int xdr_buf_to_bvec(struct bio_
while (remaining > 0) {
len = min_t(unsigned int, remaining,
PAGE_SIZE - offset);
+ if (unlikely(count >= bvec_size))
+ goto bvec_overflow;
bvec_set_page(bvec++, *pages++, len, offset);
remaining -= len;
offset = 0;
- if (unlikely(++count > bvec_size))
- goto bvec_overflow;
+ ++count;
}
}
if (tail->iov_len) {
- bvec_set_virt(bvec, tail->iov_base, tail->iov_len);
- if (unlikely(++count > bvec_size))
+ if (unlikely(count >= bvec_size))
goto bvec_overflow;
+ bvec_set_virt(bvec, tail->iov_base, tail->iov_len);
+ ++count;
}
return count;
bvec_overflow:
pr_warn_once("%s: bio_vec array overflow\n", __func__);
- return count - 1;
+ return count;
}
/**
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0969/1266] remoteproc: qcom: Fix leak when custom dump_segments addition fails
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (967 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0968/1266] SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0970/1266] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
` (29 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Wasim Nazir,
Bjorn Andersson
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wasim Nazir <wasim.nazir@oss.qualcomm.com>
commit ecf9fc18e62c58eae1ceb65dab2bccb8a724de2d upstream.
Free allocated minidump_region 'name' in qcom_add_minidump_segments()
when failing before adding the region to 'dump_segments'. Otherwise,
the 'name' is not tracked and is never freed by qcom_minidump_cleanup().
Return error when adding to 'dump_segments' fails.
Cc: stable@vger.kernel.org # v5.11
Fixes: 8ed8485c4f05 ("remoteproc: qcom: Add capability to collect minidumps")
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Wasim Nazir <wasim.nazir@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260318-rproc-memleak-v2-1-ade70ab858f2@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/qcom_common.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/remoteproc/qcom_common.c
+++ b/drivers/remoteproc/qcom_common.c
@@ -108,6 +108,7 @@ static int qcom_add_minidump_segments(st
struct minidump_region __iomem *ptr;
struct minidump_region region;
int seg_cnt, i;
+ int ret = 0;
dma_addr_t da;
size_t size;
char *name;
@@ -128,17 +129,22 @@ static int qcom_add_minidump_segments(st
if (le32_to_cpu(region.valid) == MINIDUMP_REGION_VALID) {
name = kstrndup(region.name, MAX_REGION_NAME_LENGTH - 1, GFP_KERNEL);
if (!name) {
- iounmap(ptr);
- return -ENOMEM;
+ ret = -ENOMEM;
+ break;
}
da = le64_to_cpu(region.address);
size = le64_to_cpu(region.size);
- rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t, name);
+ ret = rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t,
+ name);
+ if (ret) {
+ kfree(name);
+ break;
+ }
}
}
iounmap(ptr);
- return 0;
+ return ret;
}
void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0970/1266] MIPS: ip22-gio: fix gio device memory leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (968 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0969/1266] remoteproc: qcom: Fix leak when custom dump_segments addition fails Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0971/1266] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
` (28 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7de9a1b45f5a95b58145653c525c8fb80292d9ab upstream.
The gio device release callback was never wired up so gio devices are
not freed when the last reference is dropped.
Fixes: e84de0c61905 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org # 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -101,6 +101,8 @@ int gio_device_register(struct gio_devic
{
giodev->dev.bus = &gio_bus_type;
giodev->dev.parent = &gio_bus;
+ giodev->dev.release = gio_release_dev;
+
return device_register(&giodev->dev);
}
EXPORT_SYMBOL_GPL(gio_device_register);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0971/1266] MIPS: ip22-gio: fix kfree() of static object
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (969 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0970/1266] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0972/1266] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
` (27 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Levente Kurusa, Johan Hovold,
Thomas Bogendoerfer
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c62cdd3e919bdf84c37ec46810f87cdb1736e822 upstream.
The gio bus root device is a statically allocated object which must not
be freed by kfree() on failure to register the device or bus.
Fixes: 82242d28ff8b ("MIPS: IP22: Add missing put_device call")
Cc: stable@vger.kernel.org # 3.17
Cc: Levente Kurusa <levex@linux.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -30,7 +30,6 @@ static struct {
static void gio_bus_release(struct device *dev)
{
- kfree(dev);
}
static struct device gio_bus = {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0972/1266] MIPS: ip22-gio: fix device reference leak in probe
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (970 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0971/1266] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0973/1266] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
` (26 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b82930a4c5dbc5c4df39c0f93d968c239f2c6885 upstream.
The gio probe function needlessly takes a device reference which is
never released and therefore prevents unbound gio devices from being
freed.
Fixes: e84de0c61905 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org # 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -133,13 +133,9 @@ static int gio_device_probe(struct devic
if (!drv->probe)
return error;
- gio_dev_get(gio_dev);
-
match = gio_match_device(drv->id_table, gio_dev);
if (match)
error = drv->probe(gio_dev, match);
- if (error)
- gio_dev_put(gio_dev);
return error;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0973/1266] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (971 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0972/1266] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0974/1266] power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak Greg Kroah-Hartman
` (25 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit 5ff79e8bdc75db51e30298a75939e2308e7658e0 upstream.
In 64-bit configurations calling any firmware entry points from a kernel
thread other than the initial one will result in a situation where the
stack has been placed in the XKPHYS 64-bit memory segment.
Consequently the stack pointer is no longer a 32-bit value and when the
32-bit firmware code called uses 32-bit ALU operations to manipulate the
stack pointer, the calculated result is incorrect (in fact in the 64-bit
MIPS ISA almost all 32-bit ALU operations will produce an unpredictable
result when executed on 64-bit data) and control goes astray.
This may happen when no final console driver has been enabled in the
configuration and consequently the initial console continues being used
late into bootstrap, or with an upcoming change that will switch the zs
driver to use a platform device, which in turn will make the console
handover happen only after other kernel threads have already been
started, and the kernel will hang at:
pid_max: default: 32768 minimum: 301
or somewhat later, but always before:
cblist_init_generic: Setting adjustable number of callback queues.
has been printed.
It seems that only the prom_printf() entry point is affected. Of all
the other entry points wired only rex_slot_address() and rex_gettcinfo()
are called from a kernel thread other than the initial one, specifically
kernel_init(), and they are leaf functions that do no business with the
stack, having worked with no issue ever since 64-bit support was added
for the platform back in 2002.
To address this issue then, arrange for the stack to be switched in the
o32 wrapper as required for prom_printf() only, by supplying call_o32()
with a pointer to a chunk of initdata space, which is placed in the
CKSEG0 32-bit compatibility segment, observing that prom_printf() is
only called from console output handler and therefore with the console
lock held, implying no need for this code to be reentrant.
Other firmware entry points may be called with interrupts enabled and no
lock held, and may therefore require that call_o32() be reentrant. They
trigger no issue at this point and "if it ain't broke, don't fix it," so
just leave them alone.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/dec/prom/init.c | 6 +++++-
arch/mips/include/asm/dec/prom.h | 15 +++++++++++++--
2 files changed, 18 insertions(+), 3 deletions(-)
--- a/arch/mips/dec/prom/init.c
+++ b/arch/mips/dec/prom/init.c
@@ -3,7 +3,7 @@
* init.c: PROM library initialisation code.
*
* Copyright (C) 1998 Harald Koerfgen
- * Copyright (C) 2002, 2004 Maciej W. Rozycki
+ * Copyright (C) 2002, 2004, 2026 Maciej W. Rozycki
*/
#include <linux/init.h>
#include <linux/kernel.h>
@@ -20,6 +20,10 @@
#include <asm/dec/prom.h>
+#ifdef CONFIG_64BIT
+unsigned long o32_stk[O32_STK_SIZE] __initdata = { 0 };
+#endif
+
int (*__rex_bootinit)(void);
int (*__rex_bootread)(void);
int (*__rex_getbitmap)(memmap *);
--- a/arch/mips/include/asm/dec/prom.h
+++ b/arch/mips/include/asm/dec/prom.h
@@ -4,7 +4,7 @@
*
* DECstation PROM interface.
*
- * Copyright (C) 2002 Maciej W. Rozycki
+ * Copyright (C) 2002, 2026 Maciej W. Rozycki
*
* Based on arch/mips/dec/prom/prom.h by the Anonymous.
*/
@@ -97,6 +97,17 @@ extern int (*__pmax_close)(int);
#ifdef CONFIG_64BIT
+#define O32_STK_SIZE 512
+extern unsigned long o32_stk[];
+
+/* Switch the stack if outside the 32-bit address space. */
+static inline unsigned long *o32_get_stk(void)
+{
+ long fp = (long)__builtin_frame_address(0);
+
+ return fp != (int)fp ? o32_stk + O32_STK_SIZE : NULL;
+}
+
/*
* On MIPS64 we have to call PROM functions via a helper
* dispatcher to accommodate ABI incompatibilities.
@@ -128,7 +139,7 @@ int __DEC_PROM_O32(_prom_printf, (int (*
#define prom_getchar() _prom_getchar(__prom_getchar, NULL)
#define prom_getenv(x) _prom_getenv(__prom_getenv, NULL, x)
-#define prom_printf(x...) _prom_printf(__prom_printf, NULL, x)
+#define prom_printf(x...) _prom_printf(__prom_printf, o32_get_stk(), x)
#else /* !CONFIG_64BIT */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0974/1266] power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (972 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0973/1266] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0975/1266] mm/damon/core: make charge_addr_from aware of end-address exclusivity Greg Kroah-Hartman
` (24 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Sebastian Reichel
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit a2c14ff63e0e02e3c832385e523e9cc81301171c upstream.
In cpcap_battery_detect_battery_type(), the reference to an nvmem
device obtained via nvmem_device_find() is not released with
nvmem_device_put() on the success or read-failure paths, causing a
permanent reference leak. The driver’s retry logic on subsequent
battery property reads can compound this leak, preventing the nvmem
device from ever being freed.
Found by code review.
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Cc: stable@vger.kernel.org
Fixes: fd46821e85de ("power: supply: cpcap-battery: Add battery type auto detection for mapphone devices")
Link: https://patch.msgid.link/20260424011013.879639-1-make24@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/cpcap-battery.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/power/supply/cpcap-battery.c
+++ b/drivers/power/supply/cpcap-battery.c
@@ -415,10 +415,13 @@ static void cpcap_battery_detect_battery
if (IS_ERR_OR_NULL(nvmem)) {
ddata->check_nvmem = true;
dev_info_once(ddata->dev, "Can not find battery nvmem device. Assuming generic lipo battery\n");
- } else if (nvmem_device_read(nvmem, 2, 1, &battery_id) < 0) {
- battery_id = 0;
- ddata->check_nvmem = true;
- dev_warn(ddata->dev, "Can not read battery nvmem device. Assuming generic lipo battery\n");
+ } else {
+ if (nvmem_device_read(nvmem, 2, 1, &battery_id) < 0) {
+ battery_id = 0;
+ ddata->check_nvmem = true;
+ dev_warn(ddata->dev, "Can not read battery nvmem device. Assuming generic lipo battery\n");
+ }
+ nvmem_device_put(nvmem);
}
switch (battery_id) {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0975/1266] mm/damon/core: make charge_addr_from aware of end-address exclusivity
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (973 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0974/1266] power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0976/1266] fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename Greg Kroah-Hartman
` (23 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 5a2d162e22bf33eb89d53e802d0fc1ec422e19b6 upstream.
DAMON region end address is exclusive one, but charge_addr_from is
assigned assuming the end address is inclusive. As a result, DAMOS action
to next up to min_region_sz memory can be skipped. This is quite
negligible user impact. But, the bug is a bug that can be very simply
fixed. Fix the wrong assignment to respect the exclusiveness of the
address.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260428042942.118230-1-sj@kernel.org
Link: https://lore.kernel.org/20260428032324.115663-1-sj@kernel.org [1]
Fixes: 50585192bc2e ("mm/damon/schemes: skip already charged targets and regions")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.16.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1003,7 +1003,7 @@ static void damos_apply_scheme(struct da
quota->charged_sz += sz;
if (quota->esz && quota->charged_sz >= quota->esz) {
quota->charge_target_from = t;
- quota->charge_addr_from = r->ar.end + 1;
+ quota->charge_addr_from = r->ar.end;
}
}
if (s->action != DAMOS_STAT)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0976/1266] fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (974 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0975/1266] mm/damon/core: make charge_addr_from aware of end-address exclusivity Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0977/1266] fs/ntfs3: bound DeleteIndexEntryAllocation memmove length Greg Kroah-Hartman
` (22 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit 932fa0c1496286e39e14e27194c1ee7c2181629f upstream.
In ntfs3_rename(), when IS_DIRSYNC(new_dir) is true, the code syncs
the renamed file inode instead of the target directory new_dir:
if (IS_DIRSYNC(new_dir))
ntfs_sync_inode(inode); /* should be new_dir */
DIRSYNC requires that directory metadata changes are written to disk
synchronously. Since new_dir was modified (a new directory entry was
added), it is new_dir that must be synced to satisfy the guarantee,
not the renamed file itself.
This bug has existed since the initial ntfs3 implementation and was
carried through the refactoring in commit 78ab59fee07f
("fs/ntfs3: Rework file operations").
Fix by syncing new_dir instead of inode.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@ -341,7 +341,7 @@ static int ntfs_rename(struct mnt_idmap
ntfs_sync_inode(dir);
if (IS_DIRSYNC(new_dir))
- ntfs_sync_inode(inode);
+ ntfs_sync_inode(new_dir);
}
if (dir_ni != new_dir_ni)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0977/1266] fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (975 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0976/1266] fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0978/1266] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass Greg Kroah-Hartman
` (21 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit fc4626bb3656362de8b0ecd56605d47a19ec3518 upstream.
In do_action()'s DeleteIndexEntryAllocation case, e->size comes
from an on-disk INDEX_BUFFER entry. When e->size makes
e + e->size point past hdr + hdr->used,
PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t
that is silently cast to a quasi-infinite size_t when passed
to memmove(). The memmove then walks past the destination
buffer.
The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543
already carries the corresponding guard:
if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize ||
Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
used + esize > le32_to_cpu(hdr->total)) {
goto dirty_vol;
}
Apply the same shape to the allocation-path case. Also reject
esize == 0: memmove(e, e, ...) is a no-op and leaves
hdr->used unchanged, hiding a malformed entry from the
existing check_index_header() walk.
Reproduced under UML+KASAN on mainline 8d90b09e6741 by
mounting a crafted NTFS image: the unguarded memmove takes a
length of 0xffffffffffffff00 and the kernel oopses in
memmove+0x81/0x1a0 on the do_action+0x36a2 frame.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3574,9 +3574,23 @@ move_data:
}
e1 = Add2Ptr(e, esize);
- nsize = esize;
used = le32_to_cpu(hdr->used);
+ /*
+ * Reject crafted entries whose e->size makes e + esize
+ * point past the INDEX_HDR's used boundary. Without this,
+ * PtrOffset(e1, hdr + used) underflows to a quasi-infinite
+ * size_t when fed to the memmove() below.
+ *
+ * Also reject esize == 0: memmove(e, e, ...) is a no-op and
+ * leaves hdr->used unchanged, masking the crafted entry.
+ */
+ if (!esize || Add2Ptr(e, esize) > Add2Ptr(hdr, used) ||
+ PtrOffset(e1, Add2Ptr(hdr, used)) < esize)
+ goto dirty_vol;
+
+ nsize = esize;
+
memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
hdr->used = cpu_to_le32(used - nsize);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0978/1266] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (976 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0977/1266] fs/ntfs3: bound DeleteIndexEntryAllocation memmove length Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0979/1266] fs/ntfs3: bound attr_off in UpdateResidentValue against data_off Greg Kroah-Hartman
` (20 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 5e7b598660cfa8e5af172cf4c65cffc126333307 upstream.
In log_replay()'s analysis pass, after find_dp() returns a
valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
the copy_lcns block walks lrh->lcns_follow further entries:
t16 = le16_to_cpu(lrh->lcns_follow);
for (i = 0; i < t16; i++) {
size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
le64_to_cpu(dp->vcn));
dp->page_lcns[j + i] = lrh->page_lcns[i];
}
find_dp() only validates that target_vcn falls within
[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
cluster is covered. The walk through the further entries is
not bounded against dp->lcns_follow. For a malformed LRH
where target_vcn = dp->vcn + dp->lcns_follow - 1 and
lrh->lcns_follow > 1, the i > 0 writes overflow the dp's
allocated page_lcns[] array.
Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.
Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
slab-out-of-bounds write of size 8 from log_replay+0x68d4 on
the mount path.
This is distinct from Pavitra Jha's 2026-05-02 patch
("fs/ntfs3: validate lcns_follow in log_replay conversion",
<20260502154252.164586-1-jhapavitra98@gmail.com>) which
addresses the separate version-0 dirty-page-table conversion
path's memmove(&dp->vcn, ...) call. The two fixes are
complementary; both should land.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,
fixed conflicts]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 46 +++++++++++++++++++++++++++++-----------------
1 file changed, 29 insertions(+), 17 deletions(-)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3365,8 +3365,8 @@ move_data:
if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
attr_run(attr),
- le32_to_cpu(attr->size) -
- le16_to_cpu(attr->nres.run_off),
+ le32_to_cpu(attr->size) -
+ le16_to_cpu(attr->nres.run_off),
&t64)) {
goto dirty_vol;
}
@@ -4581,22 +4581,34 @@ copy_lcns:
* whole routine a loop, case Lcns do not fit below.
*/
t16 = le16_to_cpu(lrh->lcns_follow);
- t32 = le32_to_cpu(dp->lcns_follow);
- if (le64_to_cpu(lrh->target_vcn) < le64_to_cpu(dp->vcn)) {
- err = -EINVAL;
- goto out;
- }
-
- for (i = 0; i < t16; i++) {
- size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
- le64_to_cpu(dp->vcn));
- if (j >= t32 || i >= t32 - j) {
- err = -EINVAL;
- goto out;
- }
- dp->page_lcns[j + i] = lrh->page_lcns[i];
- }
+ t32 = le32_to_cpu(dp->lcns_follow);
+ if (le64_to_cpu(lrh->target_vcn) < le64_to_cpu(dp->vcn)) {
+ err = -EINVAL;
+ goto out;
+ }
+
+ /*
+ * find_dp() only validates that target_vcn is the first
+ * cluster covered by dp. The walk through lrh->lcns_follow
+ * further entries must stay within the allocated
+ * dp->page_lcns[] array, which is sized by dp->lcns_follow.
+ */
+ if (le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn) + t16 >
+ le32_to_cpu(dp->lcns_follow)) {
+ err = -EINVAL;
+ log->set_dirty = true;
+ goto out;
+ }
+ for (i = 0; i < t16; i++) {
+ size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
+ le64_to_cpu(dp->vcn));
+ if (j >= t32 || i >= t32 - j) {
+ err = -EINVAL;
+ goto out;
+ }
+ dp->page_lcns[j + i] = lrh->page_lcns[i];
+ }
goto next_log_record_analyze;
case DeleteDirtyClusters: {
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0979/1266] fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (977 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0978/1266] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0980/1266] fs/ntfs3: validate lcns_follow in log_replay conversion Greg Kroah-Hartman
` (19 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit d1570c48f49a693974d000251030370ee2e83539 upstream.
In do_action()'s UpdateResidentValue case (fslog.c:3307),
lrh->attr_off and lrh->redo_len come from the on-disk LRH.
When they satisfy aoff + dlen < attr->res.data_off, the
assignment
attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,
data_off=0x18). Subsequent code that reads attr->res.data_size
to walk the resident attribute payload would then read up to
4 GiB past the 1024-byte MFT record allocation.
The existing mi_enum_attr() defense in fs/ntfs3/record.c:287
catches the corrupted data_size on the next attribute walk
and fails the mount, but only on the path that walks all
attributes. A read site that picks an attribute by name and
reads its data_size without re-validating is not covered.
Validate aoff against data_off and asize at the source.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr_warn-only probe: with aoff=0x10 and data_off=0x18, the
post-assignment data_size is 0xfffffff9 (mount then fails
at -22 from mi_enum_attr).
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3313,6 +3313,17 @@ skip_load_parent:
nsize = ALIGN(nsize, 8);
data_off = le16_to_cpu(attr->res.data_off);
+ /*
+ * aoff comes from the on-disk lrh->attr_off. Forbid
+ * writes that begin below the resident attribute's
+ * data_off (which would overwrite the resident header),
+ * and forbid aoff + dlen < data_off, which would make
+ * the data_size assignment below underflow to ~4 GiB.
+ */
+ if (aoff < data_off || aoff + dlen < data_off ||
+ aoff + dlen > asize)
+ goto dirty_vol;
+
if (nsize < asize) {
memmove(Add2Ptr(attr, aoff), data, dlen);
data = NULL; // To skip below memmove().
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0980/1266] fs/ntfs3: validate lcns_follow in log_replay conversion
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (978 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0979/1266] fs/ntfs3: bound attr_off in UpdateResidentValue against data_off Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0981/1266] fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow Greg Kroah-Hartman
` (18 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pavitra Jha, Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit 6a4c53a2e26a865565bd6a460961e8d6fcb32329 upstream.
log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY
records when replaying version 0 restart tables.
During this conversion, the memmove() length is derived directly from
the on-disk lcns_follow field:
memmove(&dp->vcn, &dp0->vcn_low,
2 * sizeof(u64) +
le32_to_cpu(dp->lcns_follow) * sizeof(u64));
check_rstbl() validates restart table structure, but does not constrain
per-entry lcns_follow values relative to the entry size. A malformed
filesystem image can provide an oversized lcns_follow value, causing
the conversion memmove() to access memory beyond the bounds of the
allocated restart table buffer.
The same field is later used to bound iteration over page_lcns[],
so validating lcns_follow during conversion also prevents downstream
out-of-bounds access from the same malformed metadata.
Compute the maximum valid lcns_follow from the already-validated
restart table entry size and reject entries that exceed this bound.
Reuse the existing t16/t32 scratch variables already declared in
log_replay() to avoid introducing new declarations.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
[almaz.alexandrovich@paragon-software.com: fixed the conflicts]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -4263,13 +4263,26 @@ check_dirty_page_table:
if (rst->major_ver)
goto end_conv_1;
+ t16 = le16_to_cpu(dptbl->size);
+ if (t16 < sizeof(struct DIR_PAGE_ENTRY)) {
+ log->set_dirty = true;
+ goto out;
+ }
+
+ t32 = (t16 - sizeof(struct DIR_PAGE_ENTRY)) / sizeof(u64);
+
dp = NULL;
while ((dp = enum_rstbl(dptbl, dp))) {
struct DIR_PAGE_ENTRY_32 *dp0 = (struct DIR_PAGE_ENTRY_32 *)dp;
- // NOTE: Danger. Check for of boundary.
+ u32 lcns = le32_to_cpu(dp->lcns_follow);
+
+ if (lcns > t32) {
+ log->set_dirty = true;
+ goto out;
+ }
+
memmove(&dp->vcn, &dp0->vcn_low,
- 2 * sizeof(u64) +
- le32_to_cpu(dp->lcns_follow) * sizeof(u64));
+ 2 * sizeof(u64) + lcns * sizeof(u64));
}
end_conv_1:
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0981/1266] fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (979 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0980/1266] fs/ntfs3: validate lcns_follow in log_replay conversion Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0982/1266] fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} Greg Kroah-Hartman
` (17 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 1ebd684b8f627f75bc3e03f8b2ad8400fd1f02cd upstream.
indx_find_buffer() recursively descends the B+ tree index with no depth
limit. A crafted NTFS image with circular index node references causes
unbounded recursion, overflowing the kernel stack and panicking the
system.
This is reachable by mounting a malicious NTFS filesystem (e.g. from a
USB drive via desktop automount) and deleting a file whose index entry
triggers the rebalancing fallback path in indx_delete_entry().
Add a depth parameter and bail out with -EINVAL when it reaches the
fnd->nodes array bound, matching the constraint already enforced by
fnd_push() in indx_find().
The related function indx_find() was previously patched for a similar
infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was
missed.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Assisted-by: Codex:gpt-5-4
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/index.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -2016,13 +2016,21 @@ out1:
static struct indx_node *indx_find_buffer(struct ntfs_index *indx,
struct ntfs_inode *ni,
const struct INDEX_ROOT *root,
- __le64 vbn, struct indx_node *n)
+ __le64 vbn, struct indx_node *n,
+ int depth)
{
int err;
const struct NTFS_DE *e;
struct indx_node *r;
const struct INDEX_HDR *hdr = n ? &n->index->ihdr : &root->ihdr;
+ /*
+ * Limit recursion depth to prevent stack overflow from crafted
+ * images. Use the same bound as the fnd->nodes array (20).
+ */
+ if (depth > ARRAY_SIZE(((struct ntfs_fnd *)NULL)->nodes))
+ return ERR_PTR(-EINVAL);
+
/* Step 1: Scan one level. */
for (e = hdr_first_de(hdr);; e = hdr_next_de(hdr, e)) {
if (!e)
@@ -2043,7 +2051,8 @@ static struct indx_node *indx_find_buffe
if (err)
return ERR_PTR(err);
- r = indx_find_buffer(indx, ni, root, vbn, n);
+ r = indx_find_buffer(indx, ni, root, vbn, n,
+ depth + 1);
if (r)
return r;
}
@@ -2448,7 +2457,7 @@ int indx_delete_entry(struct ntfs_index
fnd_clear(fnd);
- in = indx_find_buffer(indx, ni, root, sub_vbn, NULL);
+ in = indx_find_buffer(indx, ni, root, sub_vbn, NULL, 0);
if (IS_ERR(in)) {
err = PTR_ERR(in);
goto out;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0982/1266] fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (980 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0981/1266] fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0983/1266] ntfs3: cap RESTART_TABLE free-chain walker at rt->used Greg Kroah-Hartman
` (16 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavitra Jha, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 3e127829e57f5190f612412ece4541cb96d5ec7a upstream.
In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and
UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove
destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,
where e->view.data_off comes from an on-disk NTFS_DE inside
an INDEX_ROOT or INDEX_BUFFER. Neither case validates
view.data_off + dlen against e->size; the existing
check_if_index_root / check_if_alloc_index helpers walk the
entry chain and validate the entry's offset, but not its
internal view fields.
The neighbouring read sites (e.g., fs/ntfs3/index.c when
iterating view entries) check view.data_off + view.data_size
<= e->size. Apply the same bound at the two memmove sites.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr_warn-only probe instrumentation: with view.data_off forced
to 0xFFFC, the memmove writes 32 bytes past the end of the
NTFS_DE.
This is similar in shape to Pavitra Jha's 2026-05-02 patch
"fs/ntfs3: prevent oob in case UpdateRecordDataRoot"
(<20260502105008.21827-1-jhapavitra98@gmail.com>) which
proposes calling ntfs3_bad_de_range(); that helper does not
exist in mainline. This patch uses inline checks.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Reported-by: Pavitra Jha <jhapavitra98@gmail.com>
Closes: https://lore.kernel.org/ntfs3/20260502105008.21827-1-jhapavitra98@gmail.com/
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3512,6 +3512,18 @@ move_data:
e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
+ /*
+ * e->view.data_off and dlen come from the on-disk
+ * INDEX_ROOT entry / LRH. The neighbouring read sites
+ * (e.g. fs/ntfs3/index.c) check that
+ * view.data_off + view.data_size <= e->size; mirror that
+ * bound here so the memmove cannot reach past the entry.
+ */
+ if (le16_to_cpu(e->view.data_off) > le16_to_cpu(e->size) ||
+ le16_to_cpu(e->view.data_off) + dlen >
+ le16_to_cpu(e->size))
+ goto dirty_vol;
+
memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
mi->dirty = true;
@@ -3718,6 +3730,12 @@ move_data:
goto dirty_vol;
}
+ /* See UpdateRecordDataRoot for the rationale. */
+ if (le16_to_cpu(e->view.data_off) > le16_to_cpu(e->size) ||
+ le16_to_cpu(e->view.data_off) + dlen >
+ le16_to_cpu(e->size))
+ goto dirty_vol;
+
memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
a_dirty = true;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0983/1266] ntfs3: cap RESTART_TABLE free-chain walker at rt->used
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (981 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0982/1266] fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0984/1266] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head Greg Kroah-Hartman
` (15 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 9611f644302c07d21bc8af97e3e06a3d30064253 upstream.
A crafted NTFS3 disk image triggers an in-kernel infinite loop at
mount time, hanging the mounting thread and firing the soft-lockup
watchdog within ~22s on multi-CPU hosts (panic with
kernel.softlockup_panic=1). The bug is reachable from desktop USB
auto-mount on distributions where udisks2 routes the NTFS signature
to the in-tree ntfs3 driver (Arch family and an increasing fraction
of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual
mount elsewhere.
check_rstbl()'s second walker iterates the free-entry singly-linked
list headed by rt->first_free with no upper bound on iteration count:
for (off = ff; off;) {
if (off == RESTART_ENTRY_ALLOCATED)
return false;
off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
if (off > ts - sizeof(__le32))
return false;
}
The existing guards cover three exits: end-of-list (off == 0), the
in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds
(off > ts - sizeof(__le32)). None of the three prevents an
in-bounds cycle.
A crafted on-disk RESTART_TABLE whose free chain contains a
self-loop or A->B->A cycle whose offsets satisfy:
- in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)]
- (off - sizeof(struct RESTART_TABLE)) % rsize == 0
passes all existing guards and spins the mount-time thread forever.
Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal
RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18
stores 0x18 as its next pointer; mount of the forged image with
the in-tree ntfs3 driver never returns.
Bound the walker by rt->used. Each entry on a legitimate free
chain is unique, and the total slot count is ne = le16_to_cpu
(rt->used). A traversal that visits more than ne slots is by
construction malformed; reject it as a corrupt RESTART_TABLE.
After this patch, mount of the forged image returns with -EINVAL
and a log_replay failure message, and mkntfs-produced legitimate
images mount cleanly (verified in the same UML harness).
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -764,8 +764,19 @@ static bool check_rstbl(const struct RES
/*
* Walk through the list headed by the first entry to make
* sure none of the entries are currently being used.
+ *
+ * Bound traversal by ne (rt->used) to defeat a crafted on-disk
+ * cycle in the free chain. Each entry in a legitimate free
+ * list is unique, so a chain that visits more than ne slots
+ * is malformed. Without this guard, an attacker-controlled
+ * RESTART_TABLE with a self-loop or A->B->A cycle whose
+ * offsets satisfy the existing alignment + in-bounds guards
+ * spins forever at mount time.
*/
- for (off = ff; off;) {
+ for (off = ff, i = 0; off; i++) {
+ if (i > ne)
+ return false;
+
if (off == RESTART_ENTRY_ALLOCATED)
return false;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0984/1266] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (982 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0983/1266] ntfs3: cap RESTART_TABLE free-chain walker at rt->used Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0985/1266] ntfs3: validate split-point offset in indx_insert_into_buffer Greg Kroah-Hartman
` (14 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 9b6926ac9c970ae0b2c2fe6289b16e9aa10b6a67 upstream.
indx_insert_into_root() promotes a full resident $INDEX_ROOT into
$INDEX_ALLOCATION and copies all non-last resident root entries into
a newly allocated INDEX_BUFFER via hdr_insert_head(). The source
byte count 'to_move' is summed from the on-disk resident entry sizes
and is independent of the destination buffer size, which comes from
root->index_block_size (via indx->index_bits).
A crafted NTFS image that keeps a valid, full resident root but
shrinks root->index_block_size down to 512 after the root has been
populated makes hdr_insert_head() memcpy attacker-controlled resident
entry bytes past the end of the kmalloc(1u << indx->index_bits)
allocation returned by indx_new(). For a 512-byte destination and a
resident root whose non-last entries total 560 bytes, the memcpy
overruns by 120 bytes and a following memmove extends the highest
written offset to 136 bytes past the allocation. The overflow bytes
are a direct copy of on-disk entries (via kmemdup), so they are
fully attacker-controlled.
The write is reachable from unprivileged open(O_CREAT) on a mounted
crafted NTFS image: a single sufficiently long create in a directory
whose resident root is already full forces root promotion and
triggers the copy.
This is a controlled out-of-bounds write of 120-136 bytes past a
kmalloc(index_block_size) allocation, with attacker-controlled
content. It is a bounded adjacent-heap corruption primitive; it is
not an arbitrary-address write. Successful exploitation into a named
victim object depends on the surrounding slab layout.
Reject the copy at the sink. The destination's INDEX_HDR already
reports hdr_total (the payload capacity of the new buffer) and
hdr_used (the bytes already consumed by the terminal END entry
installed by indx_new()); require that to_move fits in the remaining
payload before calling hdr_insert_head(). On mismatch, fail with
-EINVAL and mark the filesystem as having a detected on-disk
inconsistency, which is the same behaviour as the surrounding
validation in this function.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/index.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1745,6 +1745,22 @@ static int indx_insert_into_root(struct
hdr_used = le32_to_cpu(hdr->used);
hdr_total = le32_to_cpu(hdr->total);
+ /*
+ * The destination INDEX_BUFFER has 'hdr_total' bytes of payload
+ * available after the header, of which 'hdr_used' are already
+ * consumed by the single terminal END entry installed by
+ * indx_new(). A crafted image can present a resident root whose
+ * non-last entries (summing to 'to_move') exceed what fits in
+ * this buffer; copying them unchecked would overrun the
+ * kmalloc(1u << indx->index_bits) allocation backing the new
+ * buffer. Reject the copy in that case.
+ */
+ if (to_move > hdr_total - hdr_used) {
+ err = -EINVAL;
+ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
+ goto out_put_n;
+ }
+
/* Copy root entries into new buffer. */
hdr_insert_head(hdr, re, to_move);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0985/1266] ntfs3: validate split-point offset in indx_insert_into_buffer
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (983 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0984/1266] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0986/1266] ntfs3: fix out-of-bounds read in decompress_lznt Greg Kroah-Hartman
` (13 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit f1df9d771df47aa40de6d70949c28720ae1e430d upstream.
indx_insert_into_buffer() computes
used = used1 - to_copy - sp_size;
memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));
where sp and sp_size come from hdr_find_split(). hdr_find_split()
walks entries by le16_to_cpu(e->size) without validating that each
step stays within hdr->used or that the size field is at least
sizeof(struct NTFS_DE). index_hdr_check(), the on-load gatekeeper,
only validates header-level fields (used, total, de_off) and does
not walk per-entry sizes.
A crafted NTFS image whose leaf INDEX_HDR reports used == total but
contains one interior NTFS_DE with size = 0xFFF0 therefore passes
validation, descends to indx_insert_into_buffer() through the
ntfs_create() -> indx_insert_entry() path, and makes hdr_find_split()
return an sp whose sp_size (0xFFF0) greatly exceeds the remaining
bytes in the buffer. The u32 subtraction underflows and the memmove
count becomes a near-4-GiB value, producing an out-of-bounds kernel
write that corrupts adjacent allocations and panics the kernel.
Reproduced on 7.0.0-rc7 with UML + KASAN via a crafted image and a
single 'touch' inside the mounted directory; crash site resolves to
fs/ntfs3/index.c at the memmove. Trigger requires only local mount
of an attacker-supplied filesystem image (USB, loopback, or removable
media auto-mount).
Reject the split whenever the chosen sp plus its declared size
already extends past hdr1->used. This is the minimal fix; it
preserves the existing hdr_find_split() contract and relies on the
same out: cleanup path as the pre-existing error returns.
A prior OOB read in the very same indx_insert_into_buffer() memmove
was fixed in commit b8c44949044e ("fs/ntfs3: Fix OOB read in
indx_insert_into_buffer") by tightening hdr_find_e(), but that fix
does not cover the split-point size field path addressed here: sp is
returned by hdr_find_split(), not hdr_find_e(), and the underflow is
driven by sp->size rather than hdr->used exceeding hdr->total.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Cc: stable@vger.kernel.org
Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/index.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1865,6 +1865,20 @@ indx_insert_into_buffer(struct ntfs_inde
memcpy(up_e, sp, sp_size);
used1 = le32_to_cpu(hdr1->used);
+
+ /*
+ * hdr_find_split does not validate per-entry sizes, so a crafted
+ * NTFS_DE whose le16 size field is out of range can place sp such
+ * that (PtrOffset(hdr1, sp) + sp_size) exceeds used1. Without this
+ * guard the u32 'used = used1 - to_copy - sp_size' underflows and
+ * the subsequent memmove count becomes a near-4-GiB value,
+ * triggering an out-of-bounds kernel write.
+ */
+ if (PtrOffset(hdr1, sp) + sp_size > used1) {
+ err = -EINVAL;
+ goto out;
+ }
+
hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
if (!hdr1_saved) {
err = -ENOMEM;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0986/1266] ntfs3: fix out-of-bounds read in decompress_lznt
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (984 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0985/1266] ntfs3: validate split-point offset in indx_insert_into_buffer Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0987/1266] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
` (12 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+39b2fb0f2638669008ec,
Tristan Madani, Konstantin Komarov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
commit 7160a57192fb16d7a6fa9b7f5c7ac341d2444a89 upstream.
decompress_lznt() does not validate array index bounds before accessing
the decompression table. A corrupted NTFS3 image with invalid compressed
data can trigger an out-of-bounds read.
Add index bounds checking to prevent the OOB access.
Reported-by: syzbot+39b2fb0f2638669008ec@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/lznt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ntfs3/lznt.c
+++ b/fs/ntfs3/lznt.c
@@ -240,7 +240,7 @@ static inline ssize_t decompress_chunk(u
if (up - unc > LZNT_CHUNK_SIZE)
return -EINVAL;
/* Correct index */
- while (unc + s_max_off[index] < up)
+ while (index < ARRAY_SIZE(s_max_off) - 1 && unc + s_max_off[index] < up)
index += 1;
/* Check the current flag for zero. */
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0987/1266] power: supply: charger-manager: fix refcount leak in is_full_charged()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (985 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0986/1266] ntfs3: fix out-of-bounds read in decompress_lznt Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0988/1266] mips: sched: Fix CPUMASK_OFFSTACK memory corruption Greg Kroah-Hartman
` (11 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Sebastian Reichel
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 4373cfa38ead58f980362c841b0d0bdf8c4d956c upstream.
In is_full_charged(), power_supply_get_by_name() is called to
obtain a reference to the fuel_gauge power supply. If the
voltage check (uV >= desc->fullbatt_uV) succeeds, the function
returns true directly without releasing the reference, leaking
the refcount.
Fix this by setting a flag and jumping to the out label where
power_supply_put() properly drops the reference.
Cc: stable@vger.kernel.org
Fixes: e132fc6bb89b ("power: supply: charger-manager: Make decisions focussed on battery status")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260611005322.53096-1-vulab@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/charger-manager.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/power/supply/charger-manager.c
+++ b/drivers/power/supply/charger-manager.c
@@ -302,8 +302,10 @@ static bool is_full_charged(struct charg
if (cm->battery_status == POWER_SUPPLY_STATUS_FULL
&& desc->fullbatt_vchkdrop_uV)
uV += desc->fullbatt_vchkdrop_uV;
- if (uV >= desc->fullbatt_uV)
- return true;
+ if (uV >= desc->fullbatt_uV) {
+ is_full = true;
+ goto out;
+ }
}
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0988/1266] mips: sched: Fix CPUMASK_OFFSTACK memory corruption
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (986 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0987/1266] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0989/1266] riscv: cacheinfo: Fix node reference leak in populate_cache_leaves Greg Kroah-Hartman
` (10 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aaron Tomlin, Thomas Bogendoerfer
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Tomlin <atomlin@atomlin.com>
commit 98e37db4a34d3af3fb2f4648295c25b5e40b20e3 upstream.
This patch addresses a critical memory management flaw. When
CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer.
Consequently, sizeof(new_mask) evaluates to the pointer size, causing
copy_from_user() to clobber the mask pointer. Furthermore, the old
logic performed copy_from_user() before allocating the mask.
Fix this by allocating new_mask first. To handle variable-sized user
masks correctly, use cpumask_size() to truncate overly large user masks
or pad undersized masks with zeros before copying the data directly into
the allocated buffer.
Fixes: 295cbf6d63165 ("[MIPS] Move FPU affinity code into separate file.")
Cc: stable@vger.kernel.org
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/mips-mt-fpaff.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -70,11 +70,16 @@ asmlinkage long mipsmt_sys_sched_setaffi
struct task_struct *p;
int retval;
- if (len < sizeof(new_mask))
- return -EINVAL;
-
- if (copy_from_user(&new_mask, user_mask_ptr, sizeof(new_mask)))
- return -EFAULT;
+ if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
+ return -ENOMEM;
+ if (len < cpumask_size())
+ cpumask_clear(new_mask);
+ else if (len > cpumask_size())
+ len = cpumask_size();
+ if (copy_from_user(new_mask, user_mask_ptr, len)) {
+ retval = -EFAULT;
+ goto out_free_new_mask;
+ }
cpus_read_lock();
rcu_read_lock();
@@ -83,7 +88,8 @@ asmlinkage long mipsmt_sys_sched_setaffi
if (!p) {
rcu_read_unlock();
cpus_read_unlock();
- return -ESRCH;
+ retval = -ESRCH;
+ goto out_free_new_mask;
}
/* Prevent p going away */
@@ -94,13 +100,9 @@ asmlinkage long mipsmt_sys_sched_setaffi
retval = -ENOMEM;
goto out_put_task;
}
- if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) {
- retval = -ENOMEM;
- goto out_free_cpus_allowed;
- }
if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) {
retval = -ENOMEM;
- goto out_free_new_mask;
+ goto out_free_cpus_allowed;
}
if (!check_same_owner(p) && !capable(CAP_SYS_NICE)) {
retval = -EPERM;
@@ -141,13 +143,13 @@ asmlinkage long mipsmt_sys_sched_setaffi
}
out_unlock:
free_cpumask_var(effective_mask);
-out_free_new_mask:
- free_cpumask_var(new_mask);
out_free_cpus_allowed:
free_cpumask_var(cpus_allowed);
out_put_task:
put_task_struct(p);
cpus_read_unlock();
+out_free_new_mask:
+ free_cpumask_var(new_mask);
return retval;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0989/1266] riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (987 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0988/1266] mips: sched: Fix CPUMASK_OFFSTACK memory corruption Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0990/1266] mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() Greg Kroah-Hartman
` (9 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zishun Yi, Paul Walmsley
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zishun Yi <vulab@iscas.ac.cn>
commit bf4a195f063b0a0805c1417f6aad1dd32ea48f0f upstream.
Currently, the while loop drops the reference to prev in each iteration.
If the loop terminates early due to a break, the final of_node_put(np)
correctly drops the reference to the current node.
However, if the loop terminates naturally because np == NULL, calling
of_node_put(np) is a no-op. This leaves the last valid node stored in
prev without its reference dropped, resulting in a node reference leak.
Fix this by changing the final `of_node_put(np)` to `of_node_put(prev)`.
Fixes: 94f9bf118f1e ("RISC-V: Fix of_node_* refcount")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260509074040.1747800-1-vulab@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/cacheinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/kernel/cacheinfo.c
+++ b/arch/riscv/kernel/cacheinfo.c
@@ -128,7 +128,7 @@ int populate_cache_leaves(unsigned int c
ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
levels = level;
}
- of_node_put(np);
+ of_node_put(prev);
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0990/1266] mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (988 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0989/1266] riscv: cacheinfo: Fix node reference leak in populate_cache_leaves Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0991/1266] mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error Greg Kroah-Hartman
` (8 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit d58fdbe37a829fd2e5803dd4e5a72992dd8c5368 upstream.
Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in
error paths".
Error paths of damon_sysfs_access_pattern_add_dirs() and
damon_sysfs_scheme_add_dirs() functions put references to directories in
wrong orders. As a result, uninitialized memory dereference and/or
memory leak can happen. Fix those.
This patch (of 2):
In access_pattern_add_dirs(), error handling path puts references starting
from setup failed directories. If the failure happpened from the initial
allication in the setup functions, uninitialized memory dereference
happen. The allocation failures will not commonly happen, but the
consequence is quite bad. Fix the wrong reference put orders.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260618005650.83868-2-sj@kernel.org
Link: https://lore.kernel.org/20260617060005.86852-1-sj@kernel.org [1]
Fixes: 7e84b1f8212a ("mm/damon/sysfs: support DAMON-based Operation Schemes")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -1077,22 +1077,19 @@ static int damon_sysfs_access_pattern_ad
err = damon_sysfs_access_pattern_add_range_dir(access_pattern,
&access_pattern->sz, "sz");
if (err)
- goto put_sz_out;
+ return err;
err = damon_sysfs_access_pattern_add_range_dir(access_pattern,
&access_pattern->nr_accesses, "nr_accesses");
if (err)
- goto put_nr_accesses_sz_out;
+ goto put_sz_out;
err = damon_sysfs_access_pattern_add_range_dir(access_pattern,
&access_pattern->age, "age");
if (err)
- goto put_age_nr_accesses_sz_out;
+ goto put_nr_accesses_sz_out;
return 0;
-put_age_nr_accesses_sz_out:
- kobject_put(&access_pattern->age->kobj);
- access_pattern->age = NULL;
put_nr_accesses_sz_out:
kobject_put(&access_pattern->nr_accesses->kobj);
access_pattern->nr_accesses = NULL;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0991/1266] mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (989 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0990/1266] mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0992/1266] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
` (7 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 05ea83ee88ca70f8932906d9f2617ff996f45b50 upstream.
damon_sysfs_scheme_add_dirs() setup the tried_regions directory after the
stats directory setup is completed. When the tried_regions directory
setup is failed, the setup function ensures the reference for the tried
regions directory is released. Hence the error path should put references
on setup succeeded directory objects, starting from the stats directory.
However, the error path is putting the tried_regions directory instead of
the stats directory.
As a direct result, the stats directory object is leaked. Worse yet, if
the tried_regions directory setup failed from the initial allocation, the
scheme->tried_regions field remains uninitialized. The following
kobject_put(&scheme->tried_regions->kobj) call in the error path will
dereference the uninitialized memory. The setup failures should not be
common. But once it happens, the consequence is quite bad.
Fix this issue by correctly putting the stats directory instead of the
tried_regions directory.
The issue was discovered [1] by Sashiko.
Link: https://lore.kernel.org/20260618005650.83868-3-sj@kernel.org
Link: https://lore.kernel.org/20260617005223.96813-1-sj@kernel.org [1]
Fixes: 5181b75f438d ("mm/damon/sysfs-schemes: implement schemes/tried_regions directory")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.2.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs-schemes.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -1303,12 +1303,12 @@ static int damon_sysfs_scheme_add_dirs(s
goto put_filters_watermarks_quotas_access_pattern_out;
err = damon_sysfs_scheme_set_tried_regions(scheme);
if (err)
- goto put_tried_regions_out;
+ goto put_stats_out;
return 0;
-put_tried_regions_out:
- kobject_put(&scheme->tried_regions->kobj);
- scheme->tried_regions = NULL;
+put_stats_out:
+ kobject_put(&scheme->stats->kobj);
+ scheme->stats = NULL;
put_filters_watermarks_quotas_access_pattern_out:
kobject_put(&scheme->filters->kobj);
scheme->filters = NULL;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0992/1266] proc: only bump parent nlink when registering directories
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (990 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0991/1266] mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0993/1266] mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE Greg Kroah-Hartman
` (6 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Christian Brauner (Amutable)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 16b02eb4b9b272c221255c20d34ccd5db53a3ed3 upstream.
proc_register() increments the parent directory's link count for every
entry it registers, while remove_proc_entry() and remove_proc_subtree()
decrement it only when the removed entry is a directory. Regular files
thus inflate the parent's count while they exist, and leak one link
permanently on every create and remove cycle.
For example, /proc/bus/pci/00 with twenty-two device files and no
subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
and disable cycles, each creating and removing the VF config space
entries under /proc/bus/pci/<bus>, inflate the link count of that
directory without bound.
Before commit e06689bf5701 ("proc: change ->nlink under
proc_subdir_lock"), the increment lived in proc_mkdir_data() and
proc_create_mount_point(), and was therefore applied only to
directories. Moving it into proc_register() to bring it under
proc_subdir_lock dropped the S_ISDIR check.
Thus, move the nlink accounting into pde_subdir_insert() and
pde_erase(), only updating it for directories in both, so the link
count is always changed together with the directory entry itself.
Fixes: e06689bf5701 ("proc: change ->nlink under proc_subdir_lock")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260613211005.921692-1-kwilczynski@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -112,6 +112,8 @@ static bool pde_subdir_insert(struct pro
/* Add new node and rebalance tree. */
rb_link_node(&de->subdir_node, parent, new);
rb_insert_color(&de->subdir_node, root);
+ if (S_ISDIR(de->mode))
+ dir->nlink++;
return true;
}
@@ -399,7 +401,6 @@ struct proc_dir_entry *proc_register(str
write_unlock(&proc_subdir_lock);
goto out_free_inum;
}
- dir->nlink++;
write_unlock(&proc_subdir_lock);
return dp;
@@ -698,6 +699,8 @@ static void pde_erase(struct proc_dir_en
{
rb_erase(&pde->subdir_node, &parent->subdir);
RB_CLEAR_NODE(&pde->subdir_node);
+ if (S_ISDIR(pde->mode))
+ parent->nlink--;
}
/*
@@ -723,8 +726,6 @@ void remove_proc_entry(const char *name,
de = NULL;
} else {
pde_erase(de, parent);
- if (S_ISDIR(de->mode))
- parent->nlink--;
}
}
write_unlock(&proc_subdir_lock);
@@ -783,8 +784,6 @@ int remove_proc_subtree(const char *name
continue;
}
next = de->parent;
- if (S_ISDIR(de->mode))
- next->nlink--;
write_unlock(&proc_subdir_lock);
proc_entry_rundown(de);
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0993/1266] mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (991 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0992/1266] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0994/1266] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
` (5 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, David Hildenbrand (Arm),
Mike Rapoport (Microsoft), Liam R. Howlett, Aneesh Kumar K.V,
Joao Martins, Lorenzo Stoakes, Madhavan Srinivasan,
Michael Ellerman, Michal Hocko, Nicholas Piggin, Oscar Salvador,
Suren Baghdasaryan, Vlastimil Babka, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muchun Song <songmuchun@bytedance.com>
commit cd681403a87085562499d60325b7b45d3be11217 upstream.
If DAX memory is hotplugged into an unoccupied subsection of an early
section, section_activate() reuses the unoptimized boot memmap. However,
compound_nr_pages() still assumes that vmemmap optimization is in effect
and initializes only the reduced number of struct pages. As a result, the
remaining tail struct pages are left uninitialized, which can later lead
to unexpected behavior or crashes.
Fix this by treating early sections as unoptimized when calculating how
many struct pages to initialize.
Link: https://lore.kernel.org/20260428081855.1249045-7-songmuchun@bytedance.com
Fixes: 6fd3620b3428 ("mm/page_alloc: reuse tail struct pages for compound devmaps")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Acked-by: Liam R. Howlett <liam@infradead.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: Joao Martins <joao.m.martins@oracle.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mm_init.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -1024,10 +1024,17 @@ static void __ref __init_zone_device_pag
* of how the sparse_vmemmap internals handle compound pages in the lack
* of an altmap. See vmemmap_populate_compound_pages().
*/
-static inline unsigned long compound_nr_pages(struct vmem_altmap *altmap,
+static inline unsigned long compound_nr_pages(unsigned long pfn,
+ struct vmem_altmap *altmap,
struct dev_pagemap *pgmap)
{
- if (!vmemmap_can_optimize(altmap, pgmap))
+ /*
+ * If DAX memory is hot-plugged into an unoccupied subsection
+ * of an early section, the unoptimized boot memmap is reused.
+ * See section_activate().
+ */
+ if (early_section(__pfn_to_section(pfn)) ||
+ !vmemmap_can_optimize(altmap, pgmap))
return pgmap_vmemmap_nr(pgmap);
return VMEMMAP_RESERVE_NR * (PAGE_SIZE / sizeof(struct page));
@@ -1095,7 +1102,7 @@ void __ref memmap_init_zone_device(struc
continue;
memmap_init_compound(page, pfn, zone_idx, nid, pgmap,
- compound_nr_pages(altmap, pgmap));
+ compound_nr_pages(pfn, altmap, pgmap));
}
pr_debug("%s initialised %lu pages in %ums\n", __func__,
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0994/1266] mtd: slram: remove failed entries from the device list
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (992 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0993/1266] mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0995/1266] 9p: skip nlink update in cacheless mode to fix WARN_ON Greg Kroah-Hartman
` (4 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Miquel Raynal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 36f1648644d769c496a8e47e53603e863e358d73 upstream.
register_device() links a new slram_mtdlist entry before allocating all
of the state needed by the entry. If a later allocation, memremap(), or
mtd_device_register() fails, the partially initialized entry remains on
the global list. A later cleanup can then dereference or free invalid
state from that failed entry.
Unwind the partially initialized entry and clear the list tail on each
failure path after the entry has been linked.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/devices/slram.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -129,6 +129,7 @@ static int slram_write(struct mtd_info *
static int register_device(char *name, unsigned long start, unsigned long length)
{
slram_mtd_list_t **curmtd;
+ int ret = -ENOMEM;
curmtd = &slram_mtdlist;
while (*curmtd) {
@@ -155,14 +156,15 @@ static int register_device(char *name, u
if (!(*curmtd)->mtdinfo) {
E("slram: Cannot allocate new MTD device.\n");
- return(-ENOMEM);
+ goto err_free_list;
}
if (!(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start =
memremap(start, length,
MEMREMAP_WB | MEMREMAP_WT | MEMREMAP_WC))) {
E("slram: memremap failed\n");
- return -EIO;
+ ret = -EIO;
+ goto err_free_priv;
}
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end =
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start + length;
@@ -183,10 +185,8 @@ static int register_device(char *name, u
if (mtd_device_register((*curmtd)->mtdinfo, NULL, 0)) {
E("slram: Failed to register new device\n");
- memunmap(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start);
- kfree((*curmtd)->mtdinfo->priv);
- kfree((*curmtd)->mtdinfo);
- return(-EAGAIN);
+ ret = -EAGAIN;
+ goto err_unmap;
}
T("slram: Registered device %s from %luKiB to %luKiB\n", name,
(start / 1024), ((start + length) / 1024));
@@ -194,6 +194,16 @@ static int register_device(char *name, u
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start,
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end);
return(0);
+
+err_unmap:
+ memunmap(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start);
+err_free_priv:
+ kfree((*curmtd)->mtdinfo->priv);
+err_free_list:
+ kfree((*curmtd)->mtdinfo);
+ kfree(*curmtd);
+ *curmtd = NULL;
+ return ret;
}
static void unregister_devices(void)
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0995/1266] 9p: skip nlink update in cacheless mode to fix WARN_ON
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (993 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0994/1266] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0996/1266] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
` (3 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dominique Martinet, Breno Leitao
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 574aa0b4799470ac814479f1138d19efe6262255 upstream.
v9fs_dec_count() unconditionally calls drop_nlink() on regular files,
even when the inode's nlink is already zero. In cacheless mode the
client refetches inode metadata from the server (the source of truth)
on every operation, so by the time v9fs_remove() returns, the locally
cached nlink may already reflect the post-unlink value:
1. Client initiates unlink, server processes it and sets nlink to 0
2. Client refetches inode metadata (nlink=0) before unlink returns
3. Client's v9fs_remove() completes successfully
4. Client calls v9fs_dec_count() which calls drop_nlink() on nlink=0
This race is easily triggered under heavy unlink workloads, such as
stress-ng's unlink stressor, producing the following warning:
WARNING: fs/inode.c:417 at drop_nlink+0x4c/0xc8
Call trace:
drop_nlink+0x4c/0xc8
v9fs_remove+0x1e0/0x250 [9p]
v9fs_vfs_unlink+0x20/0x38 [9p]
vfs_unlink+0x13c/0x258
...
In cacheless mode the server is authoritative and the inode is on its
way out, so locally adjusting nlink buys nothing. Skip v9fs_dec_count()
entirely when neither CACHE_META nor CACHE_LOOSE is set, which both
avoids the warning and removes a class of nlink races (two concurrent
unlinkers observing nlink > 0 and both calling drop_nlink()) that an
nlink == 0 guard alone would only narrow rather than close.
Fixes: ac89b2ef9b55 ("9p: don't maintain dir i_nlink if the exported fs doesn't either")
Cc: stable@vger.kernel.org
Suggested-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Message-ID: <20260421-9p-v2-1-48762d294fad@debian.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/9p/vfs_inode.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -521,10 +521,19 @@ static int v9fs_at_to_dotl_flags(int fla
* - ext4 (with dir_nlink feature enabled) sets nlink to 1 if a dir has more
* than EXT4_LINK_MAX (65000) links.
*
+ * In cacheless mode the server is the source of truth for nlink and the
+ * inode is going away immediately, so locally adjusting i_nlink buys
+ * nothing and races with concurrent metadata fetches that may already
+ * have observed the post-unlink value (nlink == 0).
+ *
* @inode: inode whose nlink is being dropped
*/
static void v9fs_dec_count(struct inode *inode)
{
+ struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
+
+ if (!(v9ses->cache & (CACHE_META | CACHE_LOOSE)))
+ return;
if (!S_ISDIR(inode->i_mode) || inode->i_nlink > 2)
drop_nlink(inode);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0996/1266] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (994 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0995/1266] 9p: skip nlink update in cacheless mode to fix WARN_ON Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0997/1266] scsi: sas: Skip opt_sectors when DMA reports no real optimization hint Greg Kroah-Hartman
` (2 subsequent siblings)
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Wilck, Don Brace, storagedev,
Hannes Reinecke, Hannes Reinecke, Christoph Hellwig,
Martin K. Petersen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
commit 57db1307afb1f83d45f5ff53b93f8d040100d13e upstream.
shost_to_hba() is used everywhere except to obtain pqi_ctrl_info from
shosti, except in pqi_scan_finished(), where shost_priv() is used. This
causes one pointer dereference to be missed, as shost->hostdata is a
pointer in smartpqi. Fix it.
Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
Signed-off-by: Martin Wilck <martin.wilck@suse.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
Cc: Don Brace <don.brace@microchip.com>
Cc: storagedev@microchip.com
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260513174236.430465-2-mwilck@suse.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/smartpqi/smartpqi_init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2613,7 +2613,7 @@ static int pqi_scan_finished(struct Scsi
{
struct pqi_ctrl_info *ctrl_info;
- ctrl_info = shost_priv(shost);
+ ctrl_info = shost_to_hba(shost);
return !mutex_is_locked(&ctrl_info->scan_mutex);
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0997/1266] scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (995 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0996/1266] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0998/1266] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0999/1266] mtd: rawnand: pl353: fix probe resource allocation Greg Kroah-Hartman
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Garry, Ionut Nechita,
Christoph Hellwig, Martin K. Petersen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ionut Nechita <ionut.nechita@windriver.com>
commit be8fcd4a8217a916344c88a4b1b84f5736dda17e upstream.
sas_host_setup() unconditionally sets shost->opt_sectors from
dma_opt_mapping_size().
When the IOMMU is disabled or in passthrough mode and no DMA ops provide
an opt_mapping_size callback, dma_opt_mapping_size() returns
min(dma_max_mapping_size(), SIZE_MAX) which equals
dma_max_mapping_size() — a hard upper bound, not an optimization hint.
On a Dell PowerEdge R750 with mpt3sas (Broadcom SAS3816, FW 33.15.00.00)
and intel_iommu=off the following values are observed:
dma_opt_mapping_size() = dma_max_mapping_size() (no real hint)
shost->max_sectors = 32767
opt_sectors = min(32767, huge >> 9) = 32767
optimal_io_size = 32767 << 9 = 16776704
→ round_down(16776704, 4096) = 16773120
The SAS disk (SAMSUNG MZILT800HBHQ0D3) does not report an Optimal
Transfer Length in VPD page B0, so sdkp->opt_xfer_blocks remains 0.
sd_revalidate_disk() then uses min_not_zero(0, opt_sectors) =
opt_sectors, propagating the bogus value into the block device's
optimal_io_size (visible as OPT-IO = 16773120 in lsblk --topology).
mkfs.xfs picks up optimal_io_size and minimum_io_size and computes:
swidth = 16773120 / 4096 = 4095
sunit = 8192 / 4096 = 2
Since 4095 % 2 != 0, XFS rejects the geometry:
SB stripe unit sanity check failed
This makes it impossible to create XFS filesystems (e.g. for
/var/lib/docker) during system bootstrap.
Fix this by introducing a sas_dma_setup_opt_sectors() helper that sets
opt_sectors only when dma_opt_mapping_size() is strictly less than
dma_max_mapping_size(), indicating a genuine DMA optimization
constraint.
The helper computes min(opt_sectors, max_sectors) first, then rounds
down to a power of two so that filesystem geometry calculations always
produce clean results.
When the two DMA values are equal, no backend provided a real hint, so
opt_sectors stays at 0 ("no preference").
[mkp: implemented hch's suggestion]
Fixes: 4cbfca5f7750 ("scsi: scsi_transport_sas: cap shost opt_sectors according to DMA optimal limit")
Cc: stable@vger.kernel.org
Reviewed-by: John Garry <john.g.garry@oracle.com>
Signed-off-by: Ionut Nechita <ionut.nechita@windriver.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260519135238.373784-2-ionut.nechita@windriver.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_transport_sas.c | 41 +++++++++++++++++++++++++++++++++-----
1 file changed, 36 insertions(+), 5 deletions(-)
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -27,6 +27,7 @@
#include <linux/module.h>
#include <linux/jiffies.h>
#include <linux/err.h>
+#include <linux/log2.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/blkdev.h>
@@ -220,12 +221,45 @@ static int sas_bsg_initialize(struct Scs
* SAS host attributes
*/
+/*
+ * Set shost->opt_sectors from the DMA optimal mapping size, but only
+ * when dma_opt_mapping_size() is strictly less than dma_max_mapping_size(),
+ * indicating a genuine optimization hint from an IOMMU or DMA backend.
+ * When the two are equal (e.g. IOMMU disabled / passthrough), no real
+ * hint exists, so leave opt_sectors at 0 to avoid bogus optimal_io_size
+ * values that break filesystem geometry (e.g. mkfs.xfs stripe alignment).
+ */
+static void sas_dma_setup_opt_sectors(struct Scsi_Host *shost)
+{
+ struct device *dma_dev = shost->dma_dev;
+ size_t opt = dma_opt_mapping_size(dma_dev);
+ size_t max = dma_max_mapping_size(dma_dev);
+ unsigned int opt_sectors;
+
+ /* opt >= max means no real hint was provided by the DMA layer */
+ if (opt >= max)
+ return;
+
+ /* Clamp to max_sectors to avoid overflow in sector arithmetic */
+ opt_sectors = min_t(unsigned int, opt >> SECTOR_SHIFT,
+ shost->max_sectors);
+
+ /* Guard against zero before rounddown_pow_of_two() */
+ if (!opt_sectors)
+ return;
+
+ /*
+ * Round down to power-of-two so filesystem geometry calculations
+ * (e.g. XFS stripe width/unit) always produce clean divisors.
+ */
+ shost->opt_sectors = rounddown_pow_of_two(opt_sectors);
+}
+
static int sas_host_setup(struct transport_container *tc, struct device *dev,
struct device *cdev)
{
struct Scsi_Host *shost = dev_to_shost(dev);
struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
- struct device *dma_dev = shost->dma_dev;
INIT_LIST_HEAD(&sas_host->rphy_list);
mutex_init(&sas_host->lock);
@@ -237,10 +271,7 @@ static int sas_host_setup(struct transpo
dev_printk(KERN_ERR, dev, "fail to a bsg device %d\n",
shost->host_no);
- if (dma_dev->dma_mask) {
- shost->opt_sectors = min_t(unsigned int, shost->max_sectors,
- dma_opt_mapping_size(dma_dev) >> SECTOR_SHIFT);
- }
+ sas_dma_setup_opt_sectors(shost);
return 0;
}
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0998/1266] ocfs2: use kzalloc for quota recovery bitmap allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (996 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0997/1266] scsi: sas: Skip opt_sectors when DMA reports no real optimization hint Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0999/1266] mtd: rawnand: pl353: fix probe resource allocation Greg Kroah-Hartman
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7ea0b96c4ddb49fd1a70,
Tristan Madani, Joseph Qi, Mark Fasheh, Joel Becker, Junxiao Bi,
Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
commit 93c8c6ea90be9e9df8fe14048ad4e3caad0770a6 upstream.
ocfs2 quota recovery allocates a bitmap buffer with kmalloc and does not
fully initialize it. This can lead to use of uninitialized bits during
quota recovery from a corrupted filesystem image.
Use kzalloc instead to ensure the bitmap is zero-initialized.
Link: https://lore.kernel.org/20260418131048.1052507-1-tristmd@gmail.com
Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/quota_local.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -302,7 +302,7 @@ static int ocfs2_add_recovery_chunk(stru
if (!rc)
return -ENOMEM;
rc->rc_chunk = chunk;
- rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
+ rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
if (!rc->rc_bitmap) {
kfree(rc);
return -ENOMEM;
^ permalink raw reply [flat|nested] 1272+ messages in thread
* [PATCH 6.6 0999/1266] mtd: rawnand: pl353: fix probe resource allocation
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
` (997 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 6.6 0998/1266] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
998 siblings, 0 replies; 1272+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bastien Curutchet, Miquel Raynal
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet <bastien.curutchet@bootlin.com>
commit 19ed11aee966d91beebdef9d32ce926474872f79 upstream.
During probe(), the devm_ioremap() is called with the parent device
instead of the current one. So when the module is unloaded, the register
area isn't released.
Target the pl35x device in the devm_ioremap() instead of its parent.
Cc: stable@vger.kernel.org
Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/pl35x-nand-controller.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c
+++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c
@@ -1153,7 +1153,7 @@ static int pl35x_nand_probe(struct platf
nfc->controller.ops = &pl35x_nandc_ops;
INIT_LIST_HEAD(&nfc->chips);
- nfc->conf_regs = devm_ioremap_resource(&smc_amba->dev, &smc_amba->res);
+ nfc->conf_regs = devm_ioremap_resource(nfc->dev, &smc_amba->res);
if (IS_ERR(nfc->conf_regs))
return PTR_ERR(nfc->conf_regs);
^ permalink raw reply [flat|nested] 1272+ messages in thread
end of thread, other threads:[~2026-07-21 20:55 UTC | newest]
Thread overview: 1272+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-21 15:07 [PATCH 6.6 0000/1266] 6.6.145-rc1 review Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0001/1266] bpf, arm64: Reject out-of-range B.cond targets Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0002/1266] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0003/1266] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0004/1266] ext4: get rid of ppath in get_ext_path() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0005/1266] LoongArch: Report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0006/1266] Bluetooth: btmtk: apply the common btmtk_fw_get_filename Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0007/1266] Bluetooth: btusb: mediatek: reset the controller before downloading the fw Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0008/1266] Bluetooth: btusb: mediatek: add MT7922 subsystem reset Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0009/1266] Bluetooth: btusb: mediatek: remove the unnecessary goto tag Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0010/1266] Bluetooth: btusb: mediatek: return error for failed reg access Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0011/1266] Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0012/1266] Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0013/1266] Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0014/1266] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0015/1266] perf: Fix dangling cgroup pointer in cpuctx backport Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0016/1266] Bluetooth: btmtk: Fix btmtk.c undefined reference build error Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0017/1266] slimbus: qcom-ngd-ctrl: Fix probe error path ordering Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0018/1266] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0019/1266] slimbus: Convert to platform remove callback returning void Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0020/1266] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0021/1266] drm/amd: Fix set but not used warnings Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0022/1266] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0023/1266] device property: initialize the remaining fields of fwnode_handle in fwnode_init() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0024/1266] f2fs: validate orphan inode entry count Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0025/1266] f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0026/1266] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0027/1266] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0028/1266] f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0029/1266] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0030/1266] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0031/1266] block: Avoid mounting the bdev pseudo-filesystem in userspace Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0032/1266] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0033/1266] i2c: core: fix hang " Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0034/1266] i2c: core: fix NULL-deref " Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0035/1266] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0036/1266] i2c: core: fix adapter registration race Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0037/1266] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0038/1266] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0039/1266] nfsd: Dont reset the write verifier on a commit EAGAIN Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0040/1266] apparmor: advertise the tcp fast open fix is applied Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0041/1266] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
2026-07-21 15:07 ` [PATCH 6.6 0042/1266] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0043/1266] net: team: rename team to team_core for linking Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0044/1266] net, team, bonding: Add netdev_base_features helper Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0045/1266] bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0046/1266] bonding: add ESP offload features when slaves support Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0047/1266] bonding: Correctly support GSO ESP offload Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0048/1266] net: add a common function to compute features for upper devices Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0049/1266] bonding: use common function to compute the features Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0050/1266] bonding: fix xfrm offload feature setup on active-backup mode Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0051/1266] bonding: fix type confusion in bond_setup_by_slave() Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0052/1266] bonding: prevent potential infinite loop in bond_header_parse() Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0053/1266] team: fix header_ops type confusion with non-Ethernet ports Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0054/1266] mm/vmscan: flush deferred TLB before freeing large folios Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0055/1266] xfs: recreate work items when recovering intent items Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0056/1266] xfs: dump the recovered xattri log item if corruption happens Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0057/1266] xfs: use xfs_defer_finish_one to finish recovered work items Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0058/1266] xfs: move ->iop_recover to xfs_defer_op_type Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0059/1266] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0060/1266] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0061/1266] ACPI: CPPC: Suppress UBSAN warning caused by field misuse Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0062/1266] ACPI: NFIT: core: Fix possible NULL pointer dereference Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0063/1266] rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0064/1266] perf/core: Detach event groups during remove_on_exec Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0065/1266] Revert "crypto: talitos - rename first/last to first_desc/last_desc" Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0066/1266] Revert "crypto: talitos - fix SEC1 32k ahash request limitation" Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0067/1266] crypto: talitos - stop using crypto_ahash::init Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0068/1266] crypto: talitos - fix SEC1 32k ahash request limitation Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0069/1266] crypto: talitos - rename first/last to first_desc/last_desc Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0070/1266] arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0071/1266] arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0072/1266] arm64: Fix early handling of FEAT_E2H0 not being implemented Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0073/1266] KVM: arm64: Initialize HCR_EL2.E2H early Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0074/1266] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0075/1266] arm64: Revamp HCR_EL2.E2H RES1 detection Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0076/1266] arm64: sysreg: Correct sign definitions for EIESB and DoubleLock Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0077/1266] virtio_net: Support dynamic rss indirection table size Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0078/1266] LoongArch: Add PIO for early access before ACPI PCI root register Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0079/1266] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0080/1266] MIPS: smp: report dying CPU to RCU in stop_this_cpu() Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0081/1266] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0082/1266] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0083/1266] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0084/1266] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0085/1266] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0086/1266] iio: adc: spear: " Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0087/1266] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0088/1266] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0089/1266] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0090/1266] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0091/1266] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0092/1266] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0093/1266] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0094/1266] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0095/1266] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0096/1266] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0097/1266] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0098/1266] iio: light: tsl2591: return actual error from probe IRQ failure Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0099/1266] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0100/1266] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0101/1266] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
2026-07-21 15:08 ` [PATCH 6.6 0102/1266] ALSA: virtio: Add missing 384 kHz PCM rate mapping Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0103/1266] ALSA: ymfpci: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0104/1266] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0105/1266] ALSA: cmipci: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0106/1266] ALSA: es1938: " Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0107/1266] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0108/1266] ALSA: gus: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0109/1266] ALSA: ice1712: " Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0110/1266] ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0111/1266] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0112/1266] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0113/1266] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0114/1266] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0115/1266] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0116/1266] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0117/1266] vfio/pci: Use a private flag to prevent power state change with VFs Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0118/1266] vfio/pci: Latch disable_idle_d3 per device Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0119/1266] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0120/1266] vfio/pci: Fix racy bitfields and tighten struct layout Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0121/1266] vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0122/1266] Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0123/1266] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0124/1266] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0125/1266] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0126/1266] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0127/1266] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0128/1266] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0129/1266] usb: typec: tcpci_rt1711h: unregister TCPCI port with devres Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0130/1266] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0131/1266] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0132/1266] mm/damon/ops-common: handle extreme intervals in damon_hot_score() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0133/1266] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0134/1266] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0135/1266] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0136/1266] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0137/1266] usb: dwc3: run gadget disconnect from sleepable suspend context Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0138/1266] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0139/1266] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0140/1266] staging: vme_user: bound slave read/write to the kern_buf size Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0141/1266] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0142/1266] staging: vme_user: fix location monitor leak in fake bridge Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0143/1266] staging: vme_user: fix location monitor leak in tsi148 bridge Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0144/1266] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0145/1266] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0146/1266] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0147/1266] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0148/1266] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0149/1266] staging: rtl8723bs: fix OOB read in update_beacon_info() " Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0150/1266] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0151/1266] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0152/1266] staging: rtl8723bs: fix OOB write in HT_caps_handler() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0153/1266] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0154/1266] ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0155/1266] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0156/1266] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0157/1266] Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0158/1266] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0159/1266] fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0160/1266] NTB: epf: Avoid calling pci_irq_vector() from hardirq context Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0161/1266] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
2026-07-21 15:09 ` [PATCH 6.6 0162/1266] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0163/1266] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0164/1266] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0165/1266] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0166/1266] mm: shrinker: fix NULL pointer dereference in debugfs Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0167/1266] netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0168/1266] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0169/1266] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0170/1266] Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0171/1266] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0172/1266] Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0173/1266] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0174/1266] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0175/1266] fs/ntfs3: fsync files by syncing parent inodes Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0176/1266] fs/ntfs3: handle attr_set_size() errors when truncating files Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0177/1266] fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0178/1266] fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0179/1266] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0180/1266] smb/client: Fix error code in smb2_aead_req_alloc() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0181/1266] ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0182/1266] ksmbd: add a permission check for FSCTL_SET_ZERO_DATA Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0183/1266] ksmbd: serialize QUERY_DIRECTORY requests per file Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0184/1266] ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0185/1266] ksmbd: require source read access for duplicate extents Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0186/1266] ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0187/1266] ksmbd: run set info with opener credentials Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0188/1266] ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0189/1266] ksmbd: add per-handle permission check to FILE_LINK_INFORMATION Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0190/1266] ksmbd: use opener credentials for delete-on-close Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0191/1266] smb: client: fix query directory replay double-free Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0192/1266] smb: client: fix query_info() " Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0193/1266] smb: client: fix double-free in SMB2_ioctl() replay Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0194/1266] smb: client: fix change notify replay double-free Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0195/1266] smb: client: fix double-free in SMB2_flush() replay Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0196/1266] smb: client: fix double-free in SMB2_open() replay Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0197/1266] smb: client: fix double-free in SMB2_close() replay Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0198/1266] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0199/1266] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0200/1266] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0201/1266] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0202/1266] OPP: of: Fix potential memory leak in opp_parse_supplies() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0203/1266] firmware_loader: fix device reference leak in firmware_upload_register() Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0204/1266] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0205/1266] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0206/1266] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0207/1266] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0208/1266] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0209/1266] clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0210/1266] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0211/1266] tools/mm/slabinfo: Fix trace disable logic inversion Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0212/1266] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0213/1266] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0214/1266] HID: letsketch: fix UAF on inrange_timer at driver unbind Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0215/1266] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0216/1266] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0217/1266] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0218/1266] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0219/1266] media: mtk-jpeg: cancel workqueue on release for supported platforms only Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0220/1266] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0221/1266] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
2026-07-21 15:10 ` [PATCH 6.6 0222/1266] bpf: Reject fragmented frames in devmap Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0223/1266] bpf: Restore sysctl new-value from 1 to 0 Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0224/1266] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0225/1266] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0226/1266] usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0227/1266] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0228/1266] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0229/1266] usb: free iso schedules on failed submit Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0230/1266] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0231/1266] usb: gadget: udc: Fix use-after-free in gadget_match_driver Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0232/1266] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0233/1266] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0234/1266] USB: ldusb: " Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0235/1266] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0236/1266] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0237/1266] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0238/1266] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0239/1266] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0240/1266] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0241/1266] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0242/1266] USB: serial: keyspan_pda: fix information leak Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0243/1266] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0244/1266] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0245/1266] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0246/1266] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0247/1266] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0248/1266] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0249/1266] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0250/1266] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0251/1266] usb: typec: anx7411: use devm_pm_runtime_enable() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0252/1266] usb: typec: class: drop PD lookup reference Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0253/1266] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0254/1266] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0255/1266] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0256/1266] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0257/1266] usb: typec: ucsi: cancel pending work on system suspend Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0258/1266] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0259/1266] PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0260/1266] udf: validate free block extents against the partition length Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0261/1266] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0262/1266] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0263/1266] hwrng: jh7110 - fix refcount leak in starfive_trng_read() Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0264/1266] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0265/1266] nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0266/1266] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0267/1266] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0268/1266] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0269/1266] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0270/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0271/1266] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0272/1266] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0273/1266] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0274/1266] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0275/1266] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0276/1266] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0277/1266] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0278/1266] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0279/1266] crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0280/1266] crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0281/1266] crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function Greg Kroah-Hartman
2026-07-21 15:11 ` [PATCH 6.6 0282/1266] crypto: talitos - move code in current_desc_hdr() into a standalone function Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0283/1266] crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0284/1266] crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0285/1266] crypto: talitos/hash - drop workqueue mechanism for SEC1 Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0286/1266] crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0287/1266] crypto: talitos/hash - remove useless wrapper Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0288/1266] crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0289/1266] arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0290/1266] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0291/1266] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0292/1266] EDAC/i10nm: Dont fail probing if ADXL is missing Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0293/1266] watchdog: apple: Add "apple,t8103-wdt" compatible Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0294/1266] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0295/1266] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0296/1266] module: decompress: check return value of module_extend_max_pages() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0297/1266] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0298/1266] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0299/1266] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0300/1266] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0301/1266] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0302/1266] i2c: core: fix adapter deregistration race Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0303/1266] i2c: mpc: Fix timeout calculations Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0304/1266] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0305/1266] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0306/1266] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0307/1266] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0308/1266] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0309/1266] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0310/1266] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0311/1266] Input: mms114 - fix touch indexing for MMS134S and MMS136 Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0312/1266] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0313/1266] Input: mms114 - reject an oversized device packet size Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0314/1266] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0315/1266] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0316/1266] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0317/1266] Input: maplemouse " Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0318/1266] Input: maplecontrol " Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0319/1266] RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0320/1266] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0321/1266] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0322/1266] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0323/1266] smb: client: reject overlapping data areas in SMB2 responses Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0324/1266] xfs: fail recovery on a committed log item with no regions Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0325/1266] xfs: resample the data fork mapping after cycling ILOCK Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0326/1266] smb/server: do not require delete access for non-replacing links Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0327/1266] block: skip sync_blockdev() on surprise removal in bdev_mark_dead() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0328/1266] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0329/1266] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0330/1266] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0331/1266] KVM: arm64: Clear __hyp_running_vcpu " Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0332/1266] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0333/1266] nvmet-tcp: Fix potential UAF when ddgst mismatch Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0334/1266] crypto: sun4i-ss - Remove insecure and unused rng_alg Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0335/1266] x86/mm: Fix check/use ordering in switch_mm_irqs_off() Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0336/1266] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0337/1266] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0338/1266] crypto: hisi-trng - Remove crypto_rng interface Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0339/1266] bpf: Support for hardening against JIT spraying Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0340/1266] x86/bugs: Enable IBPB flush on BPF JIT allocation Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0341/1266] bpf: Restrict JIT predictor flush to cBPF Greg Kroah-Hartman
2026-07-21 15:12 ` [PATCH 6.6 0342/1266] bpf: Skip redundant IBPB in pack allocator Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0343/1266] bpf: Prefer packs that wont trigger an IBPB flush on allocation Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0344/1266] bpf: Prefer dirty packs for eBPF allocations Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0345/1266] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0346/1266] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0347/1266] media: uvcvideo: Fix sequence number when no EOF Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0348/1266] dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0349/1266] dt-bindings: power: imx93: Add MIPI PHY power domain Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0350/1266] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0351/1266] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0352/1266] rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0353/1266] rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0354/1266] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0355/1266] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0356/1266] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0357/1266] fbcon: fix NULL pointer dereference for a console without vc_data Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0358/1266] clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0359/1266] drm/rockchip: Test for imported buffers with drm_gem_is_imported() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0360/1266] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0361/1266] drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0362/1266] drm/radeon: fix integer overflow in radeon_align_pitch() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0363/1266] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0364/1266] libbpf: Report error when a negative kprobe offset is specified Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0365/1266] Documentation: proc: fix section numbering in table of contents Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0366/1266] arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0367/1266] arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0368/1266] wifi: cfg80211: fix grammar in MLO group key error message Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0369/1266] arm64: tegra: Fix Tegra234 MGBE PTP clock Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0370/1266] dt-bindings: pinctrl: nvidia,tegra234: Add missing required block Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0371/1266] drm/amdkfd: Validate CRIU-restored IDs before idr_alloc Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0372/1266] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0373/1266] wifi: rtw89: Correct data type for scan index to avoid infinite loop Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0374/1266] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0375/1266] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0376/1266] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0377/1266] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0378/1266] watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0379/1266] watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0380/1266] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0381/1266] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0382/1266] media: v4l2-common: Add YUV24 format info Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0383/1266] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0384/1266] arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0385/1266] arm64: dts: imx8x-colibri: Correct SODIMM PAD settings Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0386/1266] vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0387/1266] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0388/1266] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0389/1266] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0390/1266] dlm: fix add msg handle in send_queue ordered Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0391/1266] nilfs2: fix backing_dev_info reference leak Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0392/1266] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0393/1266] arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0394/1266] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0395/1266] arm64: dts: qcom: sm8450: Fix ICE reg size Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0396/1266] drm/hisilicon/hibmc: move display contrl config to hibmc_probe() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0397/1266] drm/hisilicon/hibmc: use clock to look up the PLL value Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0398/1266] evm: terminate and bound the evm_xattrs read buffer Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0399/1266] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0400/1266] clk: scpi: Unregister child clock providers on remove Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0401/1266] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
2026-07-21 15:13 ` [PATCH 6.6 0402/1266] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0403/1266] spi: hisi-kunpeng: Use dev_err_probe() for host registration failure Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0404/1266] net/sched: sch_htb: do not change sch->flags in htb_dump() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0405/1266] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0406/1266] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0407/1266] IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0408/1266] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0409/1266] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0410/1266] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0411/1266] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0412/1266] firmware: arm_scmi: Read sensor config as 32-bit value Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0413/1266] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0414/1266] bitops: use common function parameter names Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0415/1266] regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0416/1266] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0417/1266] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0418/1266] firmware: arm_scmi: Fix OOB in scmi_power_name_get() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0419/1266] arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0420/1266] tracing: Bound synthetic-field strings with seq_buf Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0421/1266] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0422/1266] driver core: Use mod_delayed_work to prevent lost deferred probe work Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0423/1266] Revert "treewide: Fix probing of devices in DT overlays" Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0424/1266] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0425/1266] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0426/1266] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0427/1266] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0428/1266] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0429/1266] RDMA/rxe: Fix a use-after-free problem in rxe_mmap Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0430/1266] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0431/1266] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0432/1266] RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0433/1266] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0434/1266] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0435/1266] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0436/1266] mips: ralink: mt7621: add missing __iomem Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0437/1266] mips: n64: add __iomem for writel call Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0438/1266] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0439/1266] ALSA: seq: midi: Serialize output teardown with event_input Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0440/1266] pinctrl: cs42l43: Fix polarity on debounce Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0441/1266] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0442/1266] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0443/1266] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0444/1266] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0445/1266] drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0446/1266] drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0447/1266] gpu: host1x: Allow entries in BO caches to be freed Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0448/1266] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0449/1266] gpu: host1x: Fix iommu_map_sgtable() return value check Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0450/1266] drm/tegra: " Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0451/1266] drm/nouveau/bios: specify correct display fuse register for Ampere and Ada Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0452/1266] libbpf: Harden parse_vma_segs() path parsing Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0453/1266] libbpf: Fix UAF in strset__add_str() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0454/1266] dax/kmem: account for partial discontiguous resource upon removal Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0455/1266] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0456/1266] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0457/1266] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0458/1266] crypto: hisilicon/qm - disable error report before flr Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0459/1266] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0460/1266] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0461/1266] EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info Greg Kroah-Hartman
2026-07-21 15:14 ` [PATCH 6.6 0462/1266] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0463/1266] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0464/1266] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0465/1266] media: qcom: venus: relax encoder frame/blur dimension steps on v4 Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0466/1266] media: qcom: venus: relax encoder frame/blur step size on v6 Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0467/1266] rpmsg: use generic driver_override infrastructure Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0468/1266] md/raid10: reset read_slot when reusing r10bio for discard Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0469/1266] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0470/1266] ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0471/1266] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0472/1266] HID: wiimote: Fix table layout and whitespace errors Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0473/1266] ata: libata: Fix ata_exec_internal() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0474/1266] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0475/1266] nvdimm/btt: Handle preemption in BTT lane acquisition Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0476/1266] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0477/1266] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0478/1266] scsi: ufs: Fix wrong value printed in unexpected UPIU response case Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0479/1266] bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0480/1266] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0481/1266] ext2: fix ignored return value of generic_write_sync() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0482/1266] sched: restore timer_slack_ns when resetting RT policy on fork Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0483/1266] lib/test_meminit: use && for bools Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0484/1266] configfs_lookup(): dont leave ->s_dentry dangling on failure Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0485/1266] drm/amdgpu: set sub_block_index for mca ras sub-blocks Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0486/1266] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0487/1266] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0488/1266] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0489/1266] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0490/1266] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0491/1266] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0492/1266] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0493/1266] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0494/1266] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0495/1266] netfilter: conntrack: revert ct extension genid infrastructure Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0496/1266] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0497/1266] IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0498/1266] RDMA/irdma: Fix OOB read during CQ MR registration Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0499/1266] RDMA/irdma: Initialize iwmr->access during " Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0500/1266] arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0501/1266] bpf: Check tail zero of bpf_prog_info Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0502/1266] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0503/1266] wifi: wcn36xx: fix heap overflow from oversized firmware HAL response Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0504/1266] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0505/1266] wifi: wcn36xx: fix OOB read from short trigger BA firmware response Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0506/1266] ALSA: seq: Fix partial userptr event expansion Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0507/1266] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0508/1266] ALSA: seq: Clear variable event pointer on read Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0509/1266] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0510/1266] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0511/1266] IB/mlx5: Dont take the rereg_mr fallback without a new translation Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0512/1266] IB/mlx5: Properly support implicit ODP rereg_mr Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0513/1266] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0514/1266] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0515/1266] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0516/1266] watchdog: unregister PM notifier on watchdog unregister Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0517/1266] scsi: target: Fix hexadecimal CHAP_I handling Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0518/1266] scsi: target: Remove tcm_loop target reset handling Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0519/1266] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0520/1266] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0521/1266] vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() Greg Kroah-Hartman
2026-07-21 15:15 ` [PATCH 6.6 0522/1266] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0523/1266] sched/fair: Fix cpu_util runnable_avg arithmetic Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0524/1266] wifi: mt76: fix argument to ieee80211_is_first_frag() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0525/1266] wifi: mt76: mt7915: fix potential tx_retries underflow Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0526/1266] wifi: mt76: mt7921: " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0527/1266] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0528/1266] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0529/1266] hwmon: (it87) Clamp negative values to zero in set_fan() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0530/1266] btrfs: zoned: dont account data relocation space-info in statfs free space Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0531/1266] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0532/1266] spi: meson-spifc: fix runtime PM leak on remove Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0533/1266] ASoC: codecs: aw88261: fix incorrect masks for boost regs Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0534/1266] vduse: hold vduse_lock across IDR lookup in open path Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0535/1266] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0536/1266] vduse: Requeue failed read to send_list head Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0537/1266] vhost/net: complete zerocopy ubufs only once Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0538/1266] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0539/1266] ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0540/1266] ASoC: cs35l56: Dont leave parent IRQ disabled if system_suspend fails Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0541/1266] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0542/1266] ext4: fix kernel BUG in ext4_write_inline_data_end Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0543/1266] selftests/bpf: Fix bpf_iter/task_vma test Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0544/1266] cxl/test: Fix integer overflow in mock LSA bounds checks Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0545/1266] cxl/test: Zero out LSA backing memory to avoid leaking to user Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0546/1266] of: cpu: add check in __of_find_n_match_cpu_property() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0547/1266] bpf: Tighten cgroup storage cookie checks for prog arrays Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0548/1266] s390/process: Fix kernel thread function pointer type Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0549/1266] Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0550/1266] Bluetooth: hci: validate codec capability element length Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0551/1266] Bluetooth: vhci: validate devcoredump state before side effects Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0552/1266] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0553/1266] RDMA/mlx5: Remove raw RSS QP restrack tracking Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0554/1266] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0555/1266] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0556/1266] ASoC: codecs: hdac_hdmi: Validate written enum value Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0557/1266] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0558/1266] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0559/1266] net/sched: cls_flow: Dont expose folded kernel pointers Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0560/1266] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0561/1266] bridge: cfm: reject invalid CCM interval at configuration time Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0562/1266] sctp: validate embedded address parameter length Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0563/1266] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0564/1266] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0565/1266] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0566/1266] tipc: reject inverted service ranges from peer bindings Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0567/1266] cxl/test: Add check after kzalloc() memory in alloc_mock_res() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0568/1266] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0569/1266] crypto: cavium/cpt " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0570/1266] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0571/1266] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0572/1266] ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0573/1266] power: supply: core: fix supplied_from allocations Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0574/1266] handshake: Require admin permission for DONE command Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0575/1266] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0576/1266] net/sched: sch_codel: " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0577/1266] net: mana: initialize gdma queue id to INVALID_QUEUE_ID Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0578/1266] net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0579/1266] bpf: Run generic devmap egress prog on private skb Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0580/1266] net/mlx5: Check max_macs devlink param value against max capability Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0581/1266] net: wwan: t7xx: check skb_clone in control TX Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 6.6 0582/1266] net: bcmgenet: Use weighted round-robin TX DMA arbitration Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0583/1266] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0584/1266] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0585/1266] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0586/1266] cifs: remove all cifs files before kill super Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0587/1266] smb/client: always return a value for FS_IOC_GETFLAGS Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0588/1266] selftests/bpf: Initialize operation name before use Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0589/1266] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0590/1266] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0591/1266] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0592/1266] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0593/1266] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0594/1266] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0595/1266] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0596/1266] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0597/1266] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0598/1266] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0599/1266] ionic: Fix check in ionic_get_link_ext_stats Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0600/1266] ksmbd: fix use-after-free in same_client_has_lease() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0601/1266] mfd: cs42l43: Sanity check firmware size Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0602/1266] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0603/1266] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0604/1266] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0605/1266] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0606/1266] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0607/1266] PCI/ASPM: Dont reconfigure ASPM entering low-power state Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0608/1266] PCI: Introduce named defines for PCI ROM Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0609/1266] PCI: Check ROM header and data structure addr before accessing Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0610/1266] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0611/1266] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0612/1266] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0613/1266] PCI: loongson: Do not ignore downstream devices on external bridges Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0614/1266] bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0615/1266] phy: phy-can-transceiver: Check driver match and driver data against NULL Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0616/1266] perf pmu: Skip test on Arm64 when #slots is zero Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0617/1266] mailbox: mtk-adsp: fix UAF during device teardown Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0618/1266] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0619/1266] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0620/1266] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0621/1266] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0622/1266] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0623/1266] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0624/1266] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0625/1266] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0626/1266] iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0627/1266] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0628/1266] iio: tcs3472: power down chip on probe failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0629/1266] clk: at91: keep securam node alive while mapping it Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0630/1266] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0631/1266] fs/ntfs3: add bounds check to run_get_highest_vcn() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0632/1266] fs/ntfs3: fix mount failure on 64K page-size kernels Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0633/1266] drm/amd/display: Add missing kdoc for ALLM parameters Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0634/1266] dmaengine: imx-sdma: Refine spba bus searching in probe Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0635/1266] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0636/1266] perf tools: Guard test_bit from out-of-bounds sample CPU Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0637/1266] perf sched: Replace BUG_ON on invalid CPU with graceful skip Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0638/1266] perf sched: Fix NULL dereference in latency_runtime_event Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0639/1266] perf tools: Add bounds check to cpu__get_node() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0640/1266] perf mmap: Guard cpu__get_node() return in aio_bind() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0641/1266] perf c2c: Bounds-check CPU and node IDs before bitmap and array access Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 6.6 0642/1266] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0643/1266] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0644/1266] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0645/1266] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0646/1266] dmaengine: qcom: gpi: set DMA_PRIVATE capability Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0647/1266] dmaengine: Fix possible use after free Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0648/1266] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0649/1266] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0650/1266] xprtrdma: Remove temp allocation of rpcrdma_rep objects Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0651/1266] xprtrdma: Avoid 250 ms delay on backlog wakeup Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0652/1266] xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0653/1266] xprtrdma: Post receive buffers after RPC completion Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0654/1266] xprtrdma: Use sendctx DMA state for Send signaling Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0655/1266] xprtrdma: Decouple req recycling from RPC completion Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0656/1266] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0657/1266] nfs: keep PG_UPTODATE clear after read errors in page groups Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0658/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0659/1266] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0660/1266] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0661/1266] PCI: meson: Propagate devm_add_action_or_reset() failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0662/1266] fs/ntfs3: resize log->one_page_buf when adopting on-disk page size Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0663/1266] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0664/1266] perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0665/1266] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0666/1266] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0667/1266] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0668/1266] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0669/1266] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0670/1266] xprtrdma: Check frwr_wp_create() during connect Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0671/1266] xprtrdma: Document and assert reply-handler invariants Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0672/1266] xprtrdma: Resize reply buffers before reposting receives Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0673/1266] xprtrdma: Fix bcall rep leak and unbounded peek Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0674/1266] xprtrdma: Sanitize the reply credit grant after parsing Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0675/1266] xprtrdma: Repost Receive buffers for malformed replies Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0676/1266] xprtrdma: Return sendctx slot after Send preparation failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0677/1266] perf cs-etm: Fix incorrect or missing decoder for raw trace Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0678/1266] perf cs-etm: Create decoders after both AUX and HW_ID search passes Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0679/1266] perf cs-etm: Queue context packets for frontend Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0680/1266] perf pmu: Fix pmu_id() heap underwrite on empty identifier file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0681/1266] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0682/1266] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0683/1266] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0684/1266] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0685/1266] perf intel-pt: Fix snprintf size tracking bug in insn decoder Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0686/1266] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0687/1266] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0688/1266] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0689/1266] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0690/1266] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0691/1266] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0692/1266] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0693/1266] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0694/1266] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0695/1266] Revert "PCI/MSI: Unmap MSI-X region on error" Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0696/1266] security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0697/1266] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0698/1266] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0699/1266] apparmor: fix rawdata_f_data implicit flex array Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0700/1266] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0701/1266] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 6.6 0702/1266] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0703/1266] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0704/1266] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0705/1266] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0706/1266] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0707/1266] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0708/1266] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0709/1266] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0710/1266] perf bpf: Bounds-check array offsets in bpil_offs_to_addr() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0711/1266] gpio: mlxbf3: fail probe if gpiochip registration fails Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0712/1266] spi: dw: fix wrong BAUDR setting after resume Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0713/1266] xfrm: Use the XFRM_GRO to indicate a GRO call on input Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0714/1266] xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0715/1266] xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0716/1266] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0717/1266] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0718/1266] perf cs-etm: Validate num_cpu before metadata allocation Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0719/1266] perf cs-etm: Require full global header in auxtrace_info size check Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0720/1266] ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0721/1266] drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0722/1266] drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0723/1266] drm/amdgpu: initialize irq.lock spinlock earlier Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0724/1266] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0725/1266] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0726/1266] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0727/1266] PCI: iproc: Restore .map_irq() for the platform bus driver Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0728/1266] spi: rpc-if: Use correct device for hardware reinitialization on resume Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0729/1266] virtio-net: fix len check in receive_big() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0730/1266] dpaa2-switch: fix VLAN upper check not rejecting bridge join Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0731/1266] devlink: Fix parent ref leak in devl_rate_node_create() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0732/1266] flow_dissector: check device type before reading ETH_ADDRS Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0733/1266] ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0734/1266] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0735/1266] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0736/1266] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0737/1266] ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0738/1266] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0739/1266] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0740/1266] md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0741/1266] netfilter: ipset: Fix data race between add and dump in all hash types Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0742/1266] netfilter: ipset: annotate "pos" for concurrent readers/writers Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0743/1266] netfilter: ipset: Dont use test_bit() in lockless RCU readers in hash types Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0744/1266] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0745/1266] netfilter: nf_reject: skip iphdr options when looking for icmp header Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0746/1266] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0747/1266] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0748/1266] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0749/1266] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0750/1266] selftests/mm: fix exclusive_cow test fork() handling Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0751/1266] net: marvell: prestera: initialize err in prestera_port_sfp_bind Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0752/1266] tipc: fix use-after-free of the discoverer in tipc_disc_rcv() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0753/1266] net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0754/1266] octeontx2-af: mcs: Fix unsupported secy stats read Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0755/1266] octeontx2-pf: Clear stats of all resources when freeing resources Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0756/1266] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0757/1266] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0758/1266] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0759/1266] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0760/1266] bpf: zero-initialize the fib lookup flow struct Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0761/1266] bpf: Fix effective prog array index with BPF_F_PREORDER Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 6.6 0762/1266] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0763/1266] PCI: endpoint: pci-epf-vntb: Add check to detect db_count value of 0 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0764/1266] PCI: endpoint: pci-epf-ntb: " Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0765/1266] ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0766/1266] ice: fix AQ error code comparison in ice_set_pauseparam() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0767/1266] i40e: Fix i40e_debug() to use struct i40e_hw argument Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0768/1266] rtc: msc313: fix NULL deref in shared IRQ handler at probe Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0769/1266] ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0770/1266] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0771/1266] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0772/1266] bpf, lsm: Add disabled BPF LSM hook list Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0773/1266] bpf: Disable xfrm_decode_session hook attachment Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0774/1266] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0775/1266] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0776/1266] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0777/1266] netfilter: nft_compat: ebtables emulation must reject non-bridge targets Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0778/1266] NTB: epf: Make db_valid_mask cover only real doorbell bits Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0779/1266] NTB: epf: Report 0-based doorbell vector via ntb_db_event() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0780/1266] NTB: epf: Fix doorbell bitmask and IRQ vector handling Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0781/1266] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0782/1266] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0783/1266] net, bpf: check master for NULL in xdp_master_redirect() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0784/1266] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0785/1266] veth: fix NAPI leak in XDP enable error path Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0786/1266] net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0787/1266] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0788/1266] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0789/1266] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0790/1266] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0791/1266] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0792/1266] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0793/1266] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0794/1266] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0795/1266] net: sungem: fix probe error cleanup Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0796/1266] net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0797/1266] ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0798/1266] dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0799/1266] tracing: probes: fix typo in a log message Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0800/1266] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0801/1266] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0802/1266] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0803/1266] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0804/1266] qede: fix out-of-bounds check for cqe->len_list[] Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0805/1266] net: enetc: check the number of BDs needed for xdp_frame Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0806/1266] sctp: fix SCTP_RESET_STREAMS stream list length limit Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0807/1266] MIPS: DEC: Ensure RTC platform device deregistration upon failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0808/1266] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0809/1266] hwmon: (pmbus) Fix passing events to regulator core Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0810/1266] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0811/1266] net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0812/1266] net: gianfar: dispose irq mappings on probe failure and device removal Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0813/1266] net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0814/1266] bridge: stp: Fix a potential use-after-free when deleting a bridge Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0815/1266] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0816/1266] tracing: eprobe: read the complete FILTER_PTR_STRING pointer Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0817/1266] irqchip/gic-v3-its: Fix OF node reference leak Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0818/1266] irqchip/ts4800: Fix missing chained handler cleanup on remove Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0819/1266] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0820/1266] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0821/1266] net/sched: act_bpf: use rcu_dereference_bh() to read the filter Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 6.6 0822/1266] ksmbd: reject undersized DACLs before parsing ACEs Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0823/1266] smb: move some duplicate definitions to common/cifsglob.h Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0824/1266] ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0825/1266] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0826/1266] pinctrl: meson: restore non-sleeping GPIO access Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0827/1266] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0828/1266] fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0829/1266] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0830/1266] afs: use kvfree() to free memory allocated by kvcalloc() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0831/1266] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0832/1266] afs: Fix vllist leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0833/1266] afs: Fix the volume AFS_VOLUME_RM_TREE is set on Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0834/1266] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0835/1266] minix: avoid overflow in bitmap block count calculation Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0836/1266] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0837/1266] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0838/1266] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0839/1266] arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0840/1266] arm64/mm: convert set_pte_at() to set_ptes(..., 1) Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0841/1266] arm64/mm: convert ptep_clear() to ptep_get_and_clear() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0842/1266] arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0843/1266] selftests/hid: ensure we can compile the tests on kernels pre-6.3 Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0844/1266] selftests/hid: do not manually call headers_install Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0845/1266] selftests/hid: force using our compiled libbpf headers Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0846/1266] selftests/hid: convert the hid_bpf selftests with struct_ops Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0847/1266] selftests/hid: Cover hid_bpf_get_data() size overflow Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0848/1266] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0849/1266] gue: validate REMCSUM private option length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0850/1266] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0851/1266] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0852/1266] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0853/1266] netfilter: xt_connmark: reject invalid shift parameters Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0854/1266] net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0855/1266] net/mlx5e: Fix HV VHCA stats agent registration race Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0856/1266] net: microchip: vcap: fix races on the shared Super VCAP block Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0857/1266] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0858/1266] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0859/1266] net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0860/1266] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0861/1266] amt: fix size calculation in amt_get_size() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0862/1266] Bluetooth: 6lowpan: hold L2CAP conn across debugfs control Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0863/1266] Bluetooth: MGMT: Fix adv monitor add failure cleanup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0864/1266] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0865/1266] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0866/1266] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0867/1266] net/tls: Consume empty data records in tls_sw_read_sock() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0868/1266] net: usb: lan78xx: move functions to avoid forward definitions Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0869/1266] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0870/1266] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0871/1266] octeontx2-pf: check DMAC extraction support before filtering Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0872/1266] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0873/1266] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0874/1266] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0875/1266] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0876/1266] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0877/1266] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0878/1266] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0879/1266] s390/zcrypt: Remove the empty file Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0880/1266] cifs: validate DFS referral string offsets Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0881/1266] SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 6.6 0882/1266] SUNRPC: pin upper rpc_clnt across the TLS connect_worker Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0883/1266] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0884/1266] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0885/1266] selftests/net: fix EVP_MD_CTX leak in tcp_mmap Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0886/1266] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0887/1266] octeontx2-af: fix VF bringup affecting PF promiscuous state Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0888/1266] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0889/1266] mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0890/1266] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0891/1266] vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0892/1266] ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0893/1266] ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0894/1266] ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0895/1266] ASoC: SOF: topology: validate vendor array size before parsing Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0896/1266] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0897/1266] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0898/1266] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0899/1266] arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0900/1266] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0901/1266] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0902/1266] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0903/1266] KVM: s390: pci: Fix handling of AIF enable without AISB Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0904/1266] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0905/1266] fbdev: metronomefb: fix potential memory leak in metronomefb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0906/1266] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0907/1266] fbdev: hecubafb: fix potential memory leak in hecubafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0908/1266] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0909/1266] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0910/1266] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0911/1266] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0912/1266] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0913/1266] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0914/1266] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0915/1266] fbdev: vesafb: fix memory leak in vesafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0916/1266] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0917/1266] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0918/1266] ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0919/1266] ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0920/1266] ASoC: mediatek: mt8192: Release reserved memory on cleanup Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0921/1266] ASoC: mediatek: mt8183: " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0922/1266] ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0923/1266] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0924/1266] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0925/1266] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0926/1266] netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0927/1266] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0928/1266] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0929/1266] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0930/1266] netfilter: ecache: fix inverted time_after() check Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0931/1266] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0932/1266] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0933/1266] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0934/1266] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0935/1266] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0936/1266] selinux: check connect-related permissions on TCP Fast Open Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0937/1266] selinux: fix incorrect execmem checks on overlayfs Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0938/1266] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0939/1266] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0940/1266] tools/power/x86/intel-speed-select: Harden daemon pidfile open Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0941/1266] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 6.6 0942/1266] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0943/1266] perf/x86/amd/lbr: Fix kernel address leakage Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0944/1266] s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0945/1266] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0946/1266] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0947/1266] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0948/1266] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0949/1266] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0950/1266] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0951/1266] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0952/1266] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0953/1266] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0954/1266] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0955/1266] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0956/1266] cifs: invalidate cfid on unlink/rename/rmdir Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0957/1266] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0958/1266] HID: playstation: validate num_touch_reports in DualShock 4 reports Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0959/1266] Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0960/1266] Bluetooth: SCO: hold sk properly " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0961/1266] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0962/1266] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0963/1266] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0964/1266] sunrpc: pin svc_xprt across the asynchronous TLS handshake callback Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0965/1266] sunrpc: wait for in-flight TLS handshake callback when cancel loses race Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0966/1266] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0967/1266] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0968/1266] SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0969/1266] remoteproc: qcom: Fix leak when custom dump_segments addition fails Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0970/1266] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0971/1266] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0972/1266] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0973/1266] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0974/1266] power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0975/1266] mm/damon/core: make charge_addr_from aware of end-address exclusivity Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0976/1266] fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0977/1266] fs/ntfs3: bound DeleteIndexEntryAllocation memmove length Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0978/1266] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0979/1266] fs/ntfs3: bound attr_off in UpdateResidentValue against data_off Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0980/1266] fs/ntfs3: validate lcns_follow in log_replay conversion Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0981/1266] fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0982/1266] fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0983/1266] ntfs3: cap RESTART_TABLE free-chain walker at rt->used Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0984/1266] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0985/1266] ntfs3: validate split-point offset in indx_insert_into_buffer Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0986/1266] ntfs3: fix out-of-bounds read in decompress_lznt Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0987/1266] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0988/1266] mips: sched: Fix CPUMASK_OFFSTACK memory corruption Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0989/1266] riscv: cacheinfo: Fix node reference leak in populate_cache_leaves Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0990/1266] mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0991/1266] mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0992/1266] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0993/1266] mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0994/1266] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0995/1266] 9p: skip nlink update in cacheless mode to fix WARN_ON Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0996/1266] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0997/1266] scsi: sas: Skip opt_sectors when DMA reports no real optimization hint Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0998/1266] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 6.6 0999/1266] mtd: rawnand: pl353: fix probe resource allocation Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox