* [PATCH 6.6 000/484] 6.6.148-rc1 review
@ 2026-07-30 14:08 Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 001/484] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug Greg Kroah-Hartman
` (489 more replies)
0 siblings, 490 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.6.148 release.
There are 484 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 01 Aug 2026 14:13:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.148-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.6.148-rc1
Nikunj A Dadhania <nikunj@amd.com>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
David Howells <dhowells@redhat.com>
rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link
Robert Mader <robert.mader@collabora.com>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
Julien Massot <julien.massot@collabora.com>
ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
Chen-Yu Tsai <wenst@chromium.org>
ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
SJ Park <sj@kernel.org>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
SJ Park <sj@kernel.org>
mm/damon/core: validate ranges in damon_set_regions()
Qian Zuo <zuoqian113@gmail.com>
coredump: fix pidfs file refcount leak in umh_coredump_setup
Venkatesh Srinivas <venkateshs@chromium.org>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
David Matlack <dmatlack@google.com>
KVM: Introduce vcpu->wants_to_run
Reinette Chatre <reinette.chatre@intel.com>
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
Haoxiang Li <haoxiang_li2024@163.com>
net: ipa: fix SMEM state handle leaks in SMP2P init
Théo Lebrun <theo.lebrun@bootlin.com>
net: macb: drop in-flight Tx SKBs on close
Bryam Vargas <hexlabsecurity@proton.me>
ata: libata-core: Reject an invalid concurrent positioning ranges count
Dawei Feng <dawei.feng@seu.edu.cn>
octeontx2-pf: fix SQB pointer leak on init failure
Wentao Liang <vulab@iscas.ac.cn>
ipmi: fix refcount leak in i_ipmi_request()
Breno Leitao <leitao@debian.org>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
Breno Leitao <leitao@debian.org>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Rasmus Villemoes <linux@rasmusvillemoes.dk>
bootconfig: do not put quotes on cmdline items unless necessary
Junrui Luo <moonafterrain@outlook.com>
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
Sergio Paracuellos <sergio.paracuellos@gmail.com>
gpio: mt7621: avoid corruption of shared interrupt trigger state
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
Runyu Xiao <runyu.xiao@seu.edu.cn>
gpio: tegra: do not call pinctrl for GPIO direction
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
pinctrl: remove pinctrl_gpio_direction_output()
Dexuan Cui <decui@microsoft.com>
net: mana: Validate the packet length reported by the NIC
Thomas Gleixner <tglx@kernel.org>
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
Guangshuo Li <lgs201920130244@gmail.com>
mmc: vub300: fix use-after-free on probe failure
Johan Hovold <johan@kernel.org>
mmc: vub300: rename probe error labels
Johan Hovold <johan@kernel.org>
mmc: vub300: fix use-after-free on disconnect
Maoyi Xie <maoyixie.tju@gmail.com>
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
Michael Bommarito <michael.bommarito@gmail.com>
tracing/user_events: Fix use-after-free in user_event_mm_dup()
Marco Crivellari <marco.crivellari@suse.com>
workqueue: Add system_percpu_wq and system_dfl_wq
Tejun Heo <tj@kernel.org>
workqueue: Factor out init_cpu_worker_pool()
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix firmware leak in async update
Dmitry Torokhov <dmitry.torokhov@gmail.com>
firmware_loader: introduce __free() cleanup hanler
Mikulas Patocka <mpatocka@redhat.com>
dm-verity: make error counter atomic
Mikulas Patocka <mpatocka@redhat.com>
dm-verity: avoid double increment of &use_bh_wq_enabled
Souvik Banerjee <souvik@amlalabs.com>
ovl: use linked upper dentry in copy-up tmpfile
Benjamin Coddington <ben.coddington@hammerspace.com>
NFS: Charge unstable writes by request size, not folio size
Christoph Hellwig <hch@lst.de>
nfs: remove dead code for the old swap over NFS implementation
Vincent Jardin <vjardin@free.fr>
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Stefan Eichenberger <stefan.eichenberger@toradex.com>
i2c: imx: separate atomic, dma and non-dma use case
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
platform/x86: dell-laptop: fix missing cleanups in init error path
Lyndon Sanche <lsanche@lyndeno.ca>
platform/x86: dell-smbios: Move request functions for reuse
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Remove XDomain from the bus without holding tb->lock
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Remove service debugfs entries during unregister
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Keep XDomain reference during the lifetime of a service
Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
thunderbolt: Update property.c function documentation
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
thunderbolt: Remove usage of the deprecated ida_simple_xx() API
Gil Fine <gil.fine@linux.intel.com>
thunderbolt: Handle lane bonding of Gen 4 XDomain links properly
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma-pcie: Reject devices without driver data
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
dmaengine: dw-edma: Fix confusing cleanup.h syntax
Abinash Singh <abinashlalotra@gmail.com>
dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
Yiyang Chen <cyyzero16@gmail.com>
taskstats: retain dead thread stats in TGID queries
Oleg Nesterov <oleg@redhat.com>
taskstats: fill_stats_for_tgid: use for_each_thread()
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: rawnand: Pause continuous reads at block boundaries
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: rawnand: Ensure all continuous terms are always in sync
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: rawnand: Add a helper for calculating a page index
Florian Fuchs <fuchsfl@gmail.com>
mtd: maps: vmu-flash: fix fault in unaligned fixup
Muchun Song <muchun.song@linux.dev>
mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
Jeff Layton <jlayton@kernel.org>
sunrpc: allocate a separate bvec array for socket sends
Mike Snitzer <snitzer@kernel.org>
NFSD: pass nfsd_file to nfsd_iter_read()
Theodor Arsenij Larionov-Trichkine <theodorlarionov@gmail.com>
netfilter: nft_fib: reject fib expression on the netdev egress hook
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: remove register tracking infrastructure
Yue Haibing <yuehaibing@huawei.com>
netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Florian Westphal <fw@strlen.de>
netfilter: nf_conntrack_sip: remove net variable shadowing
Tristan Madani <tristan@talencesecurity.com>
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Casey Schaufler <casey@schaufler-ca.com>
lsm: infrastructure management of the sock security
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: merge deactivate helper into caller
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: prepare walk function for on-demand clone
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: move prove_locking helper around
Florian Westphal <fw@strlen.de>
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: mediatek: mt8183: Check runtime resume during probe
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: mediatek: mt8192: Check runtime resume during probe
Tang Bin <tangbin@cmss.chinamobile.com>
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe()
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable()
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: efifb: fix memory leak in efifb_probe()
Thomas Zimmermann <tzimmermann@suse.de>
fbdev/efifb: Replace references to global screen_info by local pointer
Runyu Xiao <runyu.xiao@seu.edu.cn>
octeontx2-vf: clear stale mailbox IRQ state before request_irq()
Runyu Xiao <runyu.xiao@seu.edu.cn>
octeontx2-pf: clear stale mailbox IRQ state before request_irq()
Subbaraya Sundeep <sbhatta@marvell.com>
octeontx2: Annotate mmio regions as __iomem
Jason Wang <jasowang@redhat.com>
VDUSE: avoid leaking information to userspace
Eugenio Pérez <eperezma@redhat.com>
vduse: take out allocations from vduse_dev_alloc_coherent
Eugenio Pérez <eperezma@redhat.com>
vduse: remove unused vaddr parameter of vduse_domain_free_coherent
Sheng Zhao <sheng.zhao@bytedance.com>
vduse: Use fixed 4KB bounce pages for non-4KB page size
David Howells <dhowells@redhat.com>
rxrpc: Fix socket notification race
David Howells <dhowells@redhat.com>
rxrpc: Fix notification vs call-release vs recvmsg
David Howells <dhowells@redhat.com>
rxrpc: Use irq-disabling spinlocks between app and I/O thread
David Howells <dhowells@redhat.com>
rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack
Li Xiasong <lixiasong1@huawei.com>
tipc: restrict socket queue dumps in enqueue tracepoints
Jiacheng Yu <yujiacheng3@huawei.com>
fbcon: Use correct type for vc_resize() return value
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Rename struct fbcon_ops to struct fbcon_par
Li Daming <d4n.for.sec@gmail.com>
rxrpc: serialize kernel accept preallocation with socket teardown
David Howells <dhowells@redhat.com>
rxrpc: Pull out certain app callback funcs into an ops table
David Howells <dhowells@redhat.com>
afs: Turn the afs_addr_list address array into an array of structs
Kees Cook <keescook@chromium.org>
afs: Annotate struct afs_addr_list with __counted_by
Tapio Reijonen <tapio.reijonen@vaisala.com>
serial: max310x: implement gpio_chip::get_direction()
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
Xu Rao <raoxu@uniontech.com>
ALSA: hda: Fix cached processing coefficient verbs
Zhang Heng <zhangheng@kylinos.cn>
ALSA: hda: conexant: Remove mic bias threshold override
Mingyu Wang <25181214217@stu.xidian.edu.cn>
i2c: i801: fix hardware state machine corruption in error path
Ricardo Robaina <rrobaina@redhat.com>
audit: fix recursive locking deadlock in audit_dupe_exe()
Ricardo Robaina <rrobaina@redhat.com>
audit: use 'unsigned int' instead of 'unsigned'
Jeff Layton <jlayton@kernel.org>
audit: widen ino fields to u64
NeilBrown <neil@brown.name>
VFS/audit: introduce kern_path_parent() for audit
Haoxiang Li <haoxiang_li2024@163.com>
i2c: davinci: Unregister cpufreq notifier on probe failure
Sebastian Alba Vives <sebasjosue84@gmail.com>
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
Jason Gunthorpe <jgg@ziepe.ca>
udmabuf: Do not create malformed scatterlists
Weinan Liu <wnliu@google.com>
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
Matt Bobrowski <mattbobrowski@google.com>
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
Wentao Guan <guanwentao@uniontech.com>
bpf: drop bpf_lsm_getselfattr from hook list
Coia Prant <coiaprant@gmail.com>
net: pcs: xpcs: fix SGMII state reading
Yitang Yang <yi1tang.yang@gmail.com>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources
Namjae Jeon <linkinjeon@kernel.org>
exfat: validate cluster allocation bits of the allocation bitmap
Eric Biggers <ebiggers@kernel.org>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
Kyle Zeng <kylebot@openai.com>
openvswitch: fix GSO userspace truncation underflow
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: validate ACE size against SID sub-authorities
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: bound DACL dedup walk to copied ACEs
Wentao Guan <guanwentao@uniontech.com>
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
Haofeng Li <lihaofeng@kylinos.cn>
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
net: qrtr: ns: Raise node count limit to 512
Weiming Shi <bestswngs@gmail.com>
ipv6: ndisc: fix NULL deref in accept_untracked_na()
Jacob Keller <jacob.e.keller@intel.com>
i40e: remove read access to debugfs files
Asad Kamal <asad.kamal@amd.com>
drm/amdgpu: fix aperture mapping leak
Ce Sun <cesun102@amd.com>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
Boyuan Zhang <boyuan.zhang@amd.com>
drm/amdgpu: fix division by zero with invalid uvd dimensions
Luca Coelho <luciano.coelho@intel.com>
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
Boyuan Zhang <boyuan.zhang@amd.com>
drm/amdgpu/vcn4: avoid rereading IB param length
Boyuan Zhang <boyuan.zhang@amd.com>
drm/amdgpu/vce: fix integer overflow in image size
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx8: drop unecessary BUG_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
Yang Wang <kevinyang.wang@amd.com>
drm/amd/pm: make pp_features read-only when scpm is enabled
James Raphael Tiovalen <jamestiotio@gmail.com>
vxlan: mdb: Fix source list corruption on a failed replace
Daehyeon Ko <4ncienth@gmail.com>
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
Asim Viladi Oglu Manizada <manizada@pm.me>
pppoe: reload header pointer after dev_hard_header()
Doruk Tan Ozturk <doruk@0sec.ai>
mctp: serial: handle zero-length frames to prevent rx buffer overflow
Doruk Tan Ozturk <doruk@0sec.ai>
mac802154: llsec: reject frames shorter than the authentication tag
Ibrahim Hashimov <security@auditcode.ai>
mac802154: hold an interface reference across the scan worker
Michael Bommarito <michael.bommarito@gmail.com>
ila: reload IPv6 header after pskb_may_pull in checksum adjust
Sergey Temerkhanov <sergey.temerkhanov@intel.com>
ice: use READ_ONCE() to access cached PHC time
James Montgomery <james_montgomery@disroot.org>
ksmbd: defer destroy_previous_session() until after NTLM authentication
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
rbd: Reset positive result codes to zero in object map update path
Masami Hiramatsu (Google) <mhiramat@kernel.org>
selftests/ftrace: Reset triggers at top level before instance loop
Jann Horn <jannh@google.com>
proc: Fix broken error paths for namespace links
Fan Wu <fanwu01@zju.edu.cn>
net: hip04: fix RX buffer leak on build_skb failure
David Lee <david.lee@trailofbits.com>
net/x25: fix use-after-free in x25_kill_by_neigh()
Bryam Vargas <hexlabsecurity@proton.me>
net/iucv: fix use-after-free of a severed iucv_path
Hidayath Khan <hidayath@linux.ibm.com>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
Doruk Tan Ozturk <doruk@0sec.ai>
geneve: require CAP_NET_ADMIN in the device netns for changelink
Sungmin Kang <726ksm@gmail.com>
net: slip: serialize receive against buffer reallocation
Doruk Tan Ozturk <doruk@0sec.ai>
vxlan: require CAP_NET_ADMIN in the device netns for changelink
Breno Leitao <leitao@debian.org>
phonet: pep: fix use-after-free in pep_get_sb()
Lu Baolu <baolu.lu@linux.intel.com>
iommu/vt-d: Disallow SVA if page walk is not coherent
Tengda Wu <wutengda@huaweicloud.com>
ftrace: Add global mutex to serialize trace_parser access
Eric Biggers <ebiggers@kernel.org>
fscrypt: Add missing superblock check in find_or_insert_direct_key()
Amir Goldstein <amir73il@gmail.com>
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
Christian Brauner <brauner@kernel.org>
binfmt_elf_fdpic: only honour the first PT_INTERP
Douya Le <ldy3087146292@gmail.com>
libceph: remove debugfs files before client teardown
Douya Le <ldy3087146292@gmail.com>
libceph: reject zero bucket types in crush_decode
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
libceph: Reject monmaps advertising zero monitors
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
Zhao Zhang <zzhan461@ucr.edu>
libceph: guard missing CRUSH type name lookup
Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
libceph: Fix multiplication overflow in decode_new_up_state_weight()
Douya Le <ldy3087146292@gmail.com>
libceph: bound get_version reply decode to front len
Bryam Vargas <hexlabsecurity@proton.me>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
Max Kellermann <max.kellermann@ionos.com>
ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*
Jun Yang <junvyyang@tencent.com>
sctp: don't free the ASCONF's own transport in DEL-IP processing
Michael Bommarito <michael.bommarito@gmail.com>
mptcp: only set DATA_FIN when a mapping is present
Chenguang Zhao <zhaochenguang@kylinos.cn>
mptcp: decrement subflows counter on failed passive join
Will Deacon <will@kernel.org>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
Will Deacon <will@kernel.org>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
deepakraog <gaikwad.dcg@gmail.com>
tracing: Fix resource leak on mmiotrace trace_pipe close
Steven Rostedt <rostedt@goodmis.org>
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
Guangshuo Li <lgs201920130244@gmail.com>
intel_th: fix MSC output device reference leak
Alexander Usyskin <alexander.usyskin@intel.com>
mei: bus: access mei_device under device_lock on cleanup
Jiangshan Yi <yijiangshan@kylinos.cn>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: implement gpio get_direction() callback
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_parport: deal with premature interrupt
Nathan Chancellor <nathan@kernel.org>
x86/boot/compressed: Disable jump tables
Xu Rao <raoxu@uniontech.com>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
Haoran Jiang <jianghaoran@kylinos.cn>
LoongArch: Fix oops during single-step debugging
Zixing Liu <liushuyu@aosc.io>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
Christian Brauner <brauner@kernel.org>
binfmt_misc: set have_execfd only once the interpreter is opened
Christian Brauner <brauner@kernel.org>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: RFCOMM: Fix session UAF in set_termios
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: hci_sync: Protect UUID list traversal
MinJea Kim <qndkdrnl@gmail.com>
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Moksh Panicker <mokshpanicker.7@gmail.com>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
Fan Wu <fanwu01@zju.edu.cn>
wifi: brcmfmac: make release_scratchbuffers idempotent
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
Huihui Huang <hhhuang@smu.edu.sg>
wifi: wilc1000: validate assoc response length before subtracting header
Doruk Tan Ozturk <doruk@0sec.ai>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
Tristan Madani <tristan@talencesecurity.com>
wifi: ath6kl: fix OOB access from firmware ADDBA window size
Norbert Szetei <norbert@doyensec.com>
ALSA: seq: close a re-opened queue timer in the destructor
Johan Hovold <johan@kernel.org>
media: vpif_capture: fix OF node reference imbalance
Hans Verkuil <hverkuil+cisco@kernel.org>
media: vivid: check for vb2_is_busy() when toggling caps
Hans Verkuil <hverkuil+cisco@kernel.org>
media: vivid: add vivid_update_reduced_fps()
Guangshuo Li <lgs201920130244@gmail.com>
media: vimc: fix reference leak on failed device registration
Guangshuo Li <lgs201920130244@gmail.com>
media: vidtv: fix reference leak on failed device registration
Zile Xiong <xiongzile99@gmail.com>
media: vb2: use ssize_t for vb2_read/vb2_write
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: v4l2-ctrls: validate HEVC active reference counts
Sergey Shtylyov <s.shtylyov@auroraos.dev>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
Myeonghun Pak <mhun512@gmail.com>
media: ti: vpe: unwind v4l2 device registration on probe error
Hungyu Lin <dennylin0707@gmail.com>
media: tegra-video: vi: fix invalid u32 return value in format lookup
Valery Borovsky <vebohr@gmail.com>
media: sun4i-csi: Return queued buffers on start_streaming() failure
Myeonghun Pak <mhun512@gmail.com>
media: stm32: dcmi: unregister notifier on probe failure
Ma Ke <make24@iscas.ac.cn>
media: saa7134: Fix a possible memory leak in saa7134_video_init1
Valery Borovsky <vebohr@gmail.com>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure
Deepanshu Kartikey <kartikey406@gmail.com>
media: rtl2832: fix use-after-free in rtl2832_remove()
Myeonghun Pak <mhun512@gmail.com>
media: radio-si476x: Unregister v4l2_device on probe failure
Valery Borovsky <vebohr@gmail.com>
media: pwc: Return queued buffers on start_streaming() failure
Valery Borovsky <vebohr@gmail.com>
media: pwc: Drain fill_buf on start_streaming() failure
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
media: pci: dm1105: Free allocated workqueue
Guoniu Zhou <guoniu.zhou@nxp.com>
media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
Guoniu Zhou <guoniu.zhou@nxp.com>
media: nxp: imx8-isi: Fix potential out-of-bounds issues
Xiaolei Wang <xiaolei.wang@windriver.com>
media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
Xiaolei Wang <xiaolei.wang@windriver.com>
media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
Xiaolei Wang <xiaolei.wang@windriver.com>
media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
Valery Borovsky <vebohr@gmail.com>
media: msi2500: Return queued buffers on start_streaming() failure
Anand Moon <linux.amoon@gmail.com>
media: meson: vdec: Fix memory leak in error path of vdec_open
Guangshuo Li <lgs201920130244@gmail.com>
media: marvell-cam: fix missing pci_disable_device() on remove
Wang Jun <1742789905@qq.com>
media: cx23885: add ioremap return check and cleanup
Johan Hovold <johan@kernel.org>
media: cx231xx: fix devres lifetime
Pengpeng Hou <pengpeng@iscas.ac.cn>
media: cedrus: skip invalid H.264 reference list entries
Samuel Holland <samuel@sholland.org>
media: cedrus: Fix missing cleanup in error path
Myeonghun Pak <mhun512@gmail.com>
media: cedrus: clean up media device on probe failure
Myeonghun Pak <mhun512@gmail.com>
media: cec: seco: unregister adapter on IR probe failure
David Carlier <devnexen@gmail.com>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
Valery Borovsky <vebohr@gmail.com>
media: airspy: Return queued buffers on start_streaming() failure
Linmao Li <lilinmao@kylinos.cn>
drm/vc4: Prevent shader BO mappings from becoming writable
Ian Forbes <ian.forbes@broadcom.com>
drm/vmwgfx: Validate vmw_surface_metadata::array_size
Zhu Lingshan <lingshan.zhu@amd.com>
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
WenTao Liang <vulab@iscas.ac.cn>
drm/amd/display: set new_stream to NULL after release
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
Mario Limonciello <mario.limonciello@amd.com>
drm/amdgpu: Fix VFCT bus number matching with soft filter
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915/gem: Do not leak siblings[] on proto context error
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915: Return NULL on error in active_instance
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
Bryam Vargas <hexlabsecurity@proton.me>
drm/virtio: bound EDID block reads to the response buffer
WenTao Liang <vulab@iscas.ac.cn>
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
Thomas Zimmermann <tzimmermann@suse.de>
drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
David Francis <David.Francis@amd.com>
drm/amdkfd: Check bounds in allocate_event_notification_slot
Pavel Ondračka <pavel.ondracka@gmail.com>
drm/radeon: fix r100_copy_blit for large BOs
Wentao Liang <vulab@iscas.ac.cn>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915/gem: Add missing nospec on parallel submit slot
Junrui Luo <moonafterrain@outlook.com>
drm/nouveau: fix reversed error cleanup order in ucopy functions
Mario Limonciello <mario.limonciello@amd.com>
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
Ashutosh Desai <ashutoshdesai993@gmail.com>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Ashutosh Desai <ashutoshdesai993@gmail.com>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Ashutosh Desai <ashutoshdesai993@gmail.com>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
Vitor Soares <vitor.soares@toradex.com>
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
Sergey Shtylyov <s.shtylyov@auroraos.dev>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
Chengfeng Ye <nicoyip.dev@gmail.com>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
Marcin Szycik <marcin.szycik@linux.intel.com>
ice: fix LAG recipe to profile association
Li RongQing <lirongqing@baidu.com>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
Alexei Lazar <alazar@nvidia.com>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
Alexei Lazar <alazar@nvidia.com>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes
Yael Chemla <ychemla@nvidia.com>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
net: qrtr: restrict socket creation to the initial network namespace
Chenguang Zhao <zhaochenguang@kylinos.cn>
hinic: remove unused ethtool RSS user configuration buffers
Eric Dumazet <edumazet@google.com>
ppp: annotate data races in ppp_generic
Qingfang Deng <dqfext@gmail.com>
ppp: enable TX scatter-gather
Qingfang Deng <dqfext@gmail.com>
ppp: convert to percpu netstats
Qingfang Deng <dqfext@gmail.com>
ppp: use IFF_NO_QUEUE in virtual interfaces
Eric Dumazet <edumazet@google.com>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
Suman Ghosh <sumang@marvell.com>
octeontx2-vf: set TC flower flag on MCAM entry allocation
vadik likholetov <vadikas@gmail.com>
net: stmmac: enable the MAC on link up for all supported speeds
Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
net: stmmac: reset residual action in L3L4 filters on delete
Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests
Cen Zhang (Microsoft) <blbllhy@gmail.com>
tipc: fix u16 MTU truncation in media and bearer MTU validation
Zhang Yi <yi.zhang@huawei.com>
iomap: correct the range of a partial dirty clear
Harshaka Narayana <harshaka.narayana@broadcom.com>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
Qing Luo <luoqing@kylinos.cn>
sctp: auth: verify auth requirement when auth_chunk is NULL
Michael Walle <mwalle@kernel.org>
net: dpaa: fix mode setting
Eric Dumazet <edumazet@google.com>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
Nikolay Aleksandrov <razor@blackwall.org>
net: bridge: vlan: fix vlan range dumps starting with pvid
Michael Bommarito <michael.bommarito@gmail.com>
amt: make the head writable before rewriting the L2 header
Michael Bommarito <michael.bommarito@gmail.com>
amt: re-read skb header pointers after every pull
Shelley Yang <shelley.yang@infineon.com>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
Ruoyu Wang <ruoyuw560@gmail.com>
wifi: mt76: mt7915: guard HE capability lookups
Helen Koike <koike@igalia.com>
tipc: fix infinite loop in __tipc_nl_compat_dumpit
Xiang Mei (Microsoft) <xmei5@asu.edu>
nexthop: initialize extack in nh_res_bucket_migrate()
Xiang Mei (Microsoft) <xmei5@asu.edu>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
Matthieu Baerts (NGI0) <matttbe@kernel.org>
selftests: openvswitch: add config file
Matthieu Baerts (NGI0) <matttbe@kernel.org>
selftests: af_unix: add USER_NS config
Kuniyuki Iwashima <kuniyu@amazon.com>
selftest: af_unix: Add Kconfig file.
Rishikesh Jethwani <rjethwani@purestorage.com>
tls: device: push pending open record on splice EOF
Cen Zhang (Microsoft) <blbllhy@gmail.com>
sctp: validate stream count in sctp_process_strreset_inreq()
Nikhil P. Rao <nikhil.rao@amd.com>
pds_core: check for workqueue allocation failure
Nikhil P. Rao <nikhil.rao@amd.com>
pds_core: fix auxiliary device add/del races
Nikhil P. Rao <nikhil.rao@amd.com>
pds_core: order completion reads after the ownership check
Nikhil P. Rao <nikhil.rao@amd.com>
pds_core: yield the CPU while waiting for the adminq to drain
HanQuan <eilaimemedsnaimel@gmail.com>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
Prashanth Kumar KR <PrashanthKumar.K.R@amd.com>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
Nikhil P. Rao <nikhil.rao@amd.com>
pds_core: reject component parameter in legacy firmware update
Andrew Pope <andrew.pope@morsemicro.com>
wifi: mac80211: recalculate TIM when a station enters power save
Li RongQing <lirongqing@baidu.com>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
Pengpeng Hou <pengpeng@iscas.ac.cn>
iommu/amd: Bound the early ACPI HID map
HE WEI (ギカク) <skyexpoc@gmail.com>
wifi: mwifiex: bound uAP association event IEs to the event buffer
Ruoyu Wang <ruoyuw560@gmail.com>
wan: wanxl: Only reset hardware after BAR mapping
Ruoyu Wang <ruoyuw560@gmail.com>
nfp: Check resource mutex allocation
Xiang Mei <xmei5@asu.edu>
wifi: mac80211: tear down new links on vif update error path
Guanghui Feng <guanghuifeng@linux.alibaba.com>
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
Guangshuo Li <lgs201920130244@gmail.com>
dpaa2-eth: put MAC endpoint device on disconnect
Guangshuo Li <lgs201920130244@gmail.com>
dpaa2-switch: put MAC endpoint device on disconnect
Aldo Ariel Panzardo <qwe.aldo@gmail.com>
rds: drop incoming messages that cross network namespace boundaries
Zhaolong Zhang <zhangzl68@chinatelecom.cn>
bonding: fix devconf_all NULL dereference when IPv6 is disabled
David Lee <david.lee@trailofbits.com>
net/packet: avoid fanout hook re-registration after unregister
Pengpeng Hou <pengpeng@iscas.ac.cn>
Bluetooth: btusb: validate Realtek vendor event length
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: occ: validate poll response sensor blocks
Yichong Chen <chenyichong@uniontech.com>
smb: client: validate DFS referral PathConsumed
Eugene Shalygin <eugene.shalygin@gmail.com>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM
Eugene Shalygin <eugene.shalygin@gmail.com>
hwmon: (asus-ec-sensors) fix EC read intervals
Eugene Shalygin <eugene.shalygin@gmail.com>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
Shahar Tzarfati <shahar.tzarfati@intel.com>
wifi: iwlwifi: mvm: fix read in wake packet notification handler
Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
wifi: iwlwifi: mvm: validate SAR GEO response payload size
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs35l56: Use complete_all() to signal init_completion
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs35l56: Fix potential probe() deadlock
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs35l56: Don't use devres to unregister component
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
Pengpeng Hou <pengpeng@iscas.ac.cn>
ASoC: tas2781: bound firmware description string parsing
Guanghui Yang <3497809730@qq.com>
btrfs: free mapping node on duplicate reloc root insert
You-Kai Zheng <ykzheng@synology.com>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
Tristan Madani <tristan@talencesecurity.com>
wifi: carl9170: fix buffer overflow in rx_stream failover path
Tristan Madani <tristan@talencesecurity.com>
wifi: carl9170: fix OOB read from off-by-two in TX status handler
Tristan Madani <tristan@talencesecurity.com>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
Tristan Madani <tristan@talencesecurity.com>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
Tristan Madani <tristan@talencesecurity.com>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
Ruoyu Wang <ruoyuw560@gmail.com>
firewire: net: Fix fragmented datagram reassembly
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
Dmitry Morgun <d.morgun@ispras.ru>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
Tzung-Bi Shih <tzungbi@kernel.org>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
Guenter Roeck <linux@roeck-us.net>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
Guenter Roeck <linux@roeck-us.net>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
Edward Adam Davis <eadavis@qq.com>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
Gaole Zhang <gaole.zhang@oss.qualcomm.com>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
Cheng Yongkang <teel4res@gmail.com>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
Xincheng Zhang <zhangxincheng@ultrarisc.com>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
Xie Bo <xb@ultrarisc.com>
RISC-V: KVM: Serialize virtual interrupt pending state updates
Sasha Levin <sashal@kernel.org>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
Doruk Tan Ozturk <doruk@0sec.ai>
crypto: rsa-pkcs1pad: Don't WARN on an empty digest
Chukun Pan <amadeus@jmu.edu.cn>
USB: serial: option: add TDTECH MT5710-CN
Johan Hovold <johan@kernel.org>
USB: serial: keyspan_pda: fix data loss on receive throttling
Sunho Park <shpark061104@gmail.com>
USB: serial: io_edgeport: cap received transmit credits
Tim Pambor <timpambor@gmail.com>
USB: serial: ftdi_sio: add support for E+H FXA291
Muhammad Bilal <meatuni001@gmail.com>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
Fan Wu <fanwu01@zju.edu.cn>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
Sonali Pradhan <sonalipradhan@google.com>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
Johan Hovold <johan@kernel.org>
USB: gadget: fsl-udc: fix device name leak on probe failure
Johan Hovold <johan@kernel.org>
USB: gadget: snps-udc: fix device name leak on probe failure
Melbin K Mathew <mlbnkm1@gmail.com>
usb: gadget: printer: fix infinite loop in printer_read()
Fan Wu <fanwu01@zju.edu.cn>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Jinchao Wang <wangjinchao600@gmail.com>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
Huang Wei <huangwei@kylinos.cn>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
Huihui Huang <hhhuang@smu.edu.sg>
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
Weiming Shi <bestswngs@gmail.com>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
Xin Long <lucien.xin@gmail.com>
sctp: fix auth_hmacs array size in struct sctp_cookie
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: act_tunnel_key: Defer dst_release to RCU callback
Emre Cecanpunar <emreleno@gmail.com>
drm/i915/selftests: Fix GT PM sort comparators
Xiang Mei (Microsoft) <xmei5@asu.edu>
ksmbd: validate compound request size before reading StructureSize2
Qihang <q.h.hack.winter@gmail.com>
ksmbd: pin conn during async oplock break notification
Shuhao Fu <sfual@cse.ust.hk>
can: j1939: fix lockless local-destination check
Michal Luczaj <mhal@rbox.co>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
Shrikanth Hegde <sshegde@linux.ibm.com>
powerpc/vtime: Initialize starttime at boot for native accounting
Frederic Weisbecker <frederic@kernel.org>
powerpc/time: Prepare to stop elapsing in dynticks-idle
Alexander Gordeev <agordeev@linux.ibm.com>
sched/vtime: Get rid of generic vtime_task_switch() implementation
Pengpeng Hou <pengpeng@iscas.ac.cn>
drm/i915/gt: use correct selftest config symbol
Huiwen He <hehuiwen@kylinos.cn>
smb/client: handle overlapping allocated ranges in fallocate
Ruoyu Wang <ruoyuw560@gmail.com>
Bluetooth: hci_qca: Clear memdump state on invalid dump size
Pauli Virtanen <pav@iki.fi>
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Pauli Virtanen <pav@iki.fi>
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Xiang Mei <xmei5@asu.edu>
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
Rosen Penev <rosenp@gmail.com>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
Rosen Penev <rosenp@gmail.com>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
Rosen Penev <rosenp@gmail.com>
ata: sata_dwc_460ex: use platform_get_irq()
Rosen Penev <rosenp@gmail.com>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
Bryam Vargas <hexlabsecurity@proton.me>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Weiming Shi <bestswngs@gmail.com>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Norbert Szetei <norbert@doyensec.com>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Pushpendra Singh <pushpendra.singh@oss.qualcomm.com>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
Uday Khare <udaykhare77@gmail.com>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
Charles Keepax <ckeepax@opensource.cirrus.com>
ASoC: cs42l43: Correct report for forced microphone jack
Vijendar Mukunda <Vijendar.Mukunda@amd.com>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
Christian Hewitt <christianshewitt@gmail.com>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
HE WEI (ギカク) <skyexpoc@gmail.com>
wifi: cfg80211: bound element ID read when checking non-inheritance
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: brcmfmac: initialize SDIO data work before cleanup
Cen Zhang <zzzccc427@gmail.com>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
Zhao Li <enderaoelyther@gmail.com>
wifi: cfg80211: reject unsupported PMSR FTM location requests
Zhao Li <enderaoelyther@gmail.com>
wifi: cfg80211: validate PMSR FTM preamble range
Zhao Li <enderaoelyther@gmail.com>
wifi: cfg80211: validate PMSR measurement type data
Zhao Li <enderaoelyther@gmail.com>
wifi: nl80211: validate nested MBSSID IE blobs
Zhao Li <enderaoelyther@gmail.com>
wifi: nl80211: free RNR data on MBSSID mismatch
Xiang Mei <xmei5@asu.edu>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Dawei Feng <dawei.feng@seu.edu.cn>
wifi: libertas: fix memory leak in helper_firmware_cb()
Bryam Vargas <hexlabsecurity@proton.me>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Cen Zhang <zzzccc427@gmail.com>
wifi: cfg80211: cancel sched scan results work on unregister
Xiang Mei (Microsoft) <xmei5@asu.edu>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
Xiang Mei (Microsoft) <xmei5@asu.edu>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
Aleksandrova Alyona <aga@itb.spb.ru>
RDMA/irdma: Prevent overflows in memory contiguity checks
Malaya Kumar Rout <malayarout91@gmail.com>
selftests/alsa: Fix memory leak in find_controls error path
Xue Lei <Xue.Lei@windriver.com>
mtd: fix double free and WARN_ON in add_mtd_device() error paths
Ruoyu Wang <ruoyuw560@gmail.com>
RDMA/siw: publish QP after initialization
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp
Danila Chernetsov <listdansp@mail.ru>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup
Ruoyu Wang <ruoyuw560@gmail.com>
RDMA/erdma: initialize ret for empty receive WR lists
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Prevent rereg_mr for non-mem regions
Jacob Moroni <jmoroni@google.com>
RDMA/umem: Add helpers for umem dmabuf revoke lock
Jacob Moroni <jmoroni@google.com>
RDMA/umem: Add pinned revocable dmabuf import interface
Jacob Moroni <jmoroni@google.com>
RDMA/umem: Move umem dmabuf revoke logic into helper function
Jacob Moroni <jmoroni@google.com>
RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
Yishai Hadas <yishaih@nvidia.com>
RDMA/umem: Introduce an option to revoke DMABUF umem
Yishai Hadas <yishaih@nvidia.com>
RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device
Or Gerlitz <ogerlitz@ddn.com>
RDMA/cma: Fix hardware address comparison length in netevent callback
Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
Filipe Manana <fdmanana@suse.com>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
Xiang Mei <xmei5@asu.edu>
btrfs: reject free space cache with more entries than pages
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: nand: mtk-ecc: stop on ECC idle timeouts
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: mtdswap: remove debugfs stats file on teardown
Michael Bommarito <michael.bommarito@gmail.com>
IB/mad: Drop unmatched RMPP responses before reassembly
Sumit Gupta <sumitg@nvidia.com>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix logic error in packet reset
Seungjin Bae <eeodqql09@gmail.com>
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Chuck Lever <chuck.lever@oracle.com>
xprtrdma: Clear receive-side ownership pointers on release
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Jhonraushan <raushan.jhon@gmail.com>
accel/ivpu: Reject firmware log with size smaller than header
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
Oliver Hartkopp <socketcan@hartkopp.net>
can: isotp: serialize TX state transitions under so->rx_lock
Oliver Hartkopp <socketcan@hartkopp.net>
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix stale rx/tx ops after device removal
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: add missing device refcount for CAN filter removal
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: extend bcm_tx_lock usage for data and timer updates
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix CAN frame rx/tx statistics
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: add locking when updating filter and timer values
Phil Rosenthal <phil@phil.gs>
KVM: x86/mmu: Fix use-after-free on vendor module reload
Hyunwoo Kim <imv4bel@gmail.com>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
Sean Christopherson <seanjc@google.com>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Heiko Carstens <hca@linux.ibm.com>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
Peter Zijlstra <peterz@infradead.org>
seqlock: Allow KASAN to fail optimizing
Peter Zijlstra <peterz@infradead.org>
seqlock: Cure some more scoped_seqlock() optimization fails
Daniel Gibson <daniel@gibson.sh>
platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
Daniel Gibson <daniel@gibson.sh>
platform/x86/amd/pmc: Don't log during intermediate wakeups
Ryosuke Yasuoka <ryasuoka@redhat.com>
drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
Daniel Borkmann <daniel@iogearbox.net>
selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
Daniel Borkmann <daniel@iogearbox.net>
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Guixiong Wei <weiguixiong@bytedance.com>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 +-
arch/arm64/kvm/arm.c | 2 +-
arch/loongarch/kernel/kgdb.c | 3 +-
arch/mips/kvm/mips.c | 2 +-
arch/powerpc/include/asm/cputime.h | 13 -
arch/powerpc/kernel/time.c | 65 +++
arch/powerpc/kvm/powerpc.c | 2 +-
arch/riscv/include/asm/kvm_host.h | 10 +-
arch/riscv/kvm/aia.c | 35 +-
arch/riscv/kvm/vcpu.c | 66 ++-
arch/riscv/kvm/vcpu_onereg.c | 8 +-
arch/s390/kvm/kvm-s390.c | 2 +-
arch/x86/boot/compressed/Makefile | 1 +
arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +-
arch/x86/kvm/lapic.c | 2 +-
arch/x86/kvm/mmu/mmu.c | 11 +-
arch/x86/kvm/mmu/paging_tmpl.h | 10 +-
arch/x86/kvm/svm/svm.c | 7 +-
arch/x86/kvm/vmx/nested.c | 11 +-
arch/x86/kvm/x86.c | 4 +-
crypto/rsa-pkcs1pad.c | 2 +-
drivers/accel/ivpu/ivpu_fw_log.c | 4 +
drivers/ata/libata-core.c | 18 +
drivers/ata/libata-scsi.c | 2 -
drivers/ata/libata.h | 9 +
drivers/ata/sata_dwc_460ex.c | 38 +-
drivers/block/rbd.c | 7 +-
drivers/bluetooth/btqca.c | 2 +-
drivers/bluetooth/btusb.c | 4 +-
drivers/bluetooth/hci_qca.c | 4 +
drivers/cdrom/cdrom.c | 1 +
drivers/char/ipmi/ipmi_msghandler.c | 8 +
drivers/comedi/drivers/comedi_parport.c | 13 +-
drivers/dma-buf/udmabuf.c | 21 +-
drivers/dma/dw-edma/dw-edma-pcie.c | 63 +--
drivers/dma/sh/rz-dmac.c | 96 ++--
drivers/firewire/net.c | 37 +-
drivers/firmware/arm_ffa/driver.c | 2 +-
drivers/firmware/arm_scmi/notify.c | 6 +-
drivers/fpga/dfl-afu-main.c | 3 +
drivers/gpio/gpio-mt7621.c | 2 +
drivers/gpio/gpio-mvebu.c | 4 +-
drivers/gpio/gpio-pxa.c | 4 +-
drivers/gpio/gpio-tegra.c | 18 +-
drivers/gpio/gpio-vf610.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 +
drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 -
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 54 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 58 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 +-
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +-
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +-
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 -
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +-
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 +-
drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 +-
drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 +-
drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +-
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +-
.../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 9 +-
.../gpu/drm/amd/display/dc/link/link_detection.c | 5 +-
.../amd/display/modules/info_packet/info_packet.c | 2 -
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +
drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 +-
drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 +-
drivers/gpu/drm/display/drm_dp_mst_topology.c | 36 +-
drivers/gpu/drm/i915/gem/i915_gem_context.c | 25 +-
drivers/gpu/drm/i915/gt/intel_engine_user.c | 2 +-
drivers/gpu/drm/i915/gt/selftest_gt_pm.c | 8 +-
drivers/gpu/drm/i915/i915_active.c | 7 +-
drivers/gpu/drm/nouveau/nouveau_exec.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 4 +-
drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 +
drivers/gpu/drm/radeon/r100.c | 13 +-
drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +
drivers/gpu/drm/vc4/vc4_bo.c | 10 +-
drivers/gpu/drm/virtio/virtgpu_kms.c | 5 +-
drivers/gpu/drm/virtio/virtgpu_vq.c | 6 +-
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +-
drivers/gpu/host1x/bus.c | 4 +-
drivers/hwmon/asus-ec-sensors.c | 18 +-
drivers/hwmon/corsair-cpro.c | 1 +
drivers/hwmon/corsair-psu.c | 1 +
drivers/hwmon/nzxt-smart2.c | 2 +-
drivers/hwmon/occ/common.c | 38 +-
drivers/hwtracing/intel_th/core.c | 10 -
drivers/hwtracing/intel_th/msu.c | 2 +
drivers/i2c/busses/i2c-davinci.c | 4 +-
drivers/i2c/busses/i2c-i801.c | 2 +-
drivers/i2c/busses/i2c-imx.c | 126 +++--
drivers/infiniband/core/cma.c | 2 +-
drivers/infiniband/core/mad.c | 30 ++
drivers/infiniband/core/umem_dmabuf.c | 176 ++++++-
drivers/infiniband/hw/erdma/erdma_qp.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +-
drivers/infiniband/hw/irdma/verbs.c | 7 +-
drivers/infiniband/sw/siw/siw_verbs.c | 62 ++-
drivers/input/misc/ims-pcu.c | 37 +-
drivers/iommu/amd/init.c | 6 +
drivers/iommu/amd/iommu.c | 25 +-
drivers/iommu/intel/perf.c | 2 +-
drivers/iommu/intel/svm.c | 2 +-
drivers/md/dm-verity-target.c | 14 +-
drivers/md/dm-verity.h | 2 +-
drivers/media/cec/platform/seco/seco-cec.c | 6 +-
drivers/media/common/videobuf2/videobuf2-core.c | 12 +-
drivers/media/dvb-frontends/rtl2832.c | 4 +-
drivers/media/dvb-frontends/rtl2832_sdr.c | 19 +-
drivers/media/pci/cx23885/cx23885-core.c | 14 +-
drivers/media/pci/dm1105/dm1105.c | 1 +
drivers/media/pci/saa7134/saa7134-video.c | 25 +-
drivers/media/platform/aspeed/aspeed-video.c | 1 +
drivers/media/platform/marvell/cafe-driver.c | 1 +
.../media/platform/nxp/imx8-isi/imx8-isi-core.c | 2 +
.../media/platform/nxp/imx8-isi/imx8-isi-core.h | 16 +
.../platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c | 9 +-
drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 11 +-
.../media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 20 +-
drivers/media/platform/st/stm32/stm32-dcmi.c | 1 +
drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 6 +-
drivers/media/platform/ti/davinci/vpif_capture.c | 2 +-
drivers/media/platform/ti/vpe/vpe.c | 3 +-
drivers/media/radio/radio-si476x.c | 1 +
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +-
drivers/media/test-drivers/vimc/vimc-core.c | 1 +
drivers/media/test-drivers/vivid/vivid-ctrls.c | 15 +-
drivers/media/test-drivers/vivid/vivid-vid-cap.c | 38 +-
drivers/media/test-drivers/vivid/vivid-vid-cap.h | 1 +
drivers/media/test-drivers/vivid/vivid-vid-out.c | 6 +
drivers/media/usb/airspy/airspy.c | 8 +-
drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +-
drivers/media/usb/msi2500/msi2500.c | 32 +-
drivers/media/usb/pwc/pwc-if.c | 13 +-
drivers/media/v4l2-core/v4l2-ctrls-core.c | 13 +
drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +-
drivers/misc/mei/bus.c | 16 +-
drivers/mmc/host/vub300.c | 36 +-
drivers/mtd/maps/vmu-flash.c | 8 +-
drivers/mtd/mtdcore.c | 23 +-
drivers/mtd/mtdswap.c | 5 +-
drivers/mtd/nand/ecc-mtk.c | 16 +-
drivers/mtd/nand/raw/nand_base.c | 43 +-
drivers/net/amt.c | 87 +++-
drivers/net/bonding/bond_main.c | 3 +-
drivers/net/ethernet/amd/pds_core/adminq.c | 12 +-
drivers/net/ethernet/amd/pds_core/auxbus.c | 17 +-
drivers/net/ethernet/amd/pds_core/core.c | 1 +
drivers/net/ethernet/amd/pds_core/devlink.c | 6 +
drivers/net/ethernet/amd/pds_core/main.c | 9 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 +-
drivers/net/ethernet/cadence/macb_main.c | 22 +-
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 1 +
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 1 +
drivers/net/ethernet/freescale/fman/fman_dtsec.c | 17 +-
drivers/net/ethernet/hisilicon/hip04_eth.c | 11 +-
drivers/net/ethernet/huawei/hinic/hinic_dev.h | 2 -
drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 21 -
drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 121 +----
drivers/net/ethernet/intel/ice/ice_lag.c | 2 +-
drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 +
.../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 +
.../ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 +
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 28 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +-
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 +
.../ethernet/mellanox/mlx5/core/esw/acl/helper.c | 2 +-
drivers/net/ethernet/microsoft/mana/mana_en.c | 13 +
.../ethernet/netronome/nfp/nfpcore/nfp_resource.c | 3 +
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 92 ++--
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 35 ++
drivers/net/geneve.c | 3 +
drivers/net/gtp.c | 5 +-
drivers/net/ipa/ipa_smp2p.c | 30 +-
drivers/net/mctp/mctp-serial.c | 2 +-
drivers/net/pcs/pcs-xpcs.c | 34 +-
drivers/net/ppp/ppp_generic.c | 154 +++---
drivers/net/ppp/pppoe.c | 2 +
drivers/net/ppp/pptp.c | 1 +
drivers/net/slip/slip.c | 4 +
drivers/net/vmxnet3/vmxnet3_drv.c | 22 +-
drivers/net/vxlan/vxlan_core.c | 3 +
drivers/net/vxlan/vxlan_mdb.c | 30 +-
drivers/net/wan/wanxl.c | 3 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +
drivers/net/wireless/ath/ath11k/pci.c | 4 +
drivers/net/wireless/ath/ath11k/qmi.c | 11 +-
drivers/net/wireless/ath/ath12k/pci.c | 4 +
drivers/net/wireless/ath/ath6kl/txrx.c | 10 +-
drivers/net/wireless/ath/ath6kl/wmi.c | 20 +
drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +-
drivers/net/wireless/ath/carl9170/rx.c | 7 +-
drivers/net/wireless/ath/carl9170/tx.c | 2 +-
drivers/net/wireless/atmel/at76c50x-usb.c | 7 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 8 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 10 +
drivers/net/wireless/intersil/p54/txrx.c | 8 +
drivers/net/wireless/marvell/libertas/firmware.c | 1 +
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/tdls.c | 2 +-
drivers/net/wireless/marvell/mwifiex/uap_event.c | 24 +-
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 6 +
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 18 +-
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 19 +-
drivers/net/wireless/microchip/wilc1000/hif.c | 5 +
drivers/net/wireless/virtual/mac80211_hwsim.c | 1 +
drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 4 +-
drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +-
drivers/pinctrl/core.c | 14 +-
drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +-
drivers/pinctrl/intel/pinctrl-intel.c | 4 +-
drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +-
drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +-
drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +-
drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +-
drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +-
drivers/pinctrl/pinctrl-as3722.c | 4 +-
drivers/pinctrl/pinctrl-axp209.c | 2 +-
drivers/pinctrl/pinctrl-cy8c95x0.c | 4 +-
drivers/pinctrl/pinctrl-ingenic.c | 11 +-
drivers/pinctrl/pinctrl-ocelot.c | 4 +-
drivers/pinctrl/pinctrl-rk805.c | 4 +-
drivers/pinctrl/pinctrl-st.c | 4 +-
drivers/pinctrl/renesas/gpio.c | 4 +-
drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +-
drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +-
drivers/platform/loongarch/loongson-laptop.c | 1 +
drivers/platform/x86/amd/pmc/pmc.c | 39 +-
drivers/platform/x86/amd/pmc/pmc.h | 1 +
drivers/platform/x86/dell/dell-laptop.c | 28 +-
drivers/platform/x86/dell/dell-smbios-base.c | 25 +
drivers/platform/x86/dell/dell-smbios.h | 5 +
.../uncore-frequency/uncore-frequency-common.c | 7 +-
drivers/staging/media/meson/vdec/vdec.c | 4 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 6 +-
drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +
drivers/staging/media/tegra-video/vi.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 9 +-
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2 +-
drivers/thunderbolt/debugfs.c | 2 +
drivers/thunderbolt/domain.c | 36 +-
drivers/thunderbolt/icm.c | 5 +
drivers/thunderbolt/nhi.c | 6 +-
drivers/thunderbolt/nvm.c | 4 +-
drivers/thunderbolt/property.c | 38 +-
drivers/thunderbolt/switch.c | 20 +-
drivers/thunderbolt/tb.c | 61 ++-
drivers/thunderbolt/tb.h | 2 +
drivers/thunderbolt/xdomain.c | 149 ++++--
drivers/tty/serial/8250/8250_mid.c | 14 +-
drivers/tty/serial/max310x.c | 20 +-
drivers/tty/serial/sc16is7xx.c | 12 +
drivers/usb/atm/ueagle-atm.c | 17 +
drivers/usb/chipidea/core.c | 1 +
drivers/usb/gadget/function/f_midi.c | 1 +
drivers/usb/gadget/function/f_ncm.c | 17 +-
drivers/usb/gadget/function/f_printer.c | 23 +-
drivers/usb/gadget/function/uvc_v4l2.c | 2 +
drivers/usb/gadget/udc/bdc/bdc_core.c | 20 +
drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +-
drivers/usb/gadget/udc/dummy_hcd.c | 40 +-
drivers/usb/gadget/udc/fsl_udc_core.c | 1 -
drivers/usb/gadget/udc/snps_udc_core.c | 1 -
drivers/usb/host/xhci-pci.c | 1 +
drivers/usb/host/xhci.c | 15 +-
drivers/usb/host/xhci.h | 1 +
drivers/usb/serial/ftdi_sio.c | 2 +
drivers/usb/serial/ftdi_sio_ids.h | 5 +
drivers/usb/serial/io_edgeport.c | 3 +-
drivers/usb/serial/keyspan_pda.c | 44 +-
drivers/usb/serial/option.c | 1 +
drivers/usb/storage/unusual_devs.h | 7 +
drivers/vdpa/vdpa_user/iova_domain.c | 161 ++++---
drivers/vdpa/vdpa_user/iova_domain.h | 13 +-
drivers/vdpa/vdpa_user/vduse_dev.c | 16 +-
drivers/video/fbdev/core/bitblit.c | 122 ++---
drivers/video/fbdev/core/fbcon.c | 420 ++++++++--------
drivers/video/fbdev/core/fbcon.h | 6 +-
drivers/video/fbdev/core/fbcon_ccw.c | 148 +++---
drivers/video/fbdev/core/fbcon_cw.c | 148 +++---
drivers/video/fbdev/core/fbcon_rotate.c | 44 +-
drivers/video/fbdev/core/fbcon_rotate.h | 6 +-
drivers/video/fbdev/core/fbcon_ud.c | 164 +++----
drivers/video/fbdev/core/softcursor.c | 18 +-
drivers/video/fbdev/core/tileblit.c | 28 +-
drivers/video/fbdev/efifb.c | 125 ++---
drivers/watchdog/watchdog_pretimeout.c | 2 +
fs/afs/addr_list.c | 10 +-
fs/afs/fs_probe.c | 6 +-
fs/afs/internal.h | 6 +-
fs/afs/proc.c | 4 +-
fs/afs/rotate.c | 2 +-
fs/afs/rxrpc.c | 15 +-
fs/afs/server.c | 4 +-
fs/afs/vl_alias.c | 4 +-
fs/afs/vl_probe.c | 6 +-
fs/afs/vl_rotate.c | 2 +-
fs/binfmt_elf_fdpic.c | 4 +
fs/binfmt_misc.c | 5 +-
fs/btrfs/free-space-cache.c | 3 +
fs/btrfs/relocation.c | 2 +
fs/ceph/caps.c | 1 +
fs/ceph/ioctl.c | 6 +
fs/coredump.c | 1 +
fs/crypto/inline_crypt.c | 57 +--
fs/crypto/keysetup_v1.c | 8 +-
fs/exec.c | 2 +-
fs/exfat/balloc.c | 54 ++-
fs/f2fs/super.c | 25 +-
fs/iomap/buffered-io.c | 12 +-
fs/namei.c | 43 ++
fs/nfs/internal.h | 16 +-
fs/nfs/pnfs_nfs.c | 2 +-
fs/nfs/write.c | 14 +-
fs/nfsd/nfs4xdr.c | 8 +-
fs/nfsd/vfs.c | 7 +-
fs/nfsd/vfs.h | 2 +-
fs/overlayfs/copy_up.c | 12 +-
fs/posix_acl.c | 7 +
fs/proc/namespaces.c | 4 +-
fs/smb/client/misc.c | 34 +-
fs/smb/client/smb2ops.c | 25 +-
fs/smb/server/oplock.c | 6 +-
fs/smb/server/smb2misc.c | 5 +
fs/smb/server/smb2pdu.c | 9 +-
fs/smb/server/smbacl.c | 42 +-
include/linux/audit.h | 6 +-
include/linux/audit_arch.h | 12 +-
include/linux/bootconfig.h | 3 +
include/linux/bpf_lsm.h | 4 +
include/linux/firmware.h | 3 +
include/linux/fscrypt.h | 18 +-
include/linux/kvm_host.h | 1 +
include/linux/lsm_hooks.h | 1 +
include/linux/namei.h | 1 +
include/linux/pinctrl/consumer.h | 13 +-
include/linux/ppp_channel.h | 3 +-
include/linux/seqlock.h | 10 +-
include/linux/sunrpc/svcsock.h | 3 +
include/linux/sunrpc/xdr.h | 19 +-
include/linux/vtime.h | 6 +
include/linux/workqueue.h | 8 +-
include/media/videobuf2-core.h | 8 +-
include/net/af_rxrpc.h | 25 +-
include/net/bluetooth/rfcomm.h | 3 +
include/net/netfilter/nf_tables.h | 37 --
include/net/netfilter/nft_fib.h | 2 -
include/net/netfilter/nft_meta.h | 3 -
include/net/sctp/structs.h | 3 +-
include/rdma/ib_umem.h | 41 ++
include/trace/events/rxrpc.h | 3 +-
include/uapi/linux/btrfs.h | 2 +-
init/main.c | 39 --
io_uring/rw.c | 28 +-
kernel/audit.c | 2 +-
kernel/audit.h | 32 +-
kernel/audit_fsnotify.c | 39 +-
kernel/audit_tree.c | 2 +-
kernel/audit_watch.c | 42 +-
kernel/auditfilter.c | 17 +-
kernel/auditsc.c | 6 +-
kernel/bpf/bpf_inode_storage.c | 9 +
kernel/bpf/bpf_lsm.c | 1 -
kernel/bpf/verifier.c | 17 +
kernel/locking/spinlock_rt.c | 27 +-
kernel/sched/cputime.c | 13 -
kernel/taskstats.c | 67 +--
kernel/trace/ftrace.c | 13 +
kernel/trace/trace_eprobe.c | 3 +-
kernel/trace/trace_events_user.c | 43 +-
kernel/trace/trace_mmiotrace.c | 4 +-
kernel/trace/trace_probe.c | 13 +-
kernel/workqueue.c | 46 +-
lib/bootconfig.c | 65 +++
lib/compat_audit.c | 12 +-
mm/damon/core.c | 13 +
mm/mm_init.c | 34 +-
net/bluetooth/hci_sync.c | 13 +-
net/bluetooth/mgmt.c | 42 +-
net/bluetooth/rfcomm/core.c | 17 +
net/bluetooth/rfcomm/tty.c | 7 +-
net/bridge/br_netlink_tunnel.c | 3 +-
net/bridge/br_private.h | 6 +-
net/bridge/br_vlan.c | 10 +-
net/bridge/br_vlan_options.c | 3 +-
net/bridge/netfilter/nft_meta_bridge.c | 20 -
net/bridge/netfilter/nft_reject_bridge.c | 1 -
net/can/bcm.c | 528 +++++++++++++++------
net/can/isotp.c | 278 ++++++++---
net/can/j1939/transport.c | 18 +-
net/ceph/auth_x.c | 9 +-
net/ceph/ceph_common.c | 4 +-
net/ceph/mon_client.c | 4 +-
net/ceph/osdmap.c | 12 +-
net/core/sock_map.c | 2 +
net/hsr/hsr_slave.c | 2 +
net/ipv4/fib_trie.c | 2 +-
net/ipv4/icmp.c | 18 +-
net/ipv4/netfilter/nft_dup_ipv4.c | 1 -
net/ipv4/netfilter/nft_fib_ipv4.c | 2 -
net/ipv4/netfilter/nft_reject_ipv4.c | 1 -
net/ipv4/nexthop.c | 2 +-
net/ipv4/tcp_bpf.c | 2 +-
net/ipv6/ila/ila_common.c | 12 +
net/ipv6/ip6_tunnel.c | 3 +
net/ipv6/ndisc.c | 8 +-
net/ipv6/netfilter/nft_dup_ipv6.c | 1 -
net/ipv6/netfilter/nft_fib_ipv6.c | 2 -
net/ipv6/netfilter/nft_reject_ipv6.c | 1 -
net/ipv6/raw.c | 2 +-
net/ipv6/xfrm6_policy.c | 1 +
net/iucv/af_iucv.c | 21 +-
net/l2tp/l2tp_ppp.c | 1 +
net/mac80211/iface.c | 8 +-
net/mac80211/link.c | 4 +
net/mac80211/rx.c | 2 +
net/mac802154/llsec.c | 5 +
net/mac802154/scan.c | 11 +
net/mpls/af_mpls.c | 3 +
net/mptcp/options.c | 12 +-
net/mptcp/protocol.c | 1 +
net/netfilter/nf_conntrack_sip.c | 10 +-
net/netfilter/nf_tables_api.c | 67 ---
net/netfilter/nft_bitwise.c | 104 ----
net/netfilter/nft_byteorder.c | 11 -
net/netfilter/nft_cmp.c | 3 -
net/netfilter/nft_compat.c | 10 -
net/netfilter/nft_connlimit.c | 1 -
net/netfilter/nft_counter.c | 1 -
net/netfilter/nft_ct.c | 46 --
net/netfilter/nft_dup_netdev.c | 1 -
net/netfilter/nft_dynset.c | 1 -
net/netfilter/nft_exthdr.c | 34 --
net/netfilter/nft_fib.c | 51 +-
net/netfilter/nft_fib_inet.c | 1 -
net/netfilter/nft_fib_netdev.c | 30 +-
net/netfilter/nft_flow_offload.c | 1 -
net/netfilter/nft_fwd_netdev.c | 2 -
net/netfilter/nft_hash.c | 36 --
net/netfilter/nft_immediate.c | 12 -
net/netfilter/nft_last.c | 1 -
net/netfilter/nft_limit.c | 2 -
net/netfilter/nft_log.c | 1 -
net/netfilter/nft_lookup.c | 12 -
net/netfilter/nft_masq.c | 3 -
net/netfilter/nft_meta.c | 45 --
net/netfilter/nft_nat.c | 2 -
net/netfilter/nft_numgen.c | 22 -
net/netfilter/nft_objref.c | 2 -
net/netfilter/nft_osf.c | 25 -
net/netfilter/nft_payload.c | 47 --
net/netfilter/nft_queue.c | 2 -
net/netfilter/nft_quota.c | 1 -
net/netfilter/nft_range.c | 1 -
net/netfilter/nft_redir.c | 3 -
net/netfilter/nft_reject_inet.c | 1 -
net/netfilter/nft_reject_netdev.c | 1 -
net/netfilter/nft_rt.c | 1 -
net/netfilter/nft_set_pipapo.c | 259 ++++++----
net/netfilter/nft_set_pipapo.h | 8 +
net/netfilter/nft_socket.c | 26 -
net/netfilter/nft_synproxy.c | 1 -
net/netfilter/nft_tproxy.c | 1 -
net/netfilter/nft_tunnel.c | 26 -
net/netfilter/nft_xfrm.c | 27 --
net/openvswitch/actions.c | 15 +-
net/openvswitch/datapath.c | 25 +-
net/openvswitch/datapath.h | 2 +-
net/openvswitch/vport.c | 2 +-
net/packet/af_packet.c | 6 +-
net/phonet/pep.c | 2 +
net/qrtr/af_qrtr.c | 8 +
net/qrtr/ns.c | 4 +-
net/rds/recv.c | 15 +
net/rxrpc/af_rxrpc.c | 24 +-
net/rxrpc/ar-internal.h | 3 +-
net/rxrpc/call_accept.c | 77 +--
net/rxrpc/call_object.c | 42 +-
net/rxrpc/conn_client.c | 12 +-
net/rxrpc/conn_event.c | 14 +-
net/rxrpc/conn_object.c | 8 +-
net/rxrpc/input.c | 5 +-
net/rxrpc/io_thread.c | 8 +-
net/rxrpc/peer_event.c | 8 +-
net/rxrpc/peer_object.c | 1 +
net/rxrpc/recvmsg.c | 26 +-
net/rxrpc/rxperf.c | 10 +-
net/rxrpc/security.c | 4 +-
net/rxrpc/sendmsg.c | 8 +-
net/rxrpc/txbuf.c | 4 +-
net/sched/act_tunnel_key.c | 14 +-
net/sctp/auth.c | 2 +-
net/sctp/sm_make_chunk.c | 6 +
net/sctp/sm_statefuns.c | 2 +-
net/sctp/stream.c | 6 +-
net/sunrpc/svcsock.c | 51 +-
net/sunrpc/xdr.c | 210 +++++++-
net/sunrpc/xprtrdma/rpc_rdma.c | 4 +
net/sunrpc/xprtrdma/verbs.c | 12 +-
net/tipc/netlink.c | 6 +-
net/tipc/netlink_compat.c | 4 +
net/tipc/socket.c | 7 +-
net/tls/tls_device.c | 6 +-
net/wireless/core.c | 1 +
net/wireless/nl80211.c | 20 +-
net/wireless/pmsr.c | 21 +-
net/wireless/scan.c | 2 +-
net/x25/af_x25.c | 8 +-
net/xfrm/xfrm_policy.c | 4 +-
security/apparmor/include/net.h | 6 +-
security/apparmor/lsm.c | 38 +-
security/apparmor/net.c | 2 +-
security/bpf/hooks.c | 3 +
security/security.c | 36 +-
security/selinux/hooks.c | 99 ++--
security/selinux/include/objsec.h | 5 +
security/selinux/netlabel.c | 23 +-
security/smack/smack.h | 5 +
security/smack/smack_lsm.c | 70 ++-
security/smack/smack_netfilter.c | 4 +-
sound/core/seq/seq_timer.c | 13 +-
sound/hda/hdac_regmap.c | 4 +-
sound/pci/hda/patch_conexant.c | 3 -
sound/soc/amd/ps/pci-ps.c | 2 +-
sound/soc/codecs/bt-sco.c | 10 +-
sound/soc/codecs/cs35l56-i2c.c | 4 +-
sound/soc/codecs/cs35l56-spi.c | 4 +-
sound/soc/codecs/cs35l56.c | 25 +-
sound/soc/codecs/cs42l43-jack.c | 3 +-
sound/soc/codecs/tas2562.c | 5 +-
sound/soc/codecs/tas2781-fmwlib.c | 63 ++-
sound/soc/mediatek/mt6797/mt6797-afe-pcm.c | 14 +-
sound/soc/mediatek/mt7986/mt7986-afe-pcm.c | 14 +-
sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 26 +-
sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 21 +-
sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 135 ++----
sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 54 +--
sound/soc/mediatek/mt8195/mt8195-mt6359.c | 38 +-
sound/soc/meson/aiu-fifo-spdif.c | 5 +
sound/usb/quirks.c | 2 +
tools/testing/selftests/alsa/mixer-test.c | 1 +
.../testing/selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++
tools/testing/selftests/ftrace/ftracetest | 1 +
tools/testing/selftests/net/af_unix/config | 4 +
tools/testing/selftests/net/openvswitch/config | 16 +
virt/kvm/kvm_main.c | 3 +
561 files changed, 6388 insertions(+), 4060 deletions(-)
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 001/484] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 002/484] bpf: Fix ld_{abs,ind} failure path analysis in subprogs Greg Kroah-Hartman
` (488 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Ilpo Järvinen, Guixiong Wei, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixiong Wei <weiguixiong@bytedance.com>
commit 6b63520ed14b17bbe9c2103debbd2152dde1fba3 upstream.
When the last CPU of a legacy uncore die goes offline,
uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug
re-add, uncore_freq_add_entry() still populates sysfs attributes before
assigning the new control CPU. As a result, the current frequency read
returns -ENXIO and current_freq_khz is omitted from the recreated sysfs
group.
Assign control_cpu before the initial read paths and before
create_attr_group() so sysfs recreation uses the new online CPU. If
sysfs creation fails, restore control_cpu to -1 to keep the error path
state consistent.
Fixes: 4d73c6772ab7 ("platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency")
Cc: stable@vger.kernel.org
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260602020752.3126-1-weiguixiong@bytedance.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[weiguixiong: Adapt to legacy uncore_read() and instance_id naming.]
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../x86/intel/uncore-frequency/uncore-frequency-common.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c
index 33bb58dc3f78c3..b362e0170a6256 100644
--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c
+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c
@@ -238,14 +238,19 @@ int uncore_freq_add_entry(struct uncore_data *data, int cpu)
sprintf(data->name, "package_%02d_die_%02d", data->package_id, data->die_id);
}
+ /*
+ * Set the control CPU before any read path so entry recreation after CPU
+ * hotplug can populate read-only attributes from the new online CPU.
+ */
+ data->control_cpu = cpu;
uncore_read(data, &data->initial_min_freq_khz, &data->initial_max_freq_khz);
ret = create_attr_group(data, data->name);
if (ret) {
+ data->control_cpu = -1;
if (data->domain_id != UNCORE_DOMAIN_ID_INVALID)
ida_free(&intel_uncore_ida, data->instance_id);
} else {
- data->control_cpu = cpu;
data->valid = true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 002/484] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 001/484] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 003/484] selftests/bpf: Add tests for ld_{abs,ind} failure path " Greg Kroah-Hartman
` (487 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, STAR Labs SG, Daniel Borkmann,
Alexei Starovoitov, Philo Lu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit ee861486e377edc55361c08dcbceab3f6b6577bd upstream.
Usage of ld_{abs,ind} instructions got extended into subprogs some time
ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These
are only allowed in subprograms when the latter are BTF annotated and
have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +
exit) from legacy cBPF times. While the enforcement is on scalar return
types, the verifier must also simulate the path of abnormal exit if the
packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate
both success and failure paths, and extend it in similar ways as we do
for tail calls. The success path (r0=unknown, continue to next insn) is
pushed onto stack for later validation and the r0=0 and return to the
caller is done on the fall-through side.
Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.")
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ Dropped visit_abnormal_return_insn changes: depends on 7.0 symbols from
e40f5a6bf88a ("bpf: correct stack liveness for tail calls");
Hunk1: adapted IS_ERR/PTR_ERR to !branch/-EFAULT to match push_stack()
NULL-on-failure convention. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1da0092122c1db..5e094c12fc94c5 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15120,6 +15120,23 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
mark_reg_unknown(env, regs, BPF_REG_0);
/* ld_abs load up to 32-bit skb data. */
regs[BPF_REG_0].subreg_def = env->insn_idx + 1;
+ /*
+ * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0
+ * which must be explored by the verifier when in a subprog.
+ */
+ if (env->cur_state->curframe) {
+ struct bpf_verifier_state *branch;
+
+ mark_reg_scratched(env, BPF_REG_0);
+ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+ if (!branch)
+ return -EFAULT;
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+ err = prepare_func_exit(env, &env->insn_idx);
+ if (err)
+ return err;
+ env->insn_idx--;
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 003/484] selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 001/484] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 002/484] bpf: Fix ld_{abs,ind} failure path analysis in subprogs Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 004/484] drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Greg Kroah-Hartman
` (486 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Borkmann, Alexei Starovoitov,
Philo Lu, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit e0fcb42bc6f41bab2895757d6610616b3820eff7 upstream.
Extend the verifier_ld_ind BPF selftests with subprogs containing
ld_{abs,ind} and craft the test in a way where the invalid register
read is rejected in the fixed case. Also add a success case each,
and add additional coverage related to the BTF return type enforcement.
# LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind
[...]
#611/1 verifier_ld_ind/ld_ind: check calling conv, r1:OK
#611/2 verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK
#611/3 verifier_ld_ind/ld_ind: check calling conv, r2:OK
#611/4 verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK
#611/5 verifier_ld_ind/ld_ind: check calling conv, r3:OK
#611/6 verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK
#611/7 verifier_ld_ind/ld_ind: check calling conv, r4:OK
#611/8 verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK
#611/9 verifier_ld_ind/ld_ind: check calling conv, r5:OK
#611/10 verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK
#611/11 verifier_ld_ind/ld_ind: check calling conv, r7:OK
#611/12 verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK
#611/13 verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK
#611/14 verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK
#611/15 verifier_ld_ind/ld_abs: subprog with both paths safe:OK
#611/16 verifier_ld_ind/ld_ind: subprog with both paths safe:OK
#611/17 verifier_ld_ind/ld_abs: reject void return subprog:OK
#611/18 verifier_ld_ind/ld_ind: reject void return subprog:OK
#611 verifier_ld_ind:OK
Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260408191242.526279-4-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++
1 file changed, 142 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
index c925ba9a2e74c2..09e81b99eecb4e 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ld_ind.c
@@ -107,4 +107,146 @@ __naked void ind_check_calling_conv_r7(void)
: __clobber_all);
}
+/*
+ * ld_{abs,ind} subprog that always sets r0=1 on the success path.
+ * bpf_gen_ld_abs() emits a hidden exit with r0=0 when the load helper
+ * fails. The verifier must model this failure return so that callers
+ * account for r0=0 as a possible return value.
+ */
+__naked __noinline __used
+static int ldabs_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ ".8byte %[ld_abs];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+ : __clobber_all);
+}
+
+__naked __noinline __used
+static int ldind_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ "r7 = 0;"
+ ".8byte %[ld_ind];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog early exit on ld_abs failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_abs_subprog_early_exit(void)
+{
+ asm volatile (
+ "call ldabs_subprog;"
+ "if r0 != 0 goto l_exit_%=;"
+ "r0 = r9;"
+ "l_exit_%=:"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog early exit on ld_ind failure")
+__failure __msg("R9 !read_ok")
+__naked void ld_ind_subprog_early_exit(void)
+{
+ asm volatile (
+ "call ldind_subprog;"
+ "if r0 != 0 goto l_exit_%=;"
+ "r0 = r9;"
+ "l_exit_%=:"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: subprog with both paths safe")
+__success
+__naked void ld_abs_subprog_both_paths_safe(void)
+{
+ asm volatile (
+ "call ldabs_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: subprog with both paths safe")
+__success
+__naked void ld_ind_subprog_both_paths_safe(void)
+{
+ asm volatile (
+ "call ldind_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+/*
+ * ld_{abs,ind} in subprogs require scalar (int) return type in BTF.
+ * A test with void return must be rejected.
+ */
+__naked __noinline __used
+static void ldabs_void_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ ".8byte %[ld_abs];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_abs: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_abs_void_subprog_reject(void)
+{
+ asm volatile (
+ "call ldabs_void_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
+__naked __noinline __used
+static void ldind_void_subprog(void)
+{
+ asm volatile (
+ "r6 = r1;"
+ "r7 = 0;"
+ ".8byte %[ld_ind];"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_insn(ld_ind, BPF_LD_IND(BPF_W, BPF_REG_7, 0))
+ : __clobber_all);
+}
+
+SEC("socket")
+__description("ld_ind: reject void return subprog")
+__failure __msg("LD_ABS is only allowed in functions that return 'int'")
+__naked void ld_ind_void_subprog_reject(void)
+{
+ asm volatile (
+ "call ldind_void_subprog;"
+ "r0 = 0;"
+ "exit;"
+ ::: __clobber_all);
+}
+
char _license[] SEC("license") = "GPL";
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 004/484] drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 003/484] selftests/bpf: Add tests for ld_{abs,ind} failure path " Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 005/484] platform/x86/amd/pmc: Dont log during intermediate wakeups Greg Kroah-Hartman
` (485 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Osipenko, Ryosuke Yasuoka,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <ryasuoka@redhat.com>
[ Upstream commit d1b894c5bbb3fee0012bd14356286dc2384e8213 ]
A probe-time deadlock can occur between the dequeue worker and
drm_client_register(). During probe, drm_client_register() holds
clientlist_mutex and calls the fbdev hotplug callback, which triggers an
atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs()
waiting for virtqueue space. The dequeue worker that would free that
space calls virtio_gpu_cmd_get_display_info_cb(), which invokes
drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting
to acquire the same clientlist_mutex. Since wake_up() is only called
after the resp_cb loop, the probe thread is never woken and both threads
deadlock.
Fix this by removing the hotplug notification from
virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info)
is still updated synchronously in the callback.
For the init path, drm_client_register() already fires an initial
hotplug when the client is registered, which picks up the connector
state updated by display_info_cb.
For the runtime config_changed path, add a wait_event_timeout() in
config_changed_work_func() so that display_info_cb updates the connector
data before the hotplug notification is sent. Also replace
drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since
virtio-gpu never calls drm_kms_helper_poll_init() and thus
drm_helper_hpd_irq_event() always returns false without doing anything.
Fixes: 27655b9bb9f0 ("drm/client: Send hotplug event after registering a client")
Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224
Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e
Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 5 ++++-
drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 5a3b5aaed1f361..c88456bc9fcc00 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -48,7 +48,10 @@ static void virtio_gpu_config_changed_work_func(struct work_struct *work)
virtio_gpu_cmd_get_edids(vgdev);
virtio_gpu_cmd_get_display_info(vgdev);
virtio_gpu_notify(vgdev);
- drm_helper_hpd_irq_event(vgdev->ddev);
+ wait_event_timeout(vgdev->resp_wq,
+ !vgdev->display_info_pending,
+ 5 * HZ);
+ drm_kms_helper_hotplug_event(vgdev->ddev);
}
events_clear |= VIRTIO_GPU_EVENT_DISPLAY;
}
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index b1a00c0c25a70b..fbafa44a726453 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -669,9 +669,6 @@ static void virtio_gpu_cmd_get_display_info_cb(struct virtio_gpu_device *vgdev,
vgdev->display_info_pending = false;
spin_unlock(&vgdev->display_info_lock);
wake_up(&vgdev->resp_wq);
-
- if (!drm_helper_hpd_irq_event(vgdev->ddev))
- drm_kms_helper_hotplug_event(vgdev->ddev);
}
static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 005/484] platform/x86/amd/pmc: Dont log during intermediate wakeups
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 004/484] drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 006/484] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values Greg Kroah-Hartman
` (484 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Daniel Gibson,
Ilpo Järvinen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gibson <daniel@gibson.sh>
commit 037f0b03c663a247366673a807834389107995b7 upstream.
The ECs in the IdeaPads that need the delay_suspend quirk send lots
of messages when charging, which not only causes intermediate wakeups
when suspended, but also prevents the device from reaching the deepest
suspend state.
Because of this amd_pmc_intermediate_wakeup_need_delay() returns false
during intermediate wakeups and amd_pmc_want_suspend_delay() is called.
So far it always logged its "Delaying suspend by 2.5s ..." messages
then, which spams dmesg. This commit makes sure that those messages are
only logged once per suspend.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221383
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Daniel Gibson <daniel@gibson.sh>
Link: https://patch.msgid.link/20260611150426.3683372-5-daniel@gibson.sh
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 39 ++++++++++++++++++++++++------
drivers/platform/x86/amd/pmc/pmc.h | 1 +
2 files changed, 32 insertions(+), 8 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index d5b543f74a22db..b0951236887797 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -811,6 +811,20 @@ static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)
static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
{
+ /*
+ * intermediate_wakeup implies that the machine didn't get to deepest sleep
+ * state before - otherwise this function isn't called in amd_pmc_s2idle_check()
+ * because amd_pmc_intermediate_wakeup_need_delay() returns true first.
+ * On some IdeaPads that happens when charging, because the EC seems
+ * to send lots of messages then that wake the machine.
+ *
+ * But even in that case, the sleep here is necessary (on those IdeaPads),
+ * otherwise they wake up completely (resume) after a few seconds.
+ * So this variable is only used to avoid spamming dmesg on each
+ * intermediate wakeup.
+ */
+ bool intermediate_wakeup = !pdev->is_first_check_after_suspend;
+
/*
* Some Lenovo Laptops (like different IdeaPad 3 Slims) need some
* me-time before sleeping or they get uncooperative after waking
@@ -829,17 +843,20 @@ static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
* disabled with disable_workarounds or delay_suspend=0
*/
if (delay_suspend == 1 || (delay_suspend == -1 && !disable_workarounds)) {
- dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
+ if (!intermediate_wakeup)
+ dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
return true;
}
- dev_info(pdev->dev, "Not delaying suspend because of module parameter, even though your device is assumed to need it!\n");
+ if (!intermediate_wakeup)
+ dev_info(pdev->dev, "Not delaying suspend because of module parameter, even though your device is assumed to need it!\n");
} else if (delay_suspend == 1) {
- dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
- dmi_get_system_info(DMI_SYS_VENDOR),
- dmi_get_system_info(DMI_PRODUCT_NAME),
- dmi_get_system_info(DMI_PRODUCT_FAMILY),
- dmi_get_system_info(DMI_BOARD_VENDOR),
- dmi_get_system_info(DMI_BOARD_NAME));
+ if (!intermediate_wakeup)
+ dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
+ dmi_get_system_info(DMI_SYS_VENDOR),
+ dmi_get_system_info(DMI_PRODUCT_NAME),
+ dmi_get_system_info(DMI_PRODUCT_FAMILY),
+ dmi_get_system_info(DMI_BOARD_VENDOR),
+ dmi_get_system_info(DMI_BOARD_NAME));
return true;
}
return false;
@@ -852,6 +869,9 @@ static void amd_pmc_s2idle_prepare(void)
u8 msg;
u32 arg = 1;
+ /* Reset this variable because this is a fresh suspend */
+ pdev->is_first_check_after_suspend = true;
+
/* Reset and Start SMU logging - to monitor the s0i3 stats */
amd_pmc_setup_smu_logging(pdev);
@@ -891,6 +911,9 @@ static void amd_pmc_s2idle_check(void)
rc = amd_pmc_write_stb(pdev, AMD_PMC_STB_S2IDLE_CHECK);
if (rc)
dev_err(pdev->dev, "error writing to STB: %d\n", rc);
+
+ /* remember that first check after suspend is done (until next prepare) */
+ pdev->is_first_check_after_suspend = false;
}
static int amd_pmc_dump_data(struct amd_pmc_dev *pdev)
diff --git a/drivers/platform/x86/amd/pmc/pmc.h b/drivers/platform/x86/amd/pmc/pmc.h
index 5e7b8d5dc5d624..bea65810de5ab6 100644
--- a/drivers/platform/x86/amd/pmc/pmc.h
+++ b/drivers/platform/x86/amd/pmc/pmc.h
@@ -37,6 +37,7 @@ struct amd_pmc_dev {
struct dentry *dbgfs_dir;
struct quirk_entry *quirks;
bool disable_8042_wakeup;
+ bool is_first_check_after_suspend;
};
void amd_pmc_process_restore_quirks(struct amd_pmc_dev *dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 006/484] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 005/484] platform/x86/amd/pmc: Dont log during intermediate wakeups Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 007/484] seqlock: Cure some more scoped_seqlock() optimization fails Greg Kroah-Hartman
` (483 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Ilpo Järvinen, Daniel Gibson, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gibson <daniel@gibson.sh>
commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream.
dmi_get_system_info(...) can return NULL. Using that as %s arguments
of dev_info() would log "(null)" (as part of a message like
'... System Vendor: "(null)", Product Name: "(null)" ...'), which may
be confusing for users.
Use Elvis operator to print "(Unknown)" instead.
Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Daniel Gibson <daniel@gibson.sh>
Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/amd/pmc/pmc.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index b0951236887797..bf6c7ca247e243 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -852,11 +852,11 @@ static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
} else if (delay_suspend == 1) {
if (!intermediate_wakeup)
dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
- dmi_get_system_info(DMI_SYS_VENDOR),
- dmi_get_system_info(DMI_PRODUCT_NAME),
- dmi_get_system_info(DMI_PRODUCT_FAMILY),
- dmi_get_system_info(DMI_BOARD_VENDOR),
- dmi_get_system_info(DMI_BOARD_NAME));
+ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)",
+ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)",
+ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)",
+ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)",
+ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)");
return true;
}
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 007/484] seqlock: Cure some more scoped_seqlock() optimization fails
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 006/484] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 008/484] seqlock: Allow KASAN to fail optimizing Greg Kroah-Hartman
` (482 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann,
Peter Zijlstra (Intel), Ingo Molnar, Oleg Nesterov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 90dfeef1cd38dff19f8b3a752d13bfd79f0f7694 upstream.
Arnd reported an x86 randconfig using gcc-15 tripped over
__scoped_seqlock_bug(). Turns out GCC chose not to inline the
scoped_seqlock helper functions and as such was not able to optimize
properly.
[ mingo: Clang fails the build too in some circumstances. ]
Reported-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Link: https://patch.msgid.link/20251204104332.GG2528459@noisy.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/seqlock.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -1281,7 +1281,7 @@ struct ss_tmp {
spinlock_t *lock_irqsave;
};
-static inline void __scoped_seqlock_cleanup(struct ss_tmp *sst)
+static __always_inline void __scoped_seqlock_cleanup(struct ss_tmp *sst)
{
if (sst->lock)
spin_unlock(sst->lock);
@@ -1306,7 +1306,7 @@ static inline void __scoped_seqlock_bug(
extern void __scoped_seqlock_bug(void);
#endif
-static inline void
+static __always_inline void
__scoped_seqlock_next(struct ss_tmp *sst, seqlock_t *lock, enum ss_state target)
{
switch (sst->state) {
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 008/484] seqlock: Allow KASAN to fail optimizing
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 007/484] seqlock: Cure some more scoped_seqlock() optimization fails Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 009/484] seqlock: Allow UBSAN_ALIGNMENT " Greg Kroah-Hartman
` (481 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Peter Zijlstra (Intel)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit b94d45b6bbb42571ec225d3be0e7457c8765a5b4 upstream.
Some KASAN builds are failing to properly optimize this code --
luckily we don't care about core quality for KASAN builds, so just
exclude it.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Closes: https://lore.kernel.org/oe-kbuild-all/202510251641.idrNXhv5-lkp@intel.com/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/seqlock.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -1291,11 +1291,14 @@ static __always_inline void __scoped_seq
extern void __scoped_seqlock_invalid_target(void);
-#if defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000
+#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN)
/*
* For some reason some GCC-8 architectures (nios2, alpha) have trouble
* determining that the ss_done state is impossible in __scoped_seqlock_next()
* below.
+ *
+ * Similarly KASAN is known to confuse compilers enough to break this. But we
+ * don't care about code quality for KASAN builds anyway.
*/
static inline void __scoped_seqlock_bug(void) { }
#else
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 009/484] seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 008/484] seqlock: Allow KASAN to fail optimizing Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 010/484] KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Greg Kroah-Hartman
` (480 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Heiko Carstens,
Peter Zijlstra (Intel)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit 88331c4ec23a28c1006ec532fa64763d4c695e90 upstream.
With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to
inline and optimize __scoped_seqlock_bug() away on s390:
s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next':
/.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug'
Fix this by adding UBSAN_ALIGNMENT to the list of config options where a
not inlined empty __scoped_seqlock_bug() is allowed.
Closes: https://lore.kernel.org/r/20260515092057.810542-1-arnd@kernel.org/
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260519110315.1385307-1-hca@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/seqlock.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -1291,14 +1291,15 @@ static __always_inline void __scoped_seq
extern void __scoped_seqlock_invalid_target(void);
-#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN)
+#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || \
+ defined(CONFIG_KASAN) || defined(CONFIG_UBSAN_ALIGNMENT)
/*
* For some reason some GCC-8 architectures (nios2, alpha) have trouble
* determining that the ss_done state is impossible in __scoped_seqlock_next()
* below.
*
- * Similarly KASAN is known to confuse compilers enough to break this. But we
- * don't care about code quality for KASAN builds anyway.
+ * Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough
+ * to break this. But we don't care about code quality for such builds anyway.
*/
static inline void __scoped_seqlock_bug(void) { }
#else
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 010/484] KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 009/484] seqlock: Allow UBSAN_ALIGNMENT " Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 011/484] KVM: nVMX: Hide shadow VMCS right after VMCLEAR Greg Kroah-Hartman
` (479 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Sean Christopherson,
Paolo Bonzini
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 2abd5287f08319fa35764566b15c6e22cb1068db upstream.
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU. If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root. On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Fixes: f95eec9bed76 ("KVM: x86/mmu: Don't put invalid SPs back on the list of active pages")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 9 +++++----
arch/x86/kvm/mmu/paging_tmpl.h | 10 ++++++----
2 files changed, 11 insertions(+), 8 deletions(-)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4384,16 +4384,17 @@ static int direct_page_fault(struct kvm_
orig_pfn = fault->pfn;
- r = RET_PF_RETRY;
write_lock(&vcpu->kvm->mmu_lock);
- if (is_page_fault_stale(vcpu, fault))
- goto out_unlock;
-
r = make_mmu_pages_available(vcpu);
if (r)
goto out_unlock;
+ if (is_page_fault_stale(vcpu, fault)) {
+ r = RET_PF_RETRY;
+ goto out_unlock;
+ }
+
r = direct_map(vcpu, fault);
out_unlock:
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -838,15 +838,17 @@ static int FNAME(page_fault)(struct kvm_
orig_pfn = fault->pfn;
- r = RET_PF_RETRY;
write_lock(&vcpu->kvm->mmu_lock);
- if (is_page_fault_stale(vcpu, fault))
- goto out_unlock;
-
r = make_mmu_pages_available(vcpu);
if (r)
goto out_unlock;
+
+ if (is_page_fault_stale(vcpu, fault)) {
+ r = RET_PF_RETRY;
+ goto out_unlock;
+ }
+
r = FNAME(fetch)(vcpu, fault, &walker);
out_unlock:
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 011/484] KVM: nVMX: Hide shadow VMCS right after VMCLEAR
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 010/484] KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 012/484] KVM: x86/mmu: Fix use-after-free on vendor module reload Greg Kroah-Hartman
` (478 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Paolo Bonzini
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 upstream.
free_nested() frees the shadow VMCS while vmcs01 still points to it. But
because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU
might migrate before the pointer is cleared and __loaded_vmcs_clear()
may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but
then it can be hidden and the page safely freed.
Fixes: 355f4fb1405e ("kvm: nVMX: VMCLEAR an active shadow VMCS after last use")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/nested.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -295,6 +295,7 @@ static void vmx_switch_vmcs(struct kvm_v
static void free_nested(struct kvm_vcpu *vcpu)
{
struct vcpu_vmx *vmx = to_vmx(vcpu);
+ struct vmcs *shadow_vmcs;
if (WARN_ON_ONCE(vmx->loaded_vmcs != &vmx->vmcs01))
vmx_switch_vmcs(vcpu, &vmx->vmcs01);
@@ -312,9 +313,15 @@ static void free_nested(struct kvm_vcpu
vmx->nested.current_vmptr = INVALID_GPA;
if (enable_shadow_vmcs) {
vmx_disable_shadow_vmcs(vmx);
- vmcs_clear(vmx->vmcs01.shadow_vmcs);
- free_vmcs(vmx->vmcs01.shadow_vmcs);
+
+ /*
+ * Keep the pointer visible until after VMCLEAR, so migration
+ * can clear an active shadow VMCS on the old CPU.
+ */
+ shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+ vmcs_clear(shadow_vmcs);
vmx->vmcs01.shadow_vmcs = NULL;
+ free_vmcs(shadow_vmcs);
}
kfree(vmx->nested.cached_vmcs12);
vmx->nested.cached_vmcs12 = NULL;
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 012/484] KVM: x86/mmu: Fix use-after-free on vendor module reload
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 011/484] KVM: nVMX: Hide shadow VMCS right after VMCLEAR Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 013/484] can: bcm: add locking when updating filter and timer values Greg Kroah-Hartman
` (477 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Phil Rosenthal, Paolo Bonzini
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Rosenthal <phil@phil.gs>
commit 52f2f7c30126037975389aa04d24c506a5177c35 upstream.
mmu_destroy_caches() destroys pte_list_desc_cache and
mmu_page_header_cache, but leaves both pointers unchanged. The pointers
live in kvm.ko, and therefore survive when a vendor module is unloaded
while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor
module load, its assignment sets pte_list_desc_cache to NULL and the
error path calls mmu_destroy_caches(). mmu_page_header_cache still
points to the cache destroyed during the preceding vendor module
unload. Passing that stale pointer to kmem_cache_destroy() causes a
slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,
CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A
one-shot test hook forces pte_list_desc_cache to NULL on the second
invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
kmem_cache_destroy+0x21/0x1d0
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
Allocated by task 16817:
__kmem_cache_create_args+0x12c/0x3b0
__kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
...
Freed by task 16820:
kmem_cache_destroy+0x117/0x1d0
kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that
the stored state reflects the caches' lifetime and repeated cleanup is
safe.
With the fix applied, the same injected vendor module reload fails with
-ENOMEM as expected and produces no KASAN report.
Fixes: cb498ea2ce1d ("KVM: Portability: Combine kvm_init and kvm_init_x86")
Cc: stable@vger.kernel.org
Signed-off-by: Phil Rosenthal <phil@phil.gs>
Message-ID: <20260718-kvm-mmu-cache-uaf-v3-1-e103b93c74e1@phil.gs>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -6804,7 +6804,9 @@ static struct shrinker mmu_shrinker = {
static void mmu_destroy_caches(void)
{
kmem_cache_destroy(pte_list_desc_cache);
+ pte_list_desc_cache = NULL;
kmem_cache_destroy(mmu_page_header_cache);
+ mmu_page_header_cache = NULL;
}
static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp)
^ permalink raw reply [flat|nested] 492+ messages in thread
* [PATCH 6.6 013/484] can: bcm: add locking when updating filter and timer values
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 012/484] KVM: x86/mmu: Fix use-after-free on vendor module reload Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 014/484] can: bcm: fix CAN frame rx/tx statistics Greg Kroah-Hartman
` (476 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+75e5e4ae00c3b4bb544e,
Oliver Hartkopp, stable, Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 749179c2e25b95d22499ed29096b3e02d6dfd2b4 upstream.
KCSAN detected a simultaneous access to timer values that can be
overwritten in bcm_rx_setup() when updating timer and filter content
while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()
run concurrently on incoming CAN traffic.
Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter
(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new
per-op bcm_rx_update_lock, taken with the matching scope in the RX
handlers. memcpy_from_msg() is staged into a temporary buffer before the
lock is taken, since it can sleep and must not run under a spinlock.
hrtimer_cancel() is always called without bcm_rx_update_lock held, since
bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a
running callback would otherwise deadlock against the canceller.
Also close a related race: bcm_rx_setup() cleared the RTR flag in the
stored reply frame's can_id as a separate, unprotected step after the
frame content was already installed, so a concurrent bcm_rx_handler()
could transmit a stale reply with CAN_RTR_FLAG still set. Fold that
normalization into the initial frame preparation instead (on the staged
buffer for updates, directly on op->frames pre-registration for new
ops), so the installed frame is always atomically self-consistent.
bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected
snapshot of op->flags before deciding whether to call bcm_can_tx(),
but does not hold the lock across that call.
Also take a lock-protected snapshot of the currframe in bcm_can_tx()
to avoid partly overwrites by content updates in bcm_tx_setup().
Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset
op->currframe between the two locked sections in bcm_can_tx().
Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().
kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it
cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
Fixes: c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
Reported-by: syzbot+75e5e4ae00c3b4bb544e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-can/6975d5cf.a00a0220.33ccc7.0022.GAE@google.com/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-3-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 176 ++++++++++++++++++++++++++++++++++++++------------
1 file changed, 133 insertions(+), 43 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 04653df3a173e2..a80a935d6b5009 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -126,6 +126,7 @@ struct bcm_op {
struct sock *sk;
struct net_device *rx_reg_dev;
spinlock_t bcm_tx_lock; /* protect currframe/count in runtime updates */
+ spinlock_t bcm_rx_update_lock; /* protect filter/timer data updates */
};
struct bcm_sock {
@@ -280,21 +281,27 @@ static int bcm_proc_show(struct seq_file *m, void *v)
* bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
* of the given bcm tx op
*/
-static void bcm_can_tx(struct bcm_op *op)
+static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)
{
struct sk_buff *skb;
struct net_device *dev;
- struct canfd_frame *cf;
+ struct canfd_frame cframe;
+ bool cyclic = !cf;
+ unsigned int idx = 0;
int err;
/* no target device? => exit */
if (!op->ifindex)
return;
- /* read currframe under lock protection */
- spin_lock_bh(&op->bcm_tx_lock);
- cf = op->frames + op->cfsiz * op->currframe;
- spin_unlock_bh(&op->bcm_tx_lock);
+ if (cyclic) {
+ /* read currframe under lock protection */
+ spin_lock_bh(&op->bcm_tx_lock);
+ idx = op->currframe;
+ memcpy(&cframe, op->frames + op->cfsiz * idx, op->cfsiz);
+ cf = &cframe;
+ spin_unlock_bh(&op->bcm_tx_lock);
+ }
dev = dev_get_by_index(sock_net(op->sk), op->ifindex);
if (!dev) {
@@ -323,14 +330,20 @@ static void bcm_can_tx(struct bcm_op *op)
if (!err)
op->frames_abs++;
- op->currframe++;
+ /* only advance the cyclic sequence if nothing reset currframe while
+ * we were sending - a concurrent TX_RESET_MULTI_IDX means this
+ * frame's bookkeeping belongs to a sequence that no longer exists
+ */
+ if (!cyclic || op->currframe == idx) {
+ op->currframe++;
- /* reached last frame? */
- if (op->currframe >= op->nframes)
- op->currframe = 0;
+ /* reached last frame? */
+ if (op->currframe >= op->nframes)
+ op->currframe = 0;
- if (op->count > 0)
- op->count--;
+ if (op->count > 0)
+ op->count--;
+ }
spin_unlock_bh(&op->bcm_tx_lock);
out:
@@ -429,7 +442,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
struct bcm_msg_head msg_head;
if (op->kt_ival1 && (op->count > 0)) {
- bcm_can_tx(op);
+ bcm_can_tx(op, NULL);
if (!op->count && (op->flags & TX_COUNTEVT)) {
/* create notification to user */
@@ -446,7 +459,7 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
}
} else if (op->kt_ival2) {
- bcm_can_tx(op);
+ bcm_can_tx(op, NULL);
}
return bcm_tx_set_expiry(op, &op->timer) ?
@@ -585,6 +598,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
struct bcm_msg_head msg_head;
+ spin_lock_bh(&op->bcm_rx_update_lock);
+
/* if user wants to be informed, when cyclic CAN-Messages come back */
if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
/* clear received CAN frames to indicate 'nothing received' */
@@ -601,6 +616,8 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
msg_head.can_id = op->can_id;
msg_head.nframes = 0;
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+
bcm_send_to_user(op, &msg_head, NULL, 0);
return HRTIMER_NORESTART;
@@ -649,15 +666,26 @@ static int bcm_rx_thr_flush(struct bcm_op *op)
static enum hrtimer_restart bcm_rx_thr_handler(struct hrtimer *hrtimer)
{
struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer);
+ enum hrtimer_restart ret;
- if (bcm_rx_thr_flush(op)) {
+ spin_lock_bh(&op->bcm_rx_update_lock);
+
+ /* kt_ival2 may have been concurrently cleared by bcm_rx_setup()
+ * before it cancels this timer - never forward with a zero
+ * interval in that case.
+ */
+ if (bcm_rx_thr_flush(op) && op->kt_ival2) {
hrtimer_forward_now(hrtimer, op->kt_ival2);
- return HRTIMER_RESTART;
+ ret = HRTIMER_RESTART;
} else {
/* rearm throttle handling */
op->kt_lastmsg = 0;
- return HRTIMER_NORESTART;
+ ret = HRTIMER_NORESTART;
}
+
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+
+ return ret;
}
/*
@@ -667,7 +695,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
{
struct bcm_op *op = (struct bcm_op *)data;
const struct canfd_frame *rxframe = (struct canfd_frame *)skb->data;
+ struct canfd_frame rtrframe;
unsigned int i;
+ bool rtr_frame;
if (op->can_id != rxframe->can_id)
return;
@@ -691,12 +721,23 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
/* update statistics */
op->frames_abs++;
- if (op->flags & RX_RTR_FRAME) {
+ /* snapshot the flag under lock: op->flags/op->frames may be updated
+ * concurrently by bcm_rx_setup().
+ */
+ spin_lock_bh(&op->bcm_rx_update_lock);
+ rtr_frame = op->flags & RX_RTR_FRAME;
+ if (rtr_frame)
+ memcpy(&rtrframe, op->frames, op->cfsiz);
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+
+ if (rtr_frame) {
/* send reply for RTR-request (placed in op->frames[0]) */
- bcm_can_tx(op);
+ bcm_can_tx(op, &rtrframe);
return;
}
+ spin_lock_bh(&op->bcm_rx_update_lock);
+
if (op->flags & RX_FILTER_ID) {
/* the easiest case */
bcm_rx_update_and_send(op, op->last_frames, rxframe);
@@ -730,6 +771,8 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
rx_starttimer:
bcm_rx_starttimer(op);
+
+ spin_unlock_bh(&op->bcm_rx_update_lock);
}
/*
@@ -1073,7 +1116,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
list_add_rcu(&op->list, &bo->tx_ops);
if (op->flags & TX_ANNOUNCE)
- bcm_can_tx(op);
+ bcm_can_tx(op, NULL);
if (op->flags & STARTTIMER)
bcm_tx_start_timer(op);
@@ -1087,6 +1130,24 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
return err;
}
+static void bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
+ struct bcm_op *op, void *new_frames)
+{
+ /* funny feature in RX(!)_SETUP only for RTR-mode:
+ * copy can_id into frame BUT without RTR-flag to
+ * prevent a full-load-loopback-test ... ;-]
+ * normalize this on the staged buffer, before it is
+ * ever installed into op->frames.
+ */
+ if (msg_head->flags & RX_RTR_FRAME) {
+ struct canfd_frame *frame0 = new_frames;
+
+ if ((msg_head->flags & TX_CP_CAN_ID) ||
+ frame0->can_id == op->can_id)
+ frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
+ }
+}
+
/*
* bcm_rx_setup - create or update a bcm rx op (for bcm_sendmsg)
*/
@@ -1121,6 +1182,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* check the given can_id */
op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
if (op) {
+ void *new_frames = NULL;
+
/* update existing BCM operation */
/*
@@ -1132,19 +1195,48 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
return -E2BIG;
if (msg_head->nframes) {
- /* update CAN frames content */
- err = memcpy_from_msg(op->frames, msg,
+ /* get new CAN frames content before locking */
+ new_frames = kmalloc(msg_head->nframes * op->cfsiz,
+ GFP_KERNEL);
+ if (!new_frames)
+ return -ENOMEM;
+
+ err = memcpy_from_msg(new_frames, msg,
msg_head->nframes * op->cfsiz);
- if (err < 0)
+ if (err < 0) {
+ kfree(new_frames);
return err;
+ }
- /* clear last_frames to indicate 'nothing received' */
- memset(op->last_frames, 0, msg_head->nframes * op->cfsiz);
+ bcm_rx_setup_rtr_check(msg_head, op, new_frames);
}
+ spin_lock_bh(&op->bcm_rx_update_lock);
op->nframes = msg_head->nframes;
op->flags = msg_head->flags;
+ if (msg_head->nframes) {
+ /* update CAN frames content */
+ memcpy(op->frames, new_frames,
+ msg_head->nframes * op->cfsiz);
+
+ /* clear last_frames to indicate 'nothing received' */
+ memset(op->last_frames, 0,
+ msg_head->nframes * op->cfsiz);
+ }
+
+ if (msg_head->flags & SETTIMER) {
+ op->ival1 = msg_head->ival1;
+ op->ival2 = msg_head->ival2;
+ op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
+ op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+ op->kt_lastmsg = 0;
+ }
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+
+ /* free temporary frames / kfree(NULL) is safe */
+ kfree(new_frames);
+
/* Only an update -> do not call can_rx_register() */
do_rx_register = 0;
@@ -1155,6 +1247,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
return -ENOMEM;
spin_lock_init(&op->bcm_tx_lock);
+ spin_lock_init(&op->bcm_rx_update_lock);
op->can_id = msg_head->can_id;
op->nframes = msg_head->nframes;
op->cfsiz = CFSIZ(msg_head->flags);
@@ -1196,6 +1289,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
kfree(op);
return err;
}
+
+ bcm_rx_setup_rtr_check(msg_head, op, op->frames);
}
/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1223,29 +1318,22 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* check flags */
if (op->flags & RX_RTR_FRAME) {
- struct canfd_frame *frame0 = op->frames;
-
/* no timers in RTR-mode */
hrtimer_cancel(&op->thrtimer);
hrtimer_cancel(&op->timer);
-
- /*
- * funny feature in RX(!)_SETUP only for RTR-mode:
- * copy can_id into frame BUT without RTR-flag to
- * prevent a full-load-loopback-test ... ;-]
- */
- if ((op->flags & TX_CP_CAN_ID) ||
- (frame0->can_id == op->can_id))
- frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
-
} else {
if (op->flags & SETTIMER) {
- /* set timer value */
- op->ival1 = msg_head->ival1;
- op->ival2 = msg_head->ival2;
- op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
- op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+ /* set timers (locked) for newly created op */
+ if (do_rx_register) {
+ spin_lock_bh(&op->bcm_rx_update_lock);
+ op->ival1 = msg_head->ival1;
+ op->ival2 = msg_head->ival2;
+ op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
+ op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+ op->kt_lastmsg = 0;
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+ }
/* disable an active timer due to zero value? */
if (!op->kt_ival1)
@@ -1255,9 +1343,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
* In any case cancel the throttle timer, flush
* potentially blocked msgs and reset throttle handling
*/
- op->kt_lastmsg = 0;
hrtimer_cancel(&op->thrtimer);
+
+ spin_lock_bh(&op->bcm_rx_update_lock);
bcm_rx_thr_flush(op);
+ spin_unlock_bh(&op->bcm_rx_update_lock);
}
if ((op->flags & STARTTIMER) && op->kt_ival1)
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 014/484] can: bcm: fix CAN frame rx/tx statistics
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 013/484] can: bcm: add locking when updating filter and timer values Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 015/484] can: bcm: extend bcm_tx_lock usage for data and timer updates Greg Kroah-Hartman
` (475 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 upstream.
KCSAN detected a data race within the bcm_rx_handler() when two CAN frames
have been simultaneously received and processed in a single rx op by two
different CPUs.
Use atomic operations with (signed) long data types to access the
statistics in the hot path to fix the KCSAN complaint.
Additionally simplify the update and check of statistics overflow by
using the atomic operations in separate bcm_update_[rx|tx]_stats()
functions. The rx variant runs under bcm_rx_update_lock to prevent
races when resetting the two rx counters; the tx variant runs under
bcm_tx_lock and only needs to guard its own counter's overflow.
As the rx path resets its values already at LONG_MAX / 100, there is
no conflict between the two locking domains (bcm_rx_update_lock vs.
bcm_tx_lock) even for ops that use both paths.
The rx statistics update and the frames_filtered update in
bcm_rx_changed() were previously performed in two separate
bcm_rx_update_lock sections. For an rx op subscribed on all interfaces
(ifindex == 0), bcm_rx_handler() can run concurrently on different
CPUs, so a counter reset by one CPU between these two sections could
leave frames_filtered larger than frames_abs on another CPU, producing
a bogus (even negative) reduction percentage in procfs. Update the
statistics in the same critical section as bcm_rx_changed() to close
this gap, which also removes the now unneeded extra lock/unlock pair
around the traffic_flags calculation.
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-4-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 67 ++++++++++++++++++++++++++++++++++-----------------
1 file changed, 45 insertions(+), 22 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index a80a935d6b5009..980d61d853ee96 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -109,7 +109,7 @@ struct bcm_op {
int ifindex;
canid_t can_id;
u32 flags;
- unsigned long frames_abs, frames_filtered;
+ atomic_long_t frames_abs, frames_filtered;
struct bcm_timeval ival1, ival2;
struct hrtimer timer, thrtimer;
ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
@@ -216,10 +216,13 @@ static int bcm_proc_show(struct seq_file *m, void *v)
list_for_each_entry_rcu(op, &bo->rx_ops, list) {
- unsigned long reduction;
+ long reduction, frames_filtered, frames_abs;
+
+ frames_filtered = atomic_long_read(&op->frames_filtered);
+ frames_abs = atomic_long_read(&op->frames_abs);
/* print only active entries & prevent division by zero */
- if (!op->frames_abs)
+ if (!frames_abs)
continue;
seq_printf(m, "rx_op: %03X %-5s ", op->can_id,
@@ -241,9 +244,9 @@ static int bcm_proc_show(struct seq_file *m, void *v)
(long long)ktime_to_us(op->kt_ival2));
seq_printf(m, "# recv %ld (%ld) => reduction: ",
- op->frames_filtered, op->frames_abs);
+ frames_filtered, frames_abs);
- reduction = 100 - (op->frames_filtered * 100) / op->frames_abs;
+ reduction = 100 - (frames_filtered * 100) / frames_abs;
seq_printf(m, "%s%ld%%\n",
(reduction == 100) ? "near " : "", reduction);
@@ -267,7 +270,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)
seq_printf(m, "t2=%lld ",
(long long)ktime_to_us(op->kt_ival2));
- seq_printf(m, "# sent %ld\n", op->frames_abs);
+ seq_printf(m, "# sent %ld\n",
+ atomic_long_read(&op->frames_abs));
}
seq_putc(m, '\n');
@@ -277,6 +281,24 @@ static int bcm_proc_show(struct seq_file *m, void *v)
}
#endif /* CONFIG_PROC_FS */
+static void bcm_update_rx_stats(struct bcm_op *op)
+{
+ /* prevent overflow of the reduction% calculation in bcm_proc_show() */
+ if (atomic_long_inc_return(&op->frames_abs) > LONG_MAX / 100) {
+ atomic_long_set(&op->frames_filtered, 0);
+ atomic_long_set(&op->frames_abs, 0);
+ }
+}
+
+static void bcm_update_tx_stats(struct bcm_op *op)
+{
+ /* tx_op has no reduction% calculation - use the full range and
+ * just keep the displayed counter non-negative on overflow
+ */
+ if (atomic_long_inc_return(&op->frames_abs) == LONG_MAX)
+ atomic_long_set(&op->frames_abs, 0);
+}
+
/*
* bcm_can_tx - send the (next) CAN frame to the appropriate CAN interface
* of the given bcm tx op
@@ -328,7 +350,7 @@ static void bcm_can_tx(struct bcm_op *op, struct canfd_frame *cf)
spin_lock_bh(&op->bcm_tx_lock);
if (!err)
- op->frames_abs++;
+ bcm_update_tx_stats(op);
/* only advance the cyclic sequence if nothing reset currframe while
* we were sending - a concurrent TX_RESET_MULTI_IDX means this
@@ -473,12 +495,9 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data)
{
struct bcm_msg_head head;
- /* update statistics */
- op->frames_filtered++;
-
- /* prevent statistics overflow */
- if (op->frames_filtered > ULONG_MAX/100)
- op->frames_filtered = op->frames_abs = 0;
+ /* update statistics (frames_filtered <= frames_abs) */
+ if (atomic_long_read(&op->frames_abs))
+ atomic_long_inc(&op->frames_filtered);
/* this element is not throttled anymore */
data->flags &= (BCM_CAN_FLAGS_MASK|RX_RECV);
@@ -718,25 +737,29 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
op->rx_stamp = skb->tstamp;
/* save originator for recvfrom() */
op->rx_ifindex = skb->dev->ifindex;
- /* update statistics */
- op->frames_abs++;
- /* snapshot the flag under lock: op->flags/op->frames may be updated
- * concurrently by bcm_rx_setup().
- */
+ /* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */
spin_lock_bh(&op->bcm_rx_update_lock);
+
rtr_frame = op->flags & RX_RTR_FRAME;
- if (rtr_frame)
+ if (rtr_frame) {
+ bcm_update_rx_stats(op);
+ /* snapshot RTR content under lock */
memcpy(&rtrframe, op->frames, op->cfsiz);
- spin_unlock_bh(&op->bcm_rx_update_lock);
+ spin_unlock_bh(&op->bcm_rx_update_lock);
- if (rtr_frame) {
/* send reply for RTR-request (placed in op->frames[0]) */
bcm_can_tx(op, &rtrframe);
return;
}
- spin_lock_bh(&op->bcm_rx_update_lock);
+ /* update statistics in the same critical section as bcm_rx_changed()
+ * below: frames_filtered must never be checked/incremented against a
+ * frames_abs snapshot from a concurrent bcm_rx_handler() call on
+ * another CPU for the same (wildcard) op, or frames_filtered can end
+ * up larger than frames_abs.
+ */
+ bcm_update_rx_stats(op);
if (op->flags & RX_FILTER_ID) {
/* the easiest case */
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 015/484] can: bcm: extend bcm_tx_lock usage for data and timer updates
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 014/484] can: bcm: fix CAN frame rx/tx statistics Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 016/484] can: bcm: validate frame length in bcm_rx_setup() for RTR replies Greg Kroah-Hartman
` (474 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc upstream.
Stage new CAN frame content for an existing tx op into a kmalloc()'d
buffer and validate it there, mirroring the approach already used in
bcm_rx_setup(). Only copy the validated data into op->frames while
holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()
can no longer observe a partially updated or unvalidated frame.
Add a missing error path for memcpy_from_msg() when copying CAN frame
data from userspace.
Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()
under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same
lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the
torn 64-bit ktime_t read on 32-bit platforms.
Fixes: c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-6-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 104 ++++++++++++++++++++++++++++++++++++--------------
1 file changed, 75 insertions(+), 29 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 980d61d853ee96..ab94caa2d006b0 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_op {
struct canfd_frame last_sframe;
struct sock *sk;
struct net_device *rx_reg_dev;
- spinlock_t bcm_tx_lock; /* protect currframe/count in runtime updates */
+ spinlock_t bcm_tx_lock; /* protect tx data and timer updates */
spinlock_t bcm_rx_update_lock; /* protect filter/timer data updates */
};
@@ -440,12 +440,18 @@ static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt)
{
ktime_t ival;
+ spin_lock_bh(&op->bcm_tx_lock);
+
if (op->kt_ival1 && op->count)
ival = op->kt_ival1;
- else if (op->kt_ival2)
+ else if (op->kt_ival2) {
ival = op->kt_ival2;
- else
+ } else {
+ spin_unlock_bh(&op->bcm_tx_lock);
return false;
+ }
+
+ spin_unlock_bh(&op->bcm_tx_lock);
hrtimer_set_expires(hrt, ktime_add(ktime_get(), ival));
return true;
@@ -462,25 +468,47 @@ static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
{
struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
struct bcm_msg_head msg_head;
+ bool tx_ival1, tx_ival2;
+
+ /* snapshot kt_ival1/kt_ival2/count under lock to avoid torn
+ * ktime_t reads racing with concurrent bcm_tx_setup() updates
+ */
+ spin_lock_bh(&op->bcm_tx_lock);
+ tx_ival1 = op->kt_ival1 && (op->count > 0);
+ tx_ival2 = !!op->kt_ival2;
+ spin_unlock_bh(&op->bcm_tx_lock);
+
+ if (tx_ival1) {
+ u32 flags, count;
+ struct bcm_timeval ival1, ival2;
- if (op->kt_ival1 && (op->count > 0)) {
bcm_can_tx(op, NULL);
- if (!op->count && (op->flags & TX_COUNTEVT)) {
+ /* snapshot variables under lock to avoid torn reads racing
+ * with concurrent bcm_tx_setup() updates
+ */
+ spin_lock_bh(&op->bcm_tx_lock);
+ flags = op->flags;
+ count = op->count;
+ ival1 = op->ival1;
+ ival2 = op->ival2;
+ spin_unlock_bh(&op->bcm_tx_lock);
+
+ if (!count && (flags & TX_COUNTEVT)) {
/* create notification to user */
memset(&msg_head, 0, sizeof(msg_head));
msg_head.opcode = TX_EXPIRED;
- msg_head.flags = op->flags;
- msg_head.count = op->count;
- msg_head.ival1 = op->ival1;
- msg_head.ival2 = op->ival2;
+ msg_head.flags = flags;
+ msg_head.count = count;
+ msg_head.ival1 = ival1;
+ msg_head.ival2 = ival2;
msg_head.can_id = op->can_id;
msg_head.nframes = 0;
bcm_send_to_user(op, &msg_head, NULL, 0);
}
- } else if (op->kt_ival2) {
+ } else if (tx_ival2) {
bcm_can_tx(op, NULL);
}
@@ -988,6 +1016,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* check the given can_id */
op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
if (op) {
+ void *new_frames;
+
/* update existing BCM operation */
/*
@@ -998,11 +1028,23 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes > op->nframes)
return -E2BIG;
- /* update CAN frames content */
+ /* get new CAN frames content into a staging buffer before
+ * locking: validate and normalize the frames there so that
+ * bcm_can_tx() / bcm_tx_timeout_handler() never observe a
+ * partially updated or unvalidated frame in op->frames
+ */
+ new_frames = kmalloc(msg_head->nframes * op->cfsiz, GFP_KERNEL);
+ if (!new_frames)
+ return -ENOMEM;
+
for (i = 0; i < msg_head->nframes; i++) {
- cf = op->frames + op->cfsiz * i;
+ cf = new_frames + op->cfsiz * i;
err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
+ if (err < 0) {
+ kfree(new_frames);
+ return err;
+ }
if (op->flags & CAN_FD_FRAME) {
if (cf->len > 64)
@@ -1012,36 +1054,38 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
err = -EINVAL;
}
- if (err < 0)
+ if (err < 0) {
+ kfree(new_frames);
return err;
+ }
if (msg_head->flags & TX_CP_CAN_ID) {
/* copy can_id into frame */
cf->can_id = msg_head->can_id;
}
}
+
+ spin_lock_bh(&op->bcm_tx_lock);
+
+ /* update CAN frames content */
+ memcpy(op->frames, new_frames, msg_head->nframes * op->cfsiz);
+
op->flags = msg_head->flags;
- /* only lock for unlikely count/nframes/currframe changes */
if (op->nframes != msg_head->nframes ||
- op->flags & TX_RESET_MULTI_IDX ||
- op->flags & SETTIMER) {
-
- spin_lock_bh(&op->bcm_tx_lock);
+ op->flags & TX_RESET_MULTI_IDX) {
+ /* potentially update changed nframes */
+ op->nframes = msg_head->nframes;
+ /* restart multiple frame transmission */
+ op->currframe = 0;
+ }
- if (op->nframes != msg_head->nframes ||
- op->flags & TX_RESET_MULTI_IDX) {
- /* potentially update changed nframes */
- op->nframes = msg_head->nframes;
- /* restart multiple frame transmission */
- op->currframe = 0;
- }
+ if (op->flags & SETTIMER)
+ op->count = msg_head->count;
- if (op->flags & SETTIMER)
- op->count = msg_head->count;
+ spin_unlock_bh(&op->bcm_tx_lock);
- spin_unlock_bh(&op->bcm_tx_lock);
- }
+ kfree(new_frames);
} else {
/* insert new BCM operation for the given can_id */
@@ -1118,10 +1162,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (op->flags & SETTIMER) {
/* set timer values */
+ spin_lock_bh(&op->bcm_tx_lock);
op->ival1 = msg_head->ival1;
op->ival2 = msg_head->ival2;
op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
+ spin_unlock_bh(&op->bcm_tx_lock);
/* disable an active timer due to zero values? */
if (!op->kt_ival1 && !op->kt_ival2)
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 016/484] can: bcm: validate frame length in bcm_rx_setup() for RTR replies
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 015/484] can: bcm: extend bcm_tx_lock usage for data and timer updates Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 017/484] can: bcm: add missing device refcount for CAN filter removal Greg Kroah-Hartman
` (473 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 62ec41f364648be79d54d94d0d240ee326948afd upstream.
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits
before installing frames for TX_SETUP, but bcm_rx_setup() never did
the same for the RTR-reply frame configured via RX_SETUP with
RX_RTR_FRAME.
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-7-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 59 +++++++++++++++++++++++++++++++++++----------------
1 file changed, 41 insertions(+), 18 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index ab94caa2d006b0..f7733e61690613 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1199,22 +1199,37 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
return err;
}
-static void bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
- struct bcm_op *op, void *new_frames)
+static int bcm_rx_setup_rtr_check(struct bcm_msg_head *msg_head,
+ struct bcm_op *op, void *new_frames)
{
+ struct canfd_frame *frame0 = new_frames;
+
+ if (!(msg_head->flags & RX_RTR_FRAME))
+ return 0;
+
+ /* this frame is sent out as-is by bcm_can_tx() whenever a matching
+ * remote request is received, so validate its length the same way
+ * bcm_tx_setup() validates TX_SETUP frames before installing it
+ */
+ if (msg_head->flags & CAN_FD_FRAME) {
+ if (frame0->len > 64)
+ return -EINVAL;
+ } else {
+ if (frame0->len > 8)
+ return -EINVAL;
+ }
+
/* funny feature in RX(!)_SETUP only for RTR-mode:
* copy can_id into frame BUT without RTR-flag to
* prevent a full-load-loopback-test ... ;-]
* normalize this on the staged buffer, before it is
* ever installed into op->frames.
*/
- if (msg_head->flags & RX_RTR_FRAME) {
- struct canfd_frame *frame0 = new_frames;
+ if ((msg_head->flags & TX_CP_CAN_ID) ||
+ frame0->can_id == op->can_id)
+ frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
- if ((msg_head->flags & TX_CP_CAN_ID) ||
- frame0->can_id == op->can_id)
- frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
- }
+ return 0;
}
/*
@@ -1277,7 +1292,11 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
return err;
}
- bcm_rx_setup_rtr_check(msg_head, op, new_frames);
+ err = bcm_rx_setup_rtr_check(msg_head, op, new_frames);
+ if (err < 0) {
+ kfree(new_frames);
+ return err;
+ }
}
spin_lock_bh(&op->bcm_rx_update_lock);
@@ -1350,16 +1369,12 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes) {
err = memcpy_from_msg(op->frames, msg,
msg_head->nframes * op->cfsiz);
- if (err < 0) {
- if (op->frames != &op->sframe)
- kfree(op->frames);
- if (op->last_frames != &op->last_sframe)
- kfree(op->last_frames);
- kfree(op);
- return err;
- }
+ if (err < 0)
+ goto free_op;
- bcm_rx_setup_rtr_check(msg_head, op, op->frames);
+ err = bcm_rx_setup_rtr_check(msg_head, op, op->frames);
+ if (err < 0)
+ goto free_op;
}
/* bcm_can_tx / bcm_tx_timeout_handler needs this */
@@ -1461,6 +1476,14 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
}
return msg_head->nframes * op->cfsiz + MHSIZ;
+
+free_op:
+ if (op->frames != &op->sframe)
+ kfree(op->frames);
+ if (op->last_frames != &op->last_sframe)
+ kfree(op->last_frames);
+ kfree(op);
+ return err;
}
/*
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 017/484] can: bcm: add missing device refcount for CAN filter removal
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 016/484] can: bcm: validate frame length in bcm_rx_setup() for RTR replies Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 018/484] can: bcm: fix stale rx/tx ops after device removal Greg Kroah-Hartman
` (472 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit d59948293ea34b6337ce2b5febab8510de70048c upstream.
sashiko-bot remarked a problem with a concurrent device unregistration
in isotp.c which also is present in the bcm.c code. A former fix for raw.c
commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix")
introduced a netdevice_tracker which solves the issue for bcm.c too.
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on
dev_get_by_index(ifindex) to re-find the device for an rx_op before
unregistering its filter. If a concurrent NETDEV_UNREGISTER has already
unlisted the device from the ifindex table, that lookup fails and
can_rx_unregister() is silently skipped, leaving a stale CAN filter
pointing at the soon-to-be-freed bcm_op/socket.
Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev
from the moment the rx filter is registered in bcm_rx_setup() until it
is unregistered in bcm_rx_unreg(), and use that reference directly in
bcm_release() and bcm_delete_rx_op() instead of re-looking the device
up by ifindex.
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260707094716.63578-1-socketcan@hartkopp.net
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-8-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 44 ++++++++++++++++++++++++--------------------
1 file changed, 24 insertions(+), 20 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index f7733e61690613..b37e494de256b6 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -889,6 +889,7 @@ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
/* mark as removed subscription */
op->rx_reg_dev = NULL;
+ dev_put(dev);
} else
printk(KERN_ERR "can-bcm: bcm_rx_unreg: registered device "
"mismatch %p %p\n", op->rx_reg_dev, dev);
@@ -919,17 +920,14 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
* Only remove subscriptions that had not
* been removed due to NETDEV_UNREGISTER
* in bcm_notifier()
+ *
+ * op->rx_reg_dev is a tracked reference taken
+ * when the subscription was registered, so it
+ * stays valid here even if a concurrent
+ * NETDEV_UNREGISTER already unlisted the dev.
*/
- if (op->rx_reg_dev) {
- struct net_device *dev;
-
- dev = dev_get_by_index(sock_net(op->sk),
- op->ifindex);
- if (dev) {
- bcm_rx_unreg(dev, op);
- dev_put(dev);
- }
- }
+ if (op->rx_reg_dev)
+ bcm_rx_unreg(op->rx_reg_dev, op);
} else
can_rx_unregister(sock_net(op->sk), NULL,
op->can_id,
@@ -1452,7 +1450,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
bcm_rx_handler, op,
"bcm", sk);
- op->rx_reg_dev = dev;
+ /* keep a reference so that a later
+ * unregister can safely reach the device even
+ * if a concurrent NETDEV_UNREGISTER has
+ * already unlisted it by ifindex
+ */
+ if (!err) {
+ op->rx_reg_dev = dev;
+ dev_hold(dev);
+ }
dev_put(dev);
} else {
/* the requested device is gone - do not
@@ -1825,16 +1831,14 @@ static int bcm_release(struct socket *sock)
* Only remove subscriptions that had not
* been removed due to NETDEV_UNREGISTER
* in bcm_notifier()
+ *
+ * op->rx_reg_dev is a tracked reference taken
+ * when the subscription was registered, so it
+ * stays valid here even if a concurrent
+ * NETDEV_UNREGISTER already unlisted the device.
*/
- if (op->rx_reg_dev) {
- struct net_device *dev;
-
- dev = dev_get_by_index(net, op->ifindex);
- if (dev) {
- bcm_rx_unreg(dev, op);
- dev_put(dev);
- }
- }
+ if (op->rx_reg_dev)
+ bcm_rx_unreg(op->rx_reg_dev, op);
} else
can_rx_unregister(net, NULL, op->can_id,
REGMASK(op->can_id),
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 018/484] can: bcm: fix stale rx/tx ops after device removal
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 017/484] can: bcm: add missing device refcount for CAN filter removal Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 019/484] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Greg Kroah-Hartman
` (471 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 3b762c0d950383ab7a002686c9136b9aa55d2d70 upstream.
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
unconditionally, even when a concurrent NETDEV_UNREGISTER had already
torn down its registration (op->rx_reg_dev == NULL). This silently
did not re-enable frame delivery for that updated filter. bcm_rx_setup()
now re-registers in that case, while leaving rx_ops with ifindex = 0
(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.
TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving
tx_ops with an active cyclic transmission re-arming its hrtimer
indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer
prevents the runaway timer and any injection into a later reused ifindex,
since nothing else calls bcm_can_tx() for the op until an explicit
TX_SETUP update re-arms it.
Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,
the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()
always rejects ifindex 0, so clearing it would strand the op: neither a
later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could
ever find it again, since both require an exact ifindex match.
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260708094536.DDF821F00A3A@smtp.kernel.org/
Closes: https://lore.kernel.org/linux-can/20260708154039.347ED1F000E9@smtp.kernel.org/
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-9-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 54 +++++++++++++++++++++++++++++++++++++++++----------
1 file changed, 44 insertions(+), 10 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index b37e494de256b6..80d065b5ebe467 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1239,6 +1239,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
struct bcm_sock *bo = bcm_sk(sk);
struct bcm_op *op;
int do_rx_register;
+ int new_op = 0;
int err = 0;
if ((msg_head->flags & RX_FILTER_ID) || (!(msg_head->nframes))) {
@@ -1323,8 +1324,15 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* free temporary frames / kfree(NULL) is safe */
kfree(new_frames);
- /* Only an update -> do not call can_rx_register() */
- do_rx_register = 0;
+ /* Don't register a new CAN filter for the rx_op update unless
+ * a concurrent NETDEV_UNREGISTER notifier already tore down
+ * the previous registration. In this case the receiver needs
+ * to be re-registered here so that this update doesn't
+ * silently stop delivering frames for the given ifindex.
+ * Ops with ifindex = 0 (all CAN interfaces) never carry a
+ * tracked rx_reg_dev and stay registered as-is.
+ */
+ do_rx_register = (ifindex && !op->rx_reg_dev) ? 1 : 0;
} else {
/* insert new BCM operation for the given can_id */
@@ -1394,6 +1402,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
/* call can_rx_register() */
do_rx_register = 1;
+ new_op = 1;
} /* if ((op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex))) */
@@ -1407,7 +1416,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (op->flags & SETTIMER) {
/* set timers (locked) for newly created op */
- if (do_rx_register) {
+ if (new_op) {
spin_lock_bh(&op->bcm_rx_update_lock);
op->ival1 = msg_head->ival1;
op->ival2 = msg_head->ival2;
@@ -1437,7 +1446,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
HRTIMER_MODE_REL_SOFT);
}
- /* now we can register for can_ids, if we added a new bcm_op */
+ /* now we can register for can_ids, if we added a new bcm_op
+ * or need to re-register after a NETDEV_UNREGISTER tore down
+ * the previous registration of an existing op
+ */
if (do_rx_register) {
if (ifindex) {
struct net_device *dev;
@@ -1467,18 +1479,32 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
err = -ENODEV;
}
- } else
+ } else {
err = can_rx_register(sock_net(sk), NULL, op->can_id,
REGMASK(op->can_id),
bcm_rx_handler, op, "bcm", sk);
+ }
+
if (err) {
- /* this bcm rx op is broken -> remove it */
- bcm_remove_op(op);
+ /* newly created bcm rx op is broken -> remove it */
+ if (new_op) {
+ bcm_remove_op(op);
+ return err;
+ }
+
+ /* an existing op just stays unregistered.
+ * Cancel op->timer and (defensively) op->thrtimer.
+ * Other settings can't be reached until the next
+ * successful RX_SETUP.
+ */
+ hrtimer_cancel(&op->timer);
+ hrtimer_cancel(&op->thrtimer);
return err;
}
- /* add this bcm_op to the list of the rx_ops */
- list_add_rcu(&op->list, &bo->rx_ops);
+ /* add a new bcm_op to the list of the rx_ops */
+ if (new_op)
+ list_add_rcu(&op->list, &bo->rx_ops);
}
return msg_head->nframes * op->cfsiz + MHSIZ;
@@ -1694,11 +1720,19 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
case NETDEV_UNREGISTER:
lock_sock(sk);
- /* remove device specific receive entries */
+ /* rx_ops: remove device specific receive entries */
list_for_each_entry(op, &bo->rx_ops, list)
if (op->rx_reg_dev == dev)
bcm_rx_unreg(dev, op);
+ /* tx_ops: stop device specific cyclic transmissions on the
+ * vanishing ifindex. Cancelling the timer is enough to stop
+ * cyclic bcm_can_tx() calls as there is no re-arming.
+ */
+ list_for_each_entry(op, &bo->tx_ops, list)
+ if (op->ifindex == dev->ifindex)
+ hrtimer_cancel(&op->timer);
+
/* remove device reference, if this is our bound device */
if (bo->bound && bo->ifindex == dev->ifindex) {
#if IS_ENABLED(CONFIG_PROC_FS)
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 019/484] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 018/484] can: bcm: fix stale rx/tx ops after device removal Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 020/484] can: bcm: track a single source interface for ANYDEV timeout/throttle ops Greg Kroah-Hartman
` (470 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 upstream.
For an rx op subscribed on all interfaces (ifindex == 0), the same op
is registered once in the shared per-netns wildcard filter list, so
bcm_rx_handler() can run concurrently on different CPUs for frames
arriving on different net devices.
op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was
taken, allowing concurrent writers to race each other - including a torn
store of the 64-bit rx_stamp on 32-bit platforms.
Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex
of the very same frame whose content it is delivering. So the assignment
is placed in the same unbroken bcm_rx_update_lock section as the content
comparison.
As a side effect, the RTR-request frame feature (which never reach
bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only
the notification path needs them.
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260707145135.5BC831F00A3A@smtp.kernel.org/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-10-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 80d065b5ebe467..0869630a0dc06b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -761,11 +761,6 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
/* disable timeout */
hrtimer_cancel(&op->timer);
- /* save rx timestamp */
- op->rx_stamp = skb->tstamp;
- /* save originator for recvfrom() */
- op->rx_ifindex = skb->dev->ifindex;
-
/* op->flags/op->frames may be updated concurrently by bcm_rx_setup() */
spin_lock_bh(&op->bcm_rx_update_lock);
@@ -789,6 +784,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
*/
bcm_update_rx_stats(op);
+ /* save rx timestamp and originator for recvfrom() under lock.
+ * For an op subscribed on all interfaces (ifindex == 0)
+ * bcm_rx_handler() can run concurrently on different CPUs so
+ * the CAN content and the meta data must be bundled correctly.
+ */
+ op->rx_stamp = skb->tstamp;
+ op->rx_ifindex = skb->dev->ifindex;
+
if (op->flags & RX_FILTER_ID) {
/* the easiest case */
bcm_rx_update_and_send(op, op->last_frames, rxframe);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 020/484] can: bcm: track a single source interface for ANYDEV timeout/throttle ops
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 019/484] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 021/484] can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Greg Kroah-Hartman
` (469 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 2f5976f54a04e9f18b25283036ac3136be453b17 upstream.
An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or
throttle timer has no defined semantics when matching frames arrive
from several interfaces: bcm_rx_handler() can run concurrently for
the same op on different CPUs, racing hrtimer_cancel()/
bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing
spurious RX_TIMEOUT notifications and last_frames corruption. The
same concurrency lets throttled multiplex frames from different
interfaces clobber the single rx_ifindex/rx_stamp fields shared by
the op.
Add op->if_detected to track the first interface that delivers a
matching frame while a timeout/throttle timer is configured, and
reject frames from any other interface for that op. The claim is
decided in bcm_rx_handler() before hrtimer_cancel() touches
op->timer, so a rejected frame can never disturb the claimed
interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,
independent of kt_ival1/kt_ival2, since those may briefly hold a
stale value from an earlier non-RTR configuration.
The claim is released in bcm_notify() on NETDEV_UNREGISTER and in
bcm_rx_setup() when SETTIMER reconfigures the timer values.
A (re-)claim is only possible on CAN devices in NETREG_REGISTERED
dev->reg_state to cover the release in bcm_notify() where reg_state
becomes NETREG_UNREGISTERING until synchronize_net().
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260709105031.1A39C1F000E9@smtp.kernel.org/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-11-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/bcm.c | 49 ++++++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 44 insertions(+), 5 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0869630a0dc06b..fcd923c223f4ba 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -114,6 +114,7 @@ struct bcm_op {
struct hrtimer timer, thrtimer;
ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
int rx_ifindex;
+ int if_detected; /* first received ifindex in ANYDEV rx_op mode */
int cfsiz;
u32 count;
u32 nframes;
@@ -758,6 +759,33 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
return;
}
+ /* An ANYDEV op with an active RX timeout and/or throttle timer
+ * tracks a single source interface: claim the first interface that
+ * delivers a matching frame and reject frames from any other one,
+ * before hrtimer_cancel() below can touch op->timer - this avoids
+ * racing bcm_rx_timeout_handler() across concurrent interfaces.
+ * RX_RTR_FRAME ops are excluded, as kt_ival1/kt_ival2 may briefly
+ * hold a stale value from an earlier non-RTR configuration.
+ */
+ if (!op->ifindex) {
+ spin_lock_bh(&op->bcm_rx_update_lock);
+
+ if (!(op->flags & RX_RTR_FRAME) &&
+ (op->kt_ival1 || op->kt_ival2)) {
+ /* don't claim to vanishing interface */
+ if (!op->if_detected &&
+ skb->dev->reg_state == NETREG_REGISTERED)
+ op->if_detected = skb->dev->ifindex;
+
+ if (op->if_detected != skb->dev->ifindex) {
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+ return;
+ }
+ }
+
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+ }
+
/* disable timeout */
hrtimer_cancel(&op->timer);
@@ -784,10 +812,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
*/
bcm_update_rx_stats(op);
- /* save rx timestamp and originator for recvfrom() under lock.
- * For an op subscribed on all interfaces (ifindex == 0)
- * bcm_rx_handler() can run concurrently on different CPUs so
- * the CAN content and the meta data must be bundled correctly.
+ /* save rx timestamp and originator for recvfrom() under lock: an
+ * ANYDEV op without an active timer can still run concurrently on
+ * different CPUs, so content and meta data must be bundled here.
*/
op->rx_stamp = skb->tstamp;
op->rx_ifindex = skb->dev->ifindex;
@@ -1321,6 +1348,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
op->kt_lastmsg = 0;
+ op->if_detected = 0; /* reclaim ifindex in ANYDEV mode */
}
spin_unlock_bh(&op->bcm_rx_update_lock);
@@ -1724,10 +1752,21 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
lock_sock(sk);
/* rx_ops: remove device specific receive entries */
- list_for_each_entry(op, &bo->rx_ops, list)
+ list_for_each_entry(op, &bo->rx_ops, list) {
if (op->rx_reg_dev == dev)
bcm_rx_unreg(dev, op);
+ /* release an ANYDEV op's claim (see bcm_rx_handler())
+ * on this now confirmed-gone interface.
+ */
+ if (!op->ifindex) {
+ spin_lock_bh(&op->bcm_rx_update_lock);
+ if (op->if_detected == dev->ifindex)
+ op->if_detected = 0;
+ spin_unlock_bh(&op->bcm_rx_update_lock);
+ }
+ }
+
/* tx_ops: stop device specific cyclic transmissions on the
* vanishing ifindex. Cancelling the timer is enough to stop
* cyclic bcm_can_tx() calls as there is no re-arming.
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 021/484] can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 020/484] can: bcm: track a single source interface for ANYDEV timeout/throttle ops Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 022/484] can: isotp: serialize TX state transitions under so->rx_lock Greg Kroah-Hartman
` (468 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 20bab8b88baac140ca3701116e1d486c7f51e311 upstream.
isotp_release() looked up the bound network device via dev_get_by_index()
using the stored ifindex. During device unregistration the device is
unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier
chain runs, so a concurrent isotp_release() could find no device, skip
can_rx_unregister() entirely, and still proceed to free the socket.
Since isotp_release() had already removed itself from the isotp
notifier list at that point, isotp_notify() would never get a chance to
clean up either, leaving a stale CAN filter that keeps pointing at the
freed socket.
Fix this the same way raw.c already does: hold a tracked reference to
the bound net_device in the socket (so->dev/so->dev_tracker) from
bind() onward instead of re-resolving it from the ifindex, and
serialize bind()/release() with rtnl_lock() so that so->dev is always
consistent with what the NETDEV_UNREGISTER notifier sees. so->dev
stays valid regardless of ifindex-hash unlisting, and is only ever
cleared by whichever of isotp_release()/isotp_notify() gets there
first, so the filter is always removed exactly once.
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state
isn't ISOTP_IDLE yet, so a timer left running by a prior
NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks
share the same lock_sock() section, so there is no window in which a
concurrent isotp_notify() clearing so->bound could be missed.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260707101420.47F261F000E9@smtp.kernel.org/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260712-isotp-fixes-v10-2-793a1b1ce17f@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/isotp.c | 88 +++++++++++++++++++++++++++++++++----------------
1 file changed, 59 insertions(+), 29 deletions(-)
diff --git a/net/can/isotp.c b/net/can/isotp.c
index 80adf7366e63a8..b906fcdb386cd4 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -150,6 +150,7 @@ struct isotp_sock {
struct sock sk;
int bound;
int ifindex;
+ struct net_device *dev;
canid_t txid;
canid_t rxid;
ktime_t tx_gap;
@@ -962,6 +963,14 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
goto err_event_drop;
}
+ /* so->bound is only checked once above - a wakeup may have
+ * unbound/rebound the socket meanwhile, so re-validate it
+ */
+ if (!so->bound) {
+ err = -EADDRNOTAVAIL;
+ goto err_out_drop;
+ }
+
/* PDU size > default => try max_pdu_size */
if (size > so->tx.buflen && so->tx.buflen < max_pdu_size) {
u8 *newbuf = kmalloc(max_pdu_size, GFP_KERNEL);
@@ -1197,28 +1206,30 @@ static int isotp_release(struct socket *sock)
list_del(&so->notifier);
spin_unlock(&isotp_notifier_lock);
+ rtnl_lock();
lock_sock(sk);
- /* remove current filters & unregister */
- if (so->bound) {
- if (so->ifindex) {
- struct net_device *dev;
-
- dev = dev_get_by_index(net, so->ifindex);
- if (dev) {
- if (isotp_register_rxid(so))
- can_rx_unregister(net, dev, so->rxid,
- SINGLE_MASK(so->rxid),
- isotp_rcv, sk);
-
- can_rx_unregister(net, dev, so->txid,
- SINGLE_MASK(so->txid),
- isotp_rcv_echo, sk);
- dev_put(dev);
- }
- }
+ /* remove current filters & unregister
+ * tracked reference so->dev is taken at bind() time with rtnl_lock
+ */
+ if (so->bound && so->dev) {
+ if (isotp_register_rxid(so))
+ can_rx_unregister(net, so->dev, so->rxid,
+ SINGLE_MASK(so->rxid),
+ isotp_rcv, sk);
+
+ can_rx_unregister(net, so->dev, so->txid,
+ SINGLE_MASK(so->txid),
+ isotp_rcv_echo, sk);
+ dev_put(so->dev);
}
+ so->ifindex = 0;
+ so->bound = 0;
+ so->dev = NULL;
+
+ rtnl_unlock();
+
/* Always wait for a grace period before touching the timers below.
* A concurrent NETDEV_UNREGISTER may have already unregistered our
* filters and cleared so->bound in isotp_notify() without waiting
@@ -1231,9 +1242,6 @@ static int isotp_release(struct socket *sock)
hrtimer_cancel(&so->txtimer);
hrtimer_cancel(&so->rxtimer);
- so->ifindex = 0;
- so->bound = 0;
-
sock_orphan(sk);
sock->sk = NULL;
@@ -1287,6 +1295,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
if (!addr->can_ifindex)
return -ENODEV;
+ rtnl_lock();
lock_sock(sk);
if (so->bound) {
@@ -1294,6 +1303,17 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
goto out;
}
+ /* A transmission or reception that outlived a previous binding
+ * (unbound by NETDEV_UNREGISTER) may still be draining; the FC/echo
+ * and RX watchdog timers bound how long this takes. Checked together
+ * with so->bound in the same lock_sock() section above, so there is
+ * no window in which a concurrent isotp_notify() could be missed.
+ */
+ if (so->tx.state != ISOTP_IDLE || so->rx.state != ISOTP_IDLE) {
+ err = -EAGAIN;
+ goto out;
+ }
+
/* ensure different CAN IDs when the rx_id is to be registered */
if (isotp_register_rxid(so) && rx_id == tx_id) {
err = -EADDRNOTAVAIL;
@@ -1306,14 +1326,12 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
goto out;
}
if (dev->type != ARPHRD_CAN) {
- dev_put(dev);
err = -ENODEV;
- goto out;
+ goto out_put_dev;
}
- if (dev->mtu < so->ll.mtu) {
- dev_put(dev);
+ if (READ_ONCE(dev->mtu) < so->ll.mtu) {
err = -EINVAL;
- goto out;
+ goto out_put_dev;
}
if (!(dev->flags & IFF_UP))
notify_enetdown = 1;
@@ -1331,16 +1349,25 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id),
isotp_rcv_echo, sk, "isotpe", sk);
- dev_put(dev);
-
/* switch to new settings */
so->ifindex = ifindex;
so->rxid = rx_id;
so->txid = tx_id;
so->bound = 1;
+ /* bind() ok -> hold a reference for so->dev so that isotp_release()
+ * can safely reach the device later, even if a concurrent
+ * NETDEV_UNREGISTER has already unlisted it by ifindex.
+ */
+ so->dev = dev;
+ dev_hold(so->dev);
+
+out_put_dev:
+ /* remove potential reference from dev_get_by_index() */
+ dev_put(dev);
out:
release_sock(sk);
+ rtnl_unlock();
if (notify_enetdown) {
sk->sk_err = ENETDOWN;
@@ -1543,7 +1570,7 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,
if (!net_eq(dev_net(dev), sock_net(sk)))
return;
- if (so->ifindex != dev->ifindex)
+ if (so->dev != dev)
return;
switch (msg) {
@@ -1559,10 +1586,12 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,
can_rx_unregister(dev_net(dev), dev, so->txid,
SINGLE_MASK(so->txid),
isotp_rcv_echo, sk);
+ dev_put(so->dev);
}
so->ifindex = 0;
so->bound = 0;
+ so->dev = NULL;
release_sock(sk);
sk->sk_err = ENODEV;
@@ -1622,6 +1651,7 @@ static int isotp_init(struct sock *sk)
so->ifindex = 0;
so->bound = 0;
+ so->dev = NULL;
so->opt.flags = CAN_ISOTP_DEFAULT_FLAGS;
so->opt.ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 022/484] can: isotp: serialize TX state transitions under so->rx_lock
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 021/484] can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 023/484] dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Greg Kroah-Hartman
` (467 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Oliver Hartkopp, stable,
Marc Kleine-Budde, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit cf070fe33bfbd1a4c21236078fadb35dd223a157 upstream.
The TX state machine (so->tx.state) is driven from three contexts:
sendmsg() claiming and progressing a transfer, the RX path consuming
Flow Control/echo frames, and two hrtimers timing out a stalled
transfer. Mixing a lock-free cmpxchg() claim in sendmsg() with
hrtimer_cancel() calls made under so->rx_lock elsewhere left windows
where a frame or timer callback could act on a state that had already
moved on, corrupting an unrelated transfer.
so->rx_lock now covers the full lifecycle of a TX claim: sendmsg()
takes it to check so->tx.state is ISOTP_IDLE, switch it to
ISOTP_SENDING, bump so->tx_gen and drain the previous transfer's
timers - all as one critical section. isotp_rcv_fc()/isotp_rcv_cf()
already run under this lock via isotp_rcv(), and isotp_rcv_echo() now
takes it itself, so none of them can ever observe a transfer mid-claim.
This also means a transfer can no longer be handed to sendmsg()'s
cleanup paths (signal or send error) while another thread is
concurrently claiming or finishing it, so those paths can cancel
timers and reset the state unconditionally.
isotp_release() claims the socket the same way, so a racing sendmsg()
sees a consistent ISOTP_SHUTDOWN and skips arming its timer or sending.
Only the hrtimer callbacks stay outside so->rx_lock, since they run
under so->rx_lock's cancellation elsewhere and taking it themselves
would deadlock. so->tx_gen lets them recognize whether the transfer
they timed out is still the one currently active, so they don't
report an error against a transfer that has since completed or been
superseded.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260710142146.BDAE61F000E9@smtp.kernel.org/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260712-isotp-fixes-v10-3-793a1b1ce17f@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/isotp.c | 192 ++++++++++++++++++++++++++++++++++++++----------
1 file changed, 154 insertions(+), 38 deletions(-)
diff --git a/net/can/isotp.c b/net/can/isotp.c
index b906fcdb386cd4..efc5eeac7c8861 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -155,7 +155,7 @@ struct isotp_sock {
canid_t rxid;
ktime_t tx_gap;
ktime_t lastrxcf_tstamp;
- struct hrtimer rxtimer, txtimer, txfrtimer;
+ struct hrtimer rxtimer, txtimer, txfrtimer, echotimer;
struct can_isotp_options opt;
struct can_isotp_fc_options rxfc, txfc;
struct can_isotp_ll_options ll;
@@ -163,6 +163,7 @@ struct isotp_sock {
u32 force_tx_stmin;
u32 force_rx_stmin;
u32 cfecho; /* consecutive frame echo tag */
+ u32 tx_gen; /* generation, bumped per new tx transfer */
struct tpcon rx, tx;
struct list_head notifier;
wait_queue_head_t wait;
@@ -369,6 +370,15 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)
hrtimer_cancel(&so->txtimer);
+ /* isotp_tx_timeout() may have given up on this job while
+ * hrtimer_cancel() above waited for it to finish; so->rx_lock
+ * (held by our caller isotp_rcv()) rules out a concurrent claim,
+ * so a plain recheck is enough here.
+ */
+ if (so->tx.state != ISOTP_WAIT_FC &&
+ so->tx.state != ISOTP_WAIT_FIRST_FC)
+ return 1;
+
if ((cf->len < ae + FC_CONTENT_SZ) ||
((so->opt.flags & ISOTP_CHECK_PADDING) &&
check_pad(so, cf, ae + FC_CONTENT_SZ, so->opt.rxpad_content))) {
@@ -414,7 +424,7 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)
so->tx.bs = 0;
so->tx.state = ISOTP_SENDING;
/* send CF frame and enable echo timeout handling */
- hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
+ hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
HRTIMER_MODE_REL_SOFT);
isotp_send_cframe(so);
break;
@@ -567,6 +577,14 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
hrtimer_cancel(&so->rxtimer);
+ /* isotp_rx_timer_handler() may have raced us for so->rx.state
+ * while hrtimer_cancel() above waited for it to finish, already
+ * reporting ETIMEDOUT and resetting the reception; don't process
+ * this CF into a reassembly that has already been given up on.
+ */
+ if (so->rx.state != ISOTP_WAIT_DATA)
+ return 1;
+
/* CFs are never longer than the FF */
if (cf->len > so->rx.ll_dl)
return 1;
@@ -856,20 +874,36 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data)
struct canfd_frame *cf = (struct canfd_frame *)skb->data;
/* only handle my own local echo CF/SF skb's (no FF!) */
- if (skb->sk != sk || so->cfecho != *(u32 *)cf->data)
+ if (skb->sk != sk)
return;
+ /* unlike isotp_rcv_fc()/isotp_rcv_cf(), not already under so->rx_lock
+ * (no isotp_rcv() caller here), so take it ourselves
+ */
+ spin_lock(&so->rx_lock);
+
+ /* so->cfecho may since belong to a new transfer; recheck under lock */
+ if (so->cfecho != *(u32 *)cf->data)
+ goto out_unlock;
+
/* cancel local echo timeout */
- hrtimer_cancel(&so->txtimer);
+ hrtimer_cancel(&so->echotimer);
/* local echo skb with consecutive frame has been consumed */
so->cfecho = 0;
+ /* claiming a transfer also takes so->rx_lock, so a plain recheck
+ * is enough: so->tx.state can't have flipped to ISOTP_SENDING for
+ * a new claim while we're still in here
+ */
+ if (so->tx.state != ISOTP_SENDING)
+ goto out_unlock;
+
if (so->tx.idx >= so->tx.len) {
/* we are done */
so->tx.state = ISOTP_IDLE;
wake_up_interruptible(&so->wait);
- return;
+ goto out_unlock;
}
if (so->txfc.bs && so->tx.bs >= so->txfc.bs) {
@@ -877,53 +911,83 @@ static void isotp_rcv_echo(struct sk_buff *skb, void *data)
so->tx.state = ISOTP_WAIT_FC;
hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0),
HRTIMER_MODE_REL_SOFT);
- return;
+ goto out_unlock;
}
/* no gap between data frames needed => use burst mode */
if (!so->tx_gap) {
/* enable echo timeout handling */
- hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
+ hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
HRTIMER_MODE_REL_SOFT);
isotp_send_cframe(so);
- return;
+ goto out_unlock;
}
/* start timer to send next consecutive frame with correct delay */
hrtimer_start(&so->txfrtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT);
+
+out_unlock:
+ spin_unlock(&so->rx_lock);
}
-static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
+/* shared by so->txtimer's and so->echotimer's callbacks. Both timers get
+ * cancelled under so->rx_lock elsewhere, so this must stay lock-free to
+ * avoid deadlocking with that; uses so->tx_gen instead to avoid tainting
+ * a new transfer with an error from the one that just timed out.
+ */
+static enum hrtimer_restart isotp_tx_timeout(struct isotp_sock *so)
{
- struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
- txtimer);
struct sock *sk = &so->sk;
+ u32 gen = READ_ONCE(so->tx_gen);
+ u32 old_state = READ_ONCE(so->tx.state);
/* don't handle timeouts in IDLE or SHUTDOWN state */
- if (so->tx.state == ISOTP_IDLE || so->tx.state == ISOTP_SHUTDOWN)
+ if (old_state == ISOTP_IDLE || old_state == ISOTP_SHUTDOWN)
+ return HRTIMER_NORESTART;
+
+ /* only claim the timeout if the state is still unchanged */
+ if (cmpxchg(&so->tx.state, old_state, ISOTP_IDLE) != old_state)
return HRTIMER_NORESTART;
/* we did not get any flow control or echo frame in time */
- /* report 'communication error on send' */
- sk->sk_err = ECOMM;
- if (!sock_flag(sk, SOCK_DEAD))
- sk_error_report(sk);
+ if (READ_ONCE(so->tx_gen) == gen) {
+ /* report 'communication error on send' */
+ sk->sk_err = ECOMM;
+ if (!sock_flag(sk, SOCK_DEAD))
+ sk_error_report(sk);
+ }
- /* reset tx state */
- so->tx.state = ISOTP_IDLE;
wake_up_interruptible(&so->wait);
return HRTIMER_NORESTART;
}
+/* so->txtimer: fires when a Flow Control frame does not arrive in time */
+static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
+{
+ struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
+ txtimer);
+
+ return isotp_tx_timeout(so);
+}
+
+/* so->echotimer: fires when a sent CF/SF's local echo does not arrive */
+static enum hrtimer_restart isotp_echo_timer_handler(struct hrtimer *hrtimer)
+{
+ struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
+ echotimer);
+
+ return isotp_tx_timeout(so);
+}
+
static enum hrtimer_restart isotp_txfr_timer_handler(struct hrtimer *hrtimer)
{
struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
txfrtimer);
/* start echo timeout handling and cover below protocol error */
- hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
+ hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
HRTIMER_MODE_REL_SOFT);
/* cfecho should be consumed by isotp_rcv_echo() here */
@@ -943,13 +1007,24 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0;
s64 hrtimer_sec = ISOTP_ECHO_TIMEOUT;
+ struct hrtimer *tx_hrt = &so->echotimer;
+ u32 new_state = ISOTP_SENDING;
int off;
int err;
if (!so->bound || so->tx.state == ISOTP_SHUTDOWN)
return -EADDRNOTAVAIL;
- while (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) {
+ /* claim the socket under so->rx_lock: this serializes the claim
+ * with the RX path and with sendmsg()'s own error paths below, so
+ * none of them can ever see a transfer mid-claim
+ */
+ for (;;) {
+ spin_lock_bh(&so->rx_lock);
+ if (READ_ONCE(so->tx.state) == ISOTP_IDLE)
+ break;
+ spin_unlock_bh(&so->rx_lock);
+
/* we do not support multiple buffers - for now */
if (msg->msg_flags & MSG_DONTWAIT)
return -EAGAIN;
@@ -958,11 +1033,23 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
return -EADDRNOTAVAIL;
/* wait for complete transmission of current pdu */
- err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+ err = wait_event_interruptible(so->wait,
+ so->tx.state == ISOTP_IDLE);
if (err)
- goto err_event_drop;
+ return err;
}
+ /* new transfer: bump so->tx_gen and drain the old one's timers,
+ * still under the so->rx_lock we just claimed the socket with
+ */
+ WRITE_ONCE(so->tx.state, ISOTP_SENDING);
+ WRITE_ONCE(so->tx_gen, READ_ONCE(so->tx_gen) + 1);
+ hrtimer_cancel(&so->txtimer);
+ hrtimer_cancel(&so->echotimer);
+ hrtimer_cancel(&so->txfrtimer);
+ so->cfecho = 0;
+ spin_unlock_bh(&so->rx_lock);
+
/* so->bound is only checked once above - a wakeup may have
* unbound/rebound the socket meanwhile, so re-validate it
*/
@@ -1073,18 +1160,33 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
so->cfecho = *(u32 *)cf->data;
} else {
/* standard flow control check */
- so->tx.state = ISOTP_WAIT_FIRST_FC;
+ new_state = ISOTP_WAIT_FIRST_FC;
/* start timeout for FC */
hrtimer_sec = ISOTP_FC_TIMEOUT;
+ tx_hrt = &so->txtimer;
/* no CF echo tag for isotp_rcv_echo() (FF-mode) */
so->cfecho = 0;
}
}
- hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0),
+ spin_lock_bh(&so->rx_lock);
+ if (so->tx.state == ISOTP_SHUTDOWN) {
+ /* isotp_release() has since taken over and already drained
+ * our timers - don't send into a socket that's going away
+ */
+ spin_unlock_bh(&so->rx_lock);
+ kfree_skb(skb);
+ dev_put(dev);
+ wake_up_interruptible(&so->wait);
+ return -EADDRNOTAVAIL;
+ }
+ /* WAIT_FIRST_FC for standard FF, else stays ISOTP_SENDING */
+ so->tx.state = new_state;
+ hrtimer_start(tx_hrt, ktime_set(hrtimer_sec, 0),
HRTIMER_MODE_REL_SOFT);
+ spin_unlock_bh(&so->rx_lock);
/* send the first or only CAN frame */
cf->flags = so->ll.tx_flags;
@@ -1097,13 +1199,10 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
__func__, ERR_PTR(err));
+ spin_lock_bh(&so->rx_lock);
/* no transmission -> no timeout monitoring */
- hrtimer_cancel(&so->txtimer);
-
- /* reset consecutive frame echo tag */
- so->cfecho = 0;
-
- goto err_out_drop;
+ hrtimer_cancel(tx_hrt);
+ goto err_out_drop_locked;
}
if (wait_tx_done) {
@@ -1119,14 +1218,21 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
return size;
+err_out_drop:
+ /* claimed but nothing sent yet - no timer to cancel */
+ spin_lock_bh(&so->rx_lock);
+ goto err_out_drop_locked;
err_event_drop:
- /* got signal: force tx state machine to be idle */
- so->tx.state = ISOTP_IDLE;
+ /* interrupted waiting on our own transfer - drain its timers */
+ spin_lock_bh(&so->rx_lock);
hrtimer_cancel(&so->txfrtimer);
hrtimer_cancel(&so->txtimer);
-err_out_drop:
- /* drop this PDU and unlock a potential wait queue */
+ hrtimer_cancel(&so->echotimer);
+err_out_drop_locked:
+ /* release the claim; so->rx_lock still held from above */
+ so->cfecho = 0;
so->tx.state = ISOTP_IDLE;
+ spin_unlock_bh(&so->rx_lock);
wake_up_interruptible(&so->wait);
return err;
@@ -1188,13 +1294,20 @@ static int isotp_release(struct socket *sock)
so = isotp_sk(sk);
net = sock_net(sk);
- /* wait for complete transmission of current pdu */
- while (wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE) == 0 &&
- cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SHUTDOWN) != ISOTP_IDLE)
+ /* best-effort: wait for a running pdu to finish, but don't block on
+ * it forever - give up after the first signal
+ */
+ while (so->tx.state != ISOTP_IDLE &&
+ wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE) == 0)
;
- /* force state machines to be idle also when a signal occurred */
+ /* claim the socket under so->rx_lock like sendmsg() does, so its
+ * claim can't race the forced ISOTP_SHUTDOWN below; force it
+ * unconditionally, even when a signal cut the wait above short
+ */
+ spin_lock_bh(&so->rx_lock);
so->tx.state = ISOTP_SHUTDOWN;
+ spin_unlock_bh(&so->rx_lock);
so->rx.state = ISOTP_IDLE;
spin_lock(&isotp_notifier_lock);
@@ -1240,6 +1353,7 @@ static int isotp_release(struct socket *sock)
hrtimer_cancel(&so->txfrtimer);
hrtimer_cancel(&so->txtimer);
+ hrtimer_cancel(&so->echotimer);
hrtimer_cancel(&so->rxtimer);
sock_orphan(sk);
@@ -1682,6 +1796,8 @@ static int isotp_init(struct sock *sk)
so->rxtimer.function = isotp_rx_timer_handler;
hrtimer_init(&so->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
so->txtimer.function = isotp_tx_timer_handler;
+ hrtimer_init(&so->echotimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
+ so->echotimer.function = isotp_echo_timer_handler;
hrtimer_init(&so->txfrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
so->txfrtimer.function = isotp_txfr_timer_handler;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 023/484] dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 022/484] can: isotp: serialize TX state transitions under so->rx_lock Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 024/484] accel/ivpu: Reject firmware log with size smaller than header Greg Kroah-Hartman
` (466 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, John Madieu,
Claudiu Beznea, Tommaso Merciai, Vinod Koul, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 731712403ddb39d1a76a11abf339a0615bc85de7 upstream.
Once the interrupt is requested, the interrupt handler may run immediately.
Since the IRQ handler can access channel->ch_base, which is initialized
only after requesting the IRQ, this may lead to invalid memory access.
Likewise, the IRQ thread may access uninitialized data (the ld_free,
ld_queue, and ld_active lists), which may also lead to issues.
Request the interrupts only after everything is set up. To keep the error
path simpler, use dmam_alloc_coherent() instead of dma_alloc_coherent().
Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: John Madieu <john.madieu.xa@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260526084710.3491480-2-claudiu.beznea@kernel.org
[tm: Kept the channel->irq field in rz_dmac_chan_probe() instead of
upstream's local `irq` variable, as commit 04e227718ab8
("dmaengine: sh: rz-dmac: Make channel irq local") is not present
in this tree. Likewise kept platform_get_irq_byname() instead of
platform_get_irq_byname_optional() for the error IRQ in rz_dmac_probe(),
as commit 6b3a6b6dc074 ("dmaengine: sh: rz_dmac: make error interrupt
optional") is not present in this tree either; its early return on
failure becomes a goto err jump to match the new call order.]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/rz-dmac.c | 96 ++++++++++++++++------------------------
1 file changed, 38 insertions(+), 58 deletions(-)
diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c
index e5d89bc1bb83e7..63bcec46b01d7b 100644
--- a/drivers/dma/sh/rz-dmac.c
+++ b/drivers/dma/sh/rz-dmac.c
@@ -777,27 +777,6 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac,
channel->index = index;
channel->mid_rid = -EINVAL;
- /* Request the channel interrupt. */
- sprintf(pdev_irqname, "ch%u", index);
- channel->irq = platform_get_irq_byname(pdev, pdev_irqname);
- if (channel->irq < 0)
- return channel->irq;
-
- irqname = devm_kasprintf(dmac->dev, GFP_KERNEL, "%s:%u",
- dev_name(dmac->dev), index);
- if (!irqname)
- return -ENOMEM;
-
- ret = devm_request_threaded_irq(dmac->dev, channel->irq,
- rz_dmac_irq_handler,
- rz_dmac_irq_handler_thread, 0,
- irqname, channel);
- if (ret) {
- dev_err(dmac->dev, "failed to request IRQ %u (%d)\n",
- channel->irq, ret);
- return ret;
- }
-
/* Set io base address for each channel */
if (index < 8) {
channel->ch_base = dmac->base + CHANNEL_0_7_OFFSET +
@@ -810,9 +789,9 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac,
}
/* Allocate descriptors */
- lmdesc = dma_alloc_coherent(&pdev->dev,
- sizeof(struct rz_lmdesc) * DMAC_NR_LMDESC,
- &channel->lmdesc.base_dma, GFP_KERNEL);
+ lmdesc = dmam_alloc_coherent(&pdev->dev,
+ sizeof(struct rz_lmdesc) * DMAC_NR_LMDESC,
+ &channel->lmdesc.base_dma, GFP_KERNEL);
if (!lmdesc) {
dev_err(&pdev->dev, "Can't allocate memory (lmdesc)\n");
return -ENOMEM;
@@ -828,7 +807,26 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac,
INIT_LIST_HEAD(&channel->ld_free);
INIT_LIST_HEAD(&channel->ld_active);
- return 0;
+ /* Request the channel interrupt. */
+ sprintf(pdev_irqname, "ch%u", index);
+ channel->irq = platform_get_irq_byname(pdev, pdev_irqname);
+ if (channel->irq < 0)
+ return channel->irq;
+
+ irqname = devm_kasprintf(dmac->dev, GFP_KERNEL, "%s:%u",
+ dev_name(dmac->dev), index);
+ if (!irqname)
+ return -ENOMEM;
+
+ ret = devm_request_threaded_irq(dmac->dev, channel->irq,
+ rz_dmac_irq_handler,
+ rz_dmac_irq_handler_thread, 0,
+ irqname, channel);
+ if (ret)
+ dev_err(dmac->dev, "failed to request IRQ %u (%d)\n",
+ channel->irq, ret);
+
+ return ret;
}
static int rz_dmac_parse_of(struct device *dev, struct rz_dmac *dmac)
@@ -855,7 +853,6 @@ static int rz_dmac_probe(struct platform_device *pdev)
const char *irqname = "error";
struct dma_device *engine;
struct rz_dmac *dmac;
- int channel_num;
unsigned int i;
int ret;
int irq;
@@ -885,19 +882,6 @@ static int rz_dmac_probe(struct platform_device *pdev)
if (IS_ERR(dmac->ext_base))
return PTR_ERR(dmac->ext_base);
- /* Register interrupt handler for error */
- irq = platform_get_irq_byname(pdev, irqname);
- if (irq < 0)
- return irq;
-
- ret = devm_request_irq(&pdev->dev, irq, rz_dmac_irq_handler, 0,
- irqname, NULL);
- if (ret) {
- dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",
- irq, ret);
- return ret;
- }
-
/* Initialize the channels. */
INIT_LIST_HEAD(&dmac->engine.channels);
@@ -923,6 +907,21 @@ static int rz_dmac_probe(struct platform_device *pdev)
goto err;
}
+ /* Register interrupt handler for error */
+ irq = platform_get_irq_byname(pdev, irqname);
+ if (irq < 0) {
+ ret = irq;
+ goto err;
+ }
+
+ ret = devm_request_irq(&pdev->dev, irq, rz_dmac_irq_handler, 0,
+ irqname, NULL);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",
+ irq, ret);
+ goto err;
+ }
+
/* Register the DMAC as a DMA provider for DT. */
ret = of_dma_controller_register(pdev->dev.of_node, rz_dmac_of_xlate,
NULL);
@@ -961,16 +960,6 @@ static int rz_dmac_probe(struct platform_device *pdev)
dma_register_err:
of_dma_controller_free(pdev->dev.of_node);
err:
- channel_num = i ? i - 1 : 0;
- for (i = 0; i < channel_num; i++) {
- struct rz_dmac_chan *channel = &dmac->channels[i];
-
- dma_free_coherent(&pdev->dev,
- sizeof(struct rz_lmdesc) * DMAC_NR_LMDESC,
- channel->lmdesc.base,
- channel->lmdesc.base_dma);
- }
-
reset_control_assert(dmac->rstc);
err_pm_runtime_put:
pm_runtime_put(&pdev->dev);
@@ -983,18 +972,9 @@ static int rz_dmac_probe(struct platform_device *pdev)
static int rz_dmac_remove(struct platform_device *pdev)
{
struct rz_dmac *dmac = platform_get_drvdata(pdev);
- unsigned int i;
dma_async_device_unregister(&dmac->engine);
of_dma_controller_free(pdev->dev.of_node);
- for (i = 0; i < dmac->n_channels; i++) {
- struct rz_dmac_chan *channel = &dmac->channels[i];
-
- dma_free_coherent(&pdev->dev,
- sizeof(struct rz_lmdesc) * DMAC_NR_LMDESC,
- channel->lmdesc.base,
- channel->lmdesc.base_dma);
- }
reset_control_assert(dmac->rstc);
pm_runtime_put(&pdev->dev);
pm_runtime_disable(&pdev->dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 024/484] accel/ivpu: Reject firmware log with size smaller than header
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 023/484] dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 025/484] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Greg Kroah-Hartman
` (465 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jhonraushan, Karol Wachowski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jhonraushan <raushan.jhon@gmail.com>
commit ddb44baed257560f192b145ed36cf8c0a412de47 upstream.
fw_log_from_bo() validates the tracing buffer header_size and that the
log fits within the BO, but never checks that log->size is at least
log->header_size. fw_log_print_buffer() then computes:
u32 data_size = log->size - log->header_size;
which underflows to a near-U32_MAX value when firmware reports a log whose
size is smaller than its header. That huge data_size defeats the
log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
Add bounds checks for firmware log indices"), so fw_log_print_lines() reads
far past the small real data region of the BO. A size of 0 also makes
fw_log_from_bo() advance the offset by 0, causing the callers to loop
forever on the same header.
Reject logs whose size is smaller than the header (which also rejects
size == 0).
Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
Cc: stable@vger.kernel.org
Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260715074206.867712-1-raushan.jhon@gmail.com
Signed-off-by: Raushan Patel <raushan.jhon@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/accel/ivpu/ivpu_fw_log.c b/drivers/accel/ivpu/ivpu_fw_log.c
index 95065cac9fbdc4..ccad9aa99e5d64 100644
--- a/drivers/accel/ivpu/ivpu_fw_log.c
+++ b/drivers/accel/ivpu/ivpu_fw_log.c
@@ -43,6 +43,10 @@ static int fw_log_ptr(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,
ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
return -EINVAL;
}
+ if (log->size < log->header_size) {
+ ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+ return -EINVAL;
+ }
if ((char *)log + log->size > (char *)bo->kvaddr + bo->base.size) {
ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 025/484] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 024/484] accel/ivpu: Reject firmware log with size smaller than header Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 026/484] xprtrdma: Clear receive-side ownership pointers on release Greg Kroah-Hartman
` (464 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 266cddf7bd0f6c79b6c0633aef742a22bf70265b ]
__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/bus.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 6b8b7395a4189e..8a4e0738014d6c 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -1006,10 +1006,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
if (WARN_ON(!cache))
continue;
- mutex_lock(&mapping->cache->lock);
+ mutex_lock(&cache->lock);
WARN_ON(kref_read(&mapping->ref) != 1);
__host1x_bo_unpin(&mapping->ref);
- mutex_unlock(&mapping->cache->lock);
+ mutex_unlock(&cache->lock);
}
}
EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 026/484] xprtrdma: Clear receive-side ownership pointers on release
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 025/484] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 027/484] Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Greg Kroah-Hartman
` (463 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuck Lever, Anna Schumaker,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 2ae8e7afbc63bf84243367f89eb43571f0345a74 ]
Three small ownership-state cleanups land the transport in a
state that lets future reviewers reason about each pointer
locally rather than tracing the whole reply path:
rpcrdma_rep_put() clears rep->rr_rqst before the rep enters
rb_free_reps so that no rep on the free list still carries a
stale rqst pointer. rpcrdma_reply_handler() and
rpcrdma_unpin_rqst() are the only sites that set rr_rqst;
rpcrdma_reply_handler() hands the rep through
rpcrdma_rep_put(), and rpcrdma_unpin_rqst() NULLs rr_rqst
directly because its error path abandons the rep for
teardown cleanup rather than returning it to rb_free_reps.
rpcrdma_reply_put() NULLs req->rl_reply before calling
rpcrdma_rep_put(). The previous order placed the rep on
rb_free_reps while req->rl_reply still pointed at it; the
window was harmless because xprt_rdma_free_slot() holds the
req exclusively across the pair, but closing it makes the
invariant 'rep on rb_free_reps implies no req references it'
strictly checkable.
rpcrdma_sendctx_unmap() and rpcrdma_sendctx_cancel() clear
req->rl_sendctx after dropping the sendctx pointer in the
sendctx ring. Without this, req->rl_sendctx survives across
Send completion and points at a sendctx that may already have
been reassigned by rpcrdma_sendctx_get_locked() to a different
req. No caller dereferences the stale pointer today --
rpcrdma_prepare_send_sges() overwrites it before the next
Send -- but a NULL is a more honest representation of 'the
Send is no longer outstanding' and lets the assertion patch
that follows trip on any future regression.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++++
net/sunrpc/xprtrdma/verbs.c | 12 ++++++++++--
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e201b37578a70e..aa57e057ff451f 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -542,6 +542,7 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
rpcrdma_sendctx_dma_unmap(sc);
sc->sc_req = NULL;
+ req->rl_sendctx = NULL;
rpcrdma_req_put(req);
}
@@ -550,8 +551,11 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
*/
static void rpcrdma_sendctx_cancel(struct rpcrdma_sendctx *sc)
{
+ struct rpcrdma_req *req = sc->sc_req;
+
rpcrdma_sendctx_dma_unmap(sc);
sc->sc_req = NULL;
+ req->rl_sendctx = NULL;
}
/* Prepare an SGE for the RPC-over-RDMA transport header.
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 27bb176f082f63..a97f0b18ac4294 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1067,9 +1067,15 @@ static struct rpcrdma_rep *rpcrdma_rep_get_locked(struct rpcrdma_buffer *buf)
* @buf: buffer pool
* @rep: rep to release
*
+ * The rep's transient association with an rpc_rqst, established
+ * by rpcrdma_reply_handler() and torn down here, must not survive
+ * onto rb_free_reps: rpcrdma_post_recvs() pulls reps from the free
+ * list to re-post them, and a non-NULL rr_rqst on a free-listed rep
+ * would imply the rep is still referenced by a req.
*/
void rpcrdma_rep_put(struct rpcrdma_buffer *buf, struct rpcrdma_rep *rep)
{
+ rep->rr_rqst = NULL;
llist_add(&rep->rr_node, &buf->rb_free_reps);
}
@@ -1252,9 +1258,11 @@ rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt)
*/
void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req)
{
- if (req->rl_reply) {
- rpcrdma_rep_put(buffers, req->rl_reply);
+ struct rpcrdma_rep *rep = req->rl_reply;
+
+ if (rep) {
req->rl_reply = NULL;
+ rpcrdma_rep_put(buffers, rep);
}
/* I2: rl_reply NULL after the put closes the
* 'rep on rb_free_reps still referenced by req' window.
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 027/484] Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 026/484] xprtrdma: Clear receive-side ownership pointers on release Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 028/484] Input: ims-pcu - fix logic error in packet reset Greg Kroah-Hartman
` (462 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanghoon Choi, Seungjin Bae,
Dmitry Torokhov, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 875115b82c295277b81b6dfee7debc725f44e854 ]
The `ims_pcu_process_data()` processes incoming URB data byte by byte.
However, it fails to check if the `read_pos` index exceeds
IMS_PCU_BUF_SIZE.
If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE,
`read_pos` will increment indefinitely. Moreover, since `read_pos` is
located immediately after `read_buf`, the attacker can overwrite
`read_pos` itself to arbitrarily control the index.
This manipulated `read_pos` is subsequently used in
`ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a
heap buffer overflow.
Specifically, an attacker can overwrite the `cmd_done.wait.head` located
at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`.
Consequently, when the driver calls `complete(&pcu->cmd_done)`, it
triggers a control flow hijack by using the manipulated pointer.
Fix this by adding a bounds check for `read_pos` before writing to
`read_buf`. If the packet is too long, discard it, log a warning,
and reset the parser state.
Fixes: 628329d524743 ("Input: add IMS Passenger Control Unit driver")
Co-developed-by: Sanghoon Choi <csh0052@gmail.com>
Signed-off-by: Sanghoon Choi <csh0052@gmail.com>
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://patch.msgid.link/20251221211442.841549-2-eeodqql09@gmail.com
[dtor: factor out resetting packet state, reset checksum as well]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/ims-pcu.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 2bac9d9c7b0c9c..af1dfc08b10b25 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -448,6 +448,14 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu)
}
}
+static void ims_pcu_reset_packet(struct ims_pcu *pcu)
+{
+ pcu->have_stx = true;
+ pcu->have_dle = false;
+ pcu->read_pos = 0;
+ pcu->check_sum = 0;
+}
+
static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
{
int i;
@@ -460,6 +468,14 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
continue;
if (pcu->have_dle) {
+ if (pcu->read_pos >= IMS_PCU_BUF_SIZE) {
+ dev_warn(pcu->dev,
+ "Packet too long (%d bytes), discarding\n",
+ pcu->read_pos);
+ ims_pcu_reset_packet(pcu);
+ continue;
+ }
+
pcu->have_dle = false;
pcu->read_buf[pcu->read_pos++] = data;
pcu->check_sum += data;
@@ -472,10 +488,8 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
dev_warn(pcu->dev,
"Unexpected STX at byte %d, discarding old data\n",
pcu->read_pos);
+ ims_pcu_reset_packet(pcu);
pcu->have_stx = true;
- pcu->have_dle = false;
- pcu->read_pos = 0;
- pcu->check_sum = 0;
break;
case IMS_PCU_PROTOCOL_DLE:
@@ -495,12 +509,18 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
ims_pcu_handle_response(pcu);
}
- pcu->have_stx = false;
- pcu->have_dle = false;
- pcu->read_pos = 0;
+ ims_pcu_reset_packet(pcu);
break;
default:
+ if (pcu->read_pos >= IMS_PCU_BUF_SIZE) {
+ dev_warn(pcu->dev,
+ "Packet too long (%d bytes), discarding\n",
+ pcu->read_pos);
+ ims_pcu_reset_packet(pcu);
+ continue;
+ }
+
pcu->read_buf[pcu->read_pos++] = data;
pcu->check_sum += data;
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 028/484] Input: ims-pcu - fix logic error in packet reset
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 027/484] Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 029/484] arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Greg Kroah-Hartman
` (461 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit 2c9b85a14abb4811e8d4773ccd13559e59792efb ]
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies
that the start-of-packet delimiter has already been received. This
causes the protocol parser to skip waiting for the next STX byte and
potentially process garbage data.
Correctly set have_stx to false when resetting the packet state.
Fixes: 875115b82c29 ("Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/ims-pcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index af1dfc08b10b25..6b2aeaa50812f2 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -450,7 +450,7 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu)
static void ims_pcu_reset_packet(struct ims_pcu *pcu)
{
- pcu->have_stx = true;
+ pcu->have_stx = false;
pcu->have_dle = false;
pcu->read_pos = 0;
pcu->check_sum = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 029/484] arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 028/484] Input: ims-pcu - fix logic error in packet reset Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 030/484] IB/mad: Drop unmatched RMPP responses before reassembly Greg Kroah-Hartman
` (460 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Gupta, Thierry Reding,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <sumitg@nvidia.com>
[ Upstream commit 0dfa1e960f86e032007882b032c5cc7d14ebe73e ]
The Tegra234 SoC uses Cortex-A78AE cores, not Cortex-A78. Update the
compatible string for all CPU nodes to match the actual hardware.
Tegra234 hardware reports:
# head /proc/cpuinfo | egrep 'implementer|part'
CPU implementer : 0x41
CPU part : 0xd42
Which maps to (from arch/arm64/include/asm/cputype.h):
#define ARM_CPU_IMP_ARM 0x41
#define ARM_CPU_PART_CORTEX_A78AE 0xD42
Fixes: a12cf5c339b08 ("arm64: tegra: Describe Tegra234 CPU hierarchy")
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
index d1d7f6a50e11f2..6decf99af5f089 100644
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -3109,7 +3109,7 @@ cpus {
#size-cells = <0>;
cpu0_0: cpu@0 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x00000>;
@@ -3128,7 +3128,7 @@ cpu0_0: cpu@0 {
};
cpu0_1: cpu@100 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x00100>;
@@ -3147,7 +3147,7 @@ cpu0_1: cpu@100 {
};
cpu0_2: cpu@200 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x00200>;
@@ -3166,7 +3166,7 @@ cpu0_2: cpu@200 {
};
cpu0_3: cpu@300 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x00300>;
@@ -3185,7 +3185,7 @@ cpu0_3: cpu@300 {
};
cpu1_0: cpu@10000 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x10000>;
@@ -3204,7 +3204,7 @@ cpu1_0: cpu@10000 {
};
cpu1_1: cpu@10100 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x10100>;
@@ -3223,7 +3223,7 @@ cpu1_1: cpu@10100 {
};
cpu1_2: cpu@10200 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x10200>;
@@ -3242,7 +3242,7 @@ cpu1_2: cpu@10200 {
};
cpu1_3: cpu@10300 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x10300>;
@@ -3261,7 +3261,7 @@ cpu1_3: cpu@10300 {
};
cpu2_0: cpu@20000 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x20000>;
@@ -3280,7 +3280,7 @@ cpu2_0: cpu@20000 {
};
cpu2_1: cpu@20100 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x20100>;
@@ -3299,7 +3299,7 @@ cpu2_1: cpu@20100 {
};
cpu2_2: cpu@20200 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x20200>;
@@ -3318,7 +3318,7 @@ cpu2_2: cpu@20200 {
};
cpu2_3: cpu@20300 {
- compatible = "arm,cortex-a78";
+ compatible = "arm,cortex-a78ae";
device_type = "cpu";
reg = <0x20300>;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 030/484] IB/mad: Drop unmatched RMPP responses before reassembly
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 029/484] arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 031/484] mtd: mtdswap: remove debugfs stats file on teardown Greg Kroah-Hartman
` (459 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Leon Romanovsky,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ]
Kernel-handled RMPP receive processing starts reassembly for active
DATA responses before the response is matched to an outstanding send.
The normal match happens later, after ib_process_rmpp_recv_wc() has
either assembled a complete message or consumed the segment.
That ordering lets an unsolicited response that routes to a kernel
RMPP agent by the high TID bits allocate or extend RMPP receive state
before the full TID and source address are checked against a real
request. A reordered burst can therefore reach the receive-side
insertion path even though the response would not match any send.
For kernel-handled RMPP DATA responses, require the existing
ib_find_send_mad() match before entering RMPP reassembly. The matcher
already checks the full TID, management class and source address/GID
against the agent wait, backlog and in-flight send lists. If there is
no match, drop the response without creating RMPP state.
This leaves the RMPP window behavior unchanged and only rejects
responses that have no corresponding request.
Fixes: fa619a77046b ("[PATCH] IB: Add RMPP implementation")
Assisted-by: Codex:gpt-5-5-xhigh
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/3170ff3bc389a930bb1641f2caa394a0b2241579.1780774907.git.michael.bommarito@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 242434c09e8d8f..bddb1c607aff62 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1778,6 +1778,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
&mad_send_wr->mad_agent_priv->done_list);
}
+static bool is_kernel_rmpp_data_response(struct ib_mad_agent_private *agent,
+ struct ib_mad_recv_wc *mad_recv_wc)
+{
+ const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
+ struct ib_rmpp_mad *rmpp_mad;
+
+ if (!ib_mad_kernel_rmpp_agent(&agent->agent) ||
+ !ib_response_mad(mad_hdr) ||
+ !ib_is_mad_class_rmpp(mad_hdr->mgmt_class))
+ return false;
+
+ rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+
+ return (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+ IB_MGMT_RMPP_FLAG_ACTIVE) &&
+ rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA;
+}
+
static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
struct ib_mad_recv_wc *mad_recv_wc)
{
@@ -1796,6 +1814,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
}
list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
+ if (is_kernel_rmpp_data_response(mad_agent_priv, mad_recv_wc)) {
+ spin_lock_irqsave(&mad_agent_priv->lock, flags);
+ mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
+ spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
+
+ if (!mad_send_wr) {
+ ib_free_recv_mad(mad_recv_wc);
+ deref_mad_agent(mad_agent_priv);
+ return;
+ }
+ }
+
if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
mad_recv_wc);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 031/484] mtd: mtdswap: remove debugfs stats file on teardown
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 030/484] IB/mad: Drop unmatched RMPP responses before reassembly Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 032/484] mtd: nand: mtk-ecc: stop on ECC idle timeouts Greg Kroah-Hartman
` (458 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Miquel Raynal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 66fb31358108d10245b9e4ef0eef3e7d9747055e ]
mtdswap_add_debugfs() creates an mtdswap_stats debugfs file under the
per-MTD debugfs directory, but mtdswap_remove_dev() never removes it
before freeing the mtdswap_dev.
Store the returned dentry and remove it during device teardown before the
driver-private state is freed.
Fixes: a32159024620 ("mtd: Add mtdswap block driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtdswap.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index 680366616da240..4d695875ea1b23 100644
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -125,6 +125,7 @@ struct mtdswap_dev {
char *page_buf;
char *oob_buf;
+ struct dentry *debugfs_stats;
};
struct mtdswap_oobdata {
@@ -1262,7 +1263,8 @@ static int mtdswap_add_debugfs(struct mtdswap_dev *d)
if (IS_ERR_OR_NULL(root))
return -1;
- debugfs_create_file("mtdswap_stats", S_IRUSR, root, d, &mtdswap_fops);
+ d->debugfs_stats = debugfs_create_file("mtdswap_stats", 0400, root,
+ d, &mtdswap_fops);
return 0;
}
@@ -1463,6 +1465,7 @@ static void mtdswap_remove_dev(struct mtd_blktrans_dev *dev)
{
struct mtdswap_dev *d = MTDSWAP_MBD_TO_MTDSWAP(dev);
+ debugfs_remove(d->debugfs_stats);
del_mtd_blktrans_dev(dev);
mtdswap_cleanup(d);
kfree(d);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 032/484] mtd: nand: mtk-ecc: stop on ECC idle timeouts
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 031/484] mtd: mtdswap: remove debugfs stats file on teardown Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 033/484] btrfs: reject free space cache with more entries than pages Greg Kroah-Hartman
` (457 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Miquel Raynal,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 16f7ec8d5dc100eafd2c8e06cd30340a30b104a1 ]
mtk_ecc_wait_idle() logs when the encoder or decoder does not become
idle, but returns void. Callers can therefore configure a non-idle ECC
engine or read parity bytes after an unconfirmed encoder idle state.
Return the idle poll result and propagate it from the enable and encode
paths that require the engine to be idle before continuing.
Fixes: 1d6b1e464950 ("mtd: mediatek: driver for MTK Smart Device")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/ecc-mtk.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/ecc-mtk.c b/drivers/mtd/nand/ecc-mtk.c
index c75bb8b80cc1e1..96703f0a418ea2 100644
--- a/drivers/mtd/nand/ecc-mtk.c
+++ b/drivers/mtd/nand/ecc-mtk.c
@@ -123,8 +123,8 @@ static int mt7622_ecc_regs[] = {
[ECC_DECIRQ_STA] = 0x144,
};
-static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
- enum mtk_ecc_operation op)
+static inline int mtk_ecc_wait_idle(struct mtk_ecc *ecc,
+ enum mtk_ecc_operation op)
{
struct device *dev = ecc->dev;
u32 val;
@@ -136,6 +136,8 @@ static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
if (ret)
dev_warn(dev, "%s NOT idle\n",
op == ECC_ENCODE ? "encoder" : "decoder");
+
+ return ret;
}
static irqreturn_t mtk_ecc_irq(int irq, void *id)
@@ -312,7 +314,11 @@ int mtk_ecc_enable(struct mtk_ecc *ecc, struct mtk_ecc_config *config)
return ret;
}
- mtk_ecc_wait_idle(ecc, op);
+ ret = mtk_ecc_wait_idle(ecc, op);
+ if (ret) {
+ mutex_unlock(&ecc->lock);
+ return ret;
+ }
ret = mtk_ecc_config(ecc, config);
if (ret) {
@@ -412,7 +418,9 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
if (ret)
goto timeout;
- mtk_ecc_wait_idle(ecc, ECC_ENCODE);
+ ret = mtk_ecc_wait_idle(ecc, ECC_ENCODE);
+ if (ret)
+ goto timeout;
/* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
len = (config->strength * ecc->caps->parity_bits + 7) >> 3;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 033/484] btrfs: reject free space cache with more entries than pages
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 032/484] mtd: nand: mtk-ecc: stop on ECC idle timeouts Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 034/484] btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Greg Kroah-Hartman
` (456 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Qu Wenruo, Xiang Mei,
David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit a2d8d5647ed854e38f941741aea45b9eb15a6350 ]
When loading a v1 free space cache, __load_free_space_cache() takes
num_entries and num_bitmaps straight from the on-disk
btrfs_free_space_header. That header is stored in the tree_root under a key
with type 0, which the tree-checker has no case for, so neither count is
validated before the load trusts it.
The load loops num_entries times and maps the next page whenever the current
one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which
does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in
io_ctl_init() from the cache inode's i_size, not from num_entries:
num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);
So if num_entries claims more records than the pages can hold, io_ctl->index
runs off the end of pages[]. The write side never hits this because
io_ctl_add_entry() and io_ctl_add_bitmap() both stop once
io_ctl->index >= io_ctl->num_pages; the read side just never had the same
check.
To trigger it, take a clean cache (num_entries = <N> here), set num_entries
in the header to 0x10000, and fix up the leaf checksum so it still passes
the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and
pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read
65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the
array:
BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58
io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
__load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)
load_free_space_cache (fs/btrfs/free-space-cache.c:1017)
caching_thread (fs/btrfs/block-group.c:880)
btrfs_work_helper (fs/btrfs/async-thread.c:312)
process_one_work
worker_thread
kthread
ret_from_fork
free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()
at line 565, which is why that is the frame KASAN names. The out-of-bounds
slot is then treated as a struct page and handed to crc32c(), so the bad
read turns into a GP fault.
Add the missing check to io_ctl_check_crc(), which is where both the entry
loop and the bitmap loop end up. When num_entries is too large the load now
fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds
the free space from the extent tree, so a valid cache is never rejected.
Reported-by: Weiming Shi <bestswngs@gmail.com>
Fixes: 5b0e95bf607d ("Btrfs: inline checksums into the disk free space cache")
Link: https://lore.kernel.org/linux-btrfs/CAPpSM+RMPByMCKXvM5QFKToxsyNccfuFLWMdD0mfd0wh2Ja62w@mail.gmail.com/
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/free-space-cache.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c6e3b9a2921ab1..8be5614ae9b620 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -559,6 +559,9 @@ static int io_ctl_check_crc(struct btrfs_io_ctl *io_ctl, int index)
u32 crc = ~(u32)0;
unsigned offset = 0;
+ if (index >= io_ctl->num_pages)
+ return -EIO;
+
if (index == 0)
offset = sizeof(u32) * io_ctl->num_pages;
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 034/484] btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 033/484] btrfs: reject free space cache with more entries than pages Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 035/484] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Greg Kroah-Hartman
` (455 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Johannes Thumshirn,
Filipe Manana, David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit ce6050bafb4e33377dc17fcc357736bfc351180c ]
If we have an unexpected reloc_root for our root, we jump to the out label
but never drop the reference we obtained for root, resulting in a leak.
Add a missing btrfs_put_root() call.
Fixes: 24213fa46c70 ("btrfs: do proper error handling in merge_reloc_roots")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/relocation.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 0f05eb97925fdd..90aacda2523eb5 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1991,6 +1991,7 @@ void merge_reloc_roots(struct reloc_control *rc)
* corruption, e.g. bad reloc tree key offset.
*/
ret = -EINVAL;
+ btrfs_put_root(root);
goto out;
}
ret = merge_reloc_root(rc, root);
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 035/484] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 034/484] btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 036/484] RDMA/cma: Fix hardware address comparison length in netevent callback Greg Kroah-Hartman
` (454 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Unnathi Chalicheemala, Sudeep Holla,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
[ Upstream commit 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8 ]
ffa_partition_info_get() passes uuid_str directly to uuid_parse()
without a NULL check. When a caller passes NULL, uuid_parse() ->
__uuid_parse() -> uuid_is_valid() dereferences the pointer, causing
a kernel panic:
| Unable to handle kernel NULL pointer dereference at virtual address
| 0000000000000040
| pc : uuid_parse+0x40/0xac
| lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns
-ENODEV instead of crashing. Callers are expected to always supply
a valid partition UUID, so NULL is not a supported input.
Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions")
Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
Link: https://patch.msgid.link/20260617-ffa_partition_nullptr_fix-v2-1-bc801b4ce34c@oss.qualcomm.com
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_ffa/driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index ece91d8d820b51..2309a31549e25a 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -582,7 +582,7 @@ static int ffa_partition_info_get(const char *uuid_str,
uuid_t uuid;
struct ffa_partition_info *pbuf;
- if (uuid_parse(uuid_str, &uuid)) {
+ if (!uuid_str || uuid_parse(uuid_str, &uuid)) {
pr_err("invalid uuid (%s)\n", uuid_str);
return -ENODEV;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 492+ messages in thread
* [PATCH 6.6 036/484] RDMA/cma: Fix hardware address comparison length in netevent callback
2026-07-30 14:08 [PATCH 6.6 000/484] 6.6.148-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-07-30 14:08 ` [PATCH 6.6 035/484] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Greg Kroah-Hartman
@ 2026-07-30 14:08 ` Greg Kroah-Hartman
2026-07-30 14:08 ` [PATCH 6.6 037/484] RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device Greg Kroah-Hartman
` (453 subsequent siblings)
489 siblings, 0 replies; 492+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-30 14:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Or Gerlitz, Leon Romanovsky,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <ogerlitz@ddn.com>
[ Upstream commit 18313833e2c6de222a4f6c072da759d0d5888528 ]
The cited commit hardcoded the hardware address comparison len to ETH_ALEN.
This breaks IPoIB, which uses 20-byte addresses. By truncating the
memcmp, the CMA may incorrectly assume the target address is
unchanged and fails to abort the stalled connection.
Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len
to correctly evaluate the full address regardless